Okta integration with Sentinel

Question

Has anyone had any experience with getting Okta events ingesting into Sentinel?&nbsp;

dev_choudhary · Answer

Hey&nbsp;Rod_Trent&nbsp;&nbsp;Thanks for sharing this. Initially I was looking for some connector but Now I have configured the logstash and able to ingest the okta events.

john_joyner · Answer

Dev_Choudharycan you please share insights in how to configure this integration? We are stuck on getting the "gem" plugins to install in logstash. Thank you so much, John (@ howdy Rod_Trent !)&nbsp;

rod_trent · Answer

Dev_Choudhary&nbsp;Have you had a chance to look at the Okta integration information here?
&nbsp;
https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-syslog-cef-logstash-and-other-3rd-party/ba-p/803891

dev_choudhary · Answer

Hi&nbsp;John_Joyner&nbsp;&nbsp;Please refer below link for okta plugin.https://rubygems.org/gems/logstash-input-okta_system_log&nbsp;&nbsp;Install this okta input plugin for Logstash and also install below output plugin for Sentinel&nbsp;https://github.com/yokawasa/logstash-output-azure_loganalytics

john_joyner · Answer

So appreciate your reply Dev_Choudhary we know about those two URLs, but are unsuccessful at installing the plugins. The good news is that a recent Playbook was made available with works perfectly and is so simple to get working compared to the logstash method:https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks/OktaRawLog#GoServerless!John&nbsp;

Forum Discussion

Okta integration with Sentinel

5 Replies

Resources