Apply metadata to logs to distinguish source

Question

Hi - I've added two Okta environments to Sentinel but there isnt anything in the log themselves to identify the source environment. Is there not some way in Sentinel to tag some metadata to the log so you can identify the source environment when you have multiples using the same connector?

On a side note, I just see in Sentinel that the Okta connector is "connected", not even totally sure how to confirm logs from both are being ingested.

Thanks in advance.

garybushey · Answer

shay126&nbsp;As this connector uses a Function app to make a call to the Okta's System log API and then saves all the information returned into the Log Analytics table, Okta_CL, it appears the only way for this to happen is if there is a way to change what Okta itself pushes to its logs.&nbsp;I would talk with your Okta Admin or Okta to see if this is possible.

yanivsh · Answer

Ofer_Shezaf&nbsp; thanks for adding me.
indeed i added Github issue to solve this issue&nbsp;https://github.com/Azure/Azure-Sentinel/issues/925
will update once it will publish

shay126 · Answer

GaryBushey&nbsp;Thanks Gary - is there an easy way to confirm both Okta environments are being ingested into Sentinel? I added both but not totally sure how to confirm they are both working...&nbsp;Shay

garybushey · Answer

shay126&nbsp;Not being an Okta expert I don't know.&nbsp; I don't have access to the table that Okta writes to in order to see what the fields look like.

shay126 · Answer

GaryBushey&nbsp;&nbsp;Thanks for the reply Gary. I think its more of a Sentinel thing though. Ideally under the Sentinel connector it would show its connected to X and Y Okta environments. I did look at logging in the function app and saw it listing an HTTP status of 200... so i think its working...

Forum Discussion

Apply metadata to logs to distinguish source

Share

Resources