Apply metadata to logs to distinguish source

[shay126]

Hi - I've added two Okta environments to Sentinel but there isnt anything in the log themselves to identify the source environment. Is there not some way in Sentinel to tag some metadata to the log so you can identify the source environment when you have multiples using the same connector?

On a side note, I just see in Sentinel that the Okta connector is "connected", not even totally sure how to confirm logs from both are being ingested. 

Thanks in advance.

[#2]

@shay126 As this connector uses a Function app to make a call to the Okta's System log API and then saves all the information returned into the Log Analytics table, Okta_CL, it appears the only way for this to happen is if there is a way to change what Okta itself pushes to its logs.

I would talk with your Okta Admin or Okta to see if this is possible.

[#3]

@Gary Bushey 

Thanks Gary - is there an easy way to confirm both Okta environments are being ingested into Sentinel? I added both but not totally sure how to confirm they are both working...

Shay

[#4]

@shay126 Not being an Okta expert I don't know.  I don't have access to the table that Okta writes to in order to see what the fields look like.

[#5]

@Gary Bushey 

Thanks for the reply Gary. I think its more of a Sentinel thing though. Ideally under the Sentinel connector it would show its connected to X and Y Okta environments. I did look at logging in the function app and saw it listing an HTTP status of 200... so i think its working...

[#6]

@shay126  There is nothing (yet) in Azure Sentinel that would do this.

[#7]

@Gary Bushey @shay126 : I beleve @YanivSh is working on an update to the connector that ass the Okta domain.

[#8]

@Ofer_Shezaf  thanks for adding me.

indeed i added Github issue to solve this issue https://github.com/Azure/Azure-Sentinel/issues/925

will update once it will publish