okta-identity

Okta Identity — detection authoring

Okta is a major non-Microsoft identity platform with its own telemetry schema, attack surface, and detection patterns. This skill covers the platform internals needed to write detections against Okta System Log events, regardless of which SIEM ingests them.

Not to be confused with entra-id (Microsoft Entra ID) or identity-providers (cross-vendor identity mechanics).

1. System Log event schema

Every Okta event follows a consistent JSON structure:

Key eventType taxonomy

2. Authentication flows

Standard sign-in flow

User → Okta sign-in page → Primary auth (password/IWA/delegated)
  → MFA challenge (push/TOTP/FIDO2/FastPass)
  → Session token issued → SSO to applications

Delegated authentication

When Okta delegates to Active Directory, the authenticationContext.authenticationProvider is ACTIVE_DIRECTORY and credentialType is IWA or LDAP_INTERFACE. The password is validated by AD, not Okta — Okta cannot detect password spray against delegated auth directly.

FastPass (Okta Verify device-bound)

FastPass is Okta's phishing-resistant authenticator. Key detection signal: user.authentication.auth_via_mfa with outcome.reason eq "FastPass declined phishing attempt" — this fires when FastPass detects an AiTM proxy.

Device code flow

eventType eq "user.authentication.auth_via_mfa" with authenticationContext.credentialType eq "DEVICE_CODE". Monitor for abuse — device code phishing is a growing attack vector.

3. Attack patterns

3.1 Cross-tenant impersonation (Scattered Spider pattern)

The most significant Okta-specific attack pattern. Flow:

1. Social engineer IT help desk to reset MFA for a Super Administrator
2. Enrol attacker-controlled MFA factors
3. Create a second Identity Provider (inbound federation)
4. Manipulate username parameter in source IdP to impersonate target users
5. SSO into applications as any user

Detection signals:

3.2 Session token theft (HAR file exfiltration)

Okta session tokens stolen from HAR files (browser network recordings shared with support). The externalSessionId in authenticationContext is the session correlation key.

Detection: Alert on session reuse from a different IP/ASN than the original authentication:

• Correlate externalSessionId across events
• Flag when client.ipAddress or securityContext.asNumber changes mid-session

3.3 MFA fatigue / push bombing

Repeated MFA push notifications to exhaust the user into approving.

Detection: eventType eq "user.authentication.auth_via_mfa" with outcome.result eq "FAILURE" — count failures per user per time window. Threshold: >5 failures in 10 minutes.

3.4 Admin API token abuse

API tokens provide persistent access without MFA. Stolen tokens enable silent admin operations.

Detection signals:

• eventType eq "system.api_token.create" — new token creation
• transaction.detail.requestApiTokenId present in events — identifies API-driven actions
• Correlate API token usage with client.ipAddress — flag novel IPs

3.5 Policy weakening

Attacker modifies authentication policies to remove MFA requirements or weaken session controls.

Detection: eventType sw "policy.lifecycle" — alert on any policy modification, especially:

• policy.rule.update where MFA requirements are removed
• policy.lifecycle.delete for authentication policies

4. ThreatInsight and behavioural signals

Okta ThreatInsight provides pre-built threat detection signals available in the System Log.

debugContext.debugData.behaviors is a JSON string containing Okta's behavioural analysis. Parse it to extract individual signals. Note: debugContext fields are unstable and may change between releases.

5. Okta Workflows and automation abuse

Risk: Okta Workflows can automate user provisioning, group membership changes, and external API calls. An attacker with admin access can create workflows that silently exfiltrate data or maintain persistence.

6. OAuth app and integration abuse

Risk: Attackers can create rogue app integrations to harvest OAuth tokens, or modify existing SAML app certificates to forge assertions.

7. SIEM ingestion patterns

Column/field names vary by SIEM and connector version. Consult your SIEM's Okta integration documentation for exact field mappings.

Content truncated.