[role="xpack"]

:modulename: okta
:has-dashboards: false

== Okta module

include::{libbeat-dir}/shared/integration-link.asciidoc[]

The Okta module collects events from the
https://developer.okta.com/docs/reference/[Okta API]. Specifically this supports
reading from the https://developer.okta.com/docs/reference/api/system-log/[Okta
System Log API].

:fileset_ex: system

include::../include/config-option-intro.asciidoc[]

[float]
==== `system` fileset settings

The Okta System Log records system events related to your organization in order
to provide an audit trail that can be used to understand platform activity and
to diagnose problems. This module is implemented using the
<<filebeat-input-httpjson,httpjson>> input and is configured to paginate through
the logs while honoring any
https://developer.okta.com/docs/reference/rate-limits/[rate-limiting] headers
sent by Okta.

This is an example configuration for the module.

[source,yaml]
----
- module: okta
  system:
    var.url: https://yourOktaDomain/api/v1/logs
    var.api_key: '00QCjAl4MlV-WPXM...0HmjFx-vbGua'
----

[float]
===== Configuration options

*`var.url`*::

Specifies the URL to the Okta System Log API. Required.
+
[source,yaml]
----
    var.url: https://mycompany.okta.com/api/v1/logs
----

*`var.api_key`*::

Specifies the Okta API token to use in requests to the API. Required.
The token is used in an HTTP `Authorization` header with the `SSWS` scheme.
See https://developer.okta.com/docs/guides/create-an-api-token/create-the-token/[
Create an API token] for information on how to obtain a token.
+
[source,yaml]
----
    var.api_key: '00QCjAl4MlV-WPXM...0HmjFx-vbGua'
----

*`var.http_client_timeout`*::

Duration of the time limit on HTTP requests made by the module. Defaults to
`60s`.

*`var.interval`*::

Duration between requests to the API. Defaults to `60s`.

*`var.keep_original_message`*::

Boolean flag indicating if the original JSON event string should be included in
the `event.original` field. Defaults to `true`.

*`var.ssl`*::

Configuration options for SSL parameters like the certificate authority to use
for HTTPS-based connections. If the `ssl` section is missing, the host CAs are
used for HTTPS connections to Okta. See <<configuration-ssl>> for more
information.
+
[source,yaml]
----
    var.ssl:
      supported_protocols: [TLSv1.2]
----

*`var.initial_interval`*::

An initial interval can be defined. The first time the module starts, will fetch events from the current moment minus the initial interval value. Following restarts will fetch events starting from the last event read. It defaults to `24h`.
+
[source,yaml]
----
    var.initial_interval: 24h # will fetch events starting 24h ago.
----

*`input.request.rate_limit.early_limit`*::

You can override the default rate-limiting behavior in <<filebeat-input-httpjson>>.
The default for the Okta module is to use up to 89% of the Okta rate-limit,
which should avoid Okta Warnings on rate-limit usage.
+
[source.yaml]
----
    input.request.rate_limit.early_limit: 0.89
----

[float]
=== Example dashboard

This module comes with a sample dashboard:

[role="screenshot"]
image::./images/filebeat-okta-dashboard.png[]

:has-dashboards!:

:fileset_ex!:

:modulename!:
