Forum Discussion

shay126's avatar
shay126
Copper Contributor
Jul 26, 2020

Apply metadata to logs to distinguish source

Hi - I've added two Okta environments to Sentinel but there isnt anything in the log themselves to identify the source environment. Is there not some way in Sentinel to tag some metadata to the log s...
shay126's avatar
shay126
Copper Contributor
Jul 28, 2020

GaryBushey 

Thanks Gary - is there an easy way to confirm both Okta environments are being ingested into Sentinel? I added both but not totally sure how to confirm they are both working...

 

Shay

GaryBushey's avatar
GaryBushey
Bronze Contributor
Jul 29, 2020

shay126 Not being an Okta expert I don't know.  I don't have access to the table that Okta writes to in order to see what the fields look like.

  • shay126's avatar
    shay126
    Copper Contributor
    Jul 29, 2020

    GaryBushey 

     

    Thanks for the reply Gary. I think its more of a Sentinel thing though. Ideally under the Sentinel connector it would show its connected to X and Y Okta environments. I did look at logging in the function app and saw it listing an HTTP status of 200... so i think its working...

    • GaryBushey's avatar
      GaryBushey
      Bronze Contributor
      Jul 29, 2020

      shay126  There is nothing (yet) in Azure Sentinel that would do this.

Resources