Source configuration for Okta SSO - Amazon CloudWatch

Integrating with Okta SSO Authenticating with Okta SSO Configuring the CloudWatch Pipeline Supported Open Cybersecurity Schema Framework Event Classes

Source configuration for Okta SSO

Integrating with Okta SSO

CloudWatch Pipeline uses the Okta System Log API to retrieve Authentication, API Activity, Detection Finding and Entity Management events from your Okta SSO tenant.

Authenticating with Okta SSO

To read the logs, the pipeline needs to authenticate with your Okta SSO tenant. For Okta SSO, authentication is performed using the OAuth 2.0 Client Credentials (JWT Assertion) flow through an Okta API Services application.

Generate the private/public key pair for authentication

Sign in to the Okta Admin Console using an administrator account.
Navigate to Applications → Applications.
Select an existing API Services Application or create a new one.
Under General → Client Credentials, upload a public key or generate a new key. This key pair will be used to authenticate using a signed JWT assertion.
Ensure the application has the required OAuth scopes assigned, specifically: okta.logs.read
Admin Roles → Edit assignments → Role(Select Read-only Administrator)
Copy the Client ID of the application.
Store the client_id and client_secret(private key) in AWS Secrets Manager: client_id and client_secret(private_key) (the RSA private key used to sign the JWT assertion)
Identify your Okta Organization URL and configure in the pipeline (for example: https://yourdomain.okta.com).

Once configured, the pipeline can authenticate using Okta's OAuth 2.0 Client Credentials (JWT Assertion) flow and begin retrieving audit log events from the Okta System Log API.

Configuring the CloudWatch Pipeline

To configure the pipeline to read logs, choose Okta SSO as the data source. Fill in the required information like Okta Domain name. Once you create and activate the pipeline, audit log data from Okta SSO will begin flowing into the selected CloudWatch Logs log group.

Supported Open Cybersecurity Schema Framework Event Classes

This integration supports OCSF schema version v1.5.0 and Okta events that map to Authentication (3002), API Activity (6003), Detection Finding (2004), and Entity Management (3004).

Authentication contains the following events:

user.authentication.auth
user.authentication.auth_via_AD_agent
user.authentication.auth_via_IDP
user.authentication.auth_via_LDAP_agent
user.authentication.auth_via_inbound_SAML
user.authentication.auth_via_inbound_delauth
user.authentication.auth_via_iwa
user.authentication.auth_via_mfa
user.authentication.auth_via_radius
user.authentication.auth_via_richclient
user.authentication.auth_via_social
user.authentication.authenticate
user.authentication.sso
user.session.start
user.session.impersonation.grant
app.oauth2.signon
user.session.impersonation.initiate
user.authentication.universal_logout
user.session.clear
user.session.end
user.authentication.slo
user.authentication.universal_logout.scheduled
user.session.expire
user.session.impersonation.end
user.authentication.verify
policy.evaluate_sign_on
user.mfa.attempt_bypass
user.mfa.okta_verify
user.mfa.okta_verify.deny_push
user.mfa.okta_verify.deny_push_upgrade_needed
user.mfa.factor.activate
user.mfa.factor.deactivate
user.mfa.factor.reset_all
user.mfa.factor.suspend
user.mfa.factor.unsuspend
user.mfa.factor.update
user.session.impersonation.extend
user.session.impersonation.revoke
user.session.access_admin_app
user.session.context.change
application.policy.sign_on.deny_access
user.authentication.auth_unconfigured_identifier
user.authentication.dsso_via_non_priority_source
app.oauth2.invalid_client_credentials
policy.auth_reevaluate.fail

API Activity contains the following events:

oauth2.claim.created
oauth2.scope.created
security.trusted_origin.create
system.api_token.create
workflows.user.table.view
app.oauth2.as.key.rollover
app.saml.sensitive.attribute.update
system.api_token.update
oauth2.claim.updated
oauth2.scope.updated
security.events.provider.deactivate
system.api_token.revoke
oauth2.claim.deleted
oauth2.scope.deleted

Detection Finding contains the following events:

security.attack.start
security.breached_credential.detected
security.request.blocked
security.threat.detected
security.zone.make_blacklist
system.rate_limit.violation
user.account.report_suspicious_activity_by_enduser
user.risk.change
user.risk.detect
zone.make_blacklist
security.attack.end

Entity Management contains the following events:

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Okta SSO

Pipeline configuration