Type to search.

Okta fields

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Module for handling system logs from Okta.

okta

Fields from Okta.

okta.uuid

The unique identifier of the Okta LogEvent.

type: keyword

okta.event_type

The type of the LogEvent.

type: keyword

okta.version

The version of the LogEvent.

type: keyword

okta.severity

The severity of the LogEvent. Must be one of DEBUG, INFO, WARN, or ERROR.

type: keyword

okta.display_message

The display message of the LogEvent.

type: keyword

actor

Fields that let you store information of the actor for the LogEvent.

okta.actor.id

Identifier of the actor.

type: keyword

okta.actor.type

Type of the actor.

type: keyword

okta.actor.alternate_id

Alternate identifier of the actor.

type: keyword

okta.actor.display_name

Display name of the actor.

type: keyword

client

Fields that let you store information about the client of the actor.

okta.client.ip

The IP address of the client.

type: ip

user_agent

Fields about the user agent information of the client.

okta.client.user_agent.raw_user_agent

The raw information of the user agent.

type: keyword

okta.client.user_agent.os

The OS information.

type: keyword

okta.client.user_agent.browser

The browser information of the client.

type: keyword

okta.client.zone

The zone information of the client.

type: keyword

okta.client.device

The information of the client device.

type: keyword

okta.client.id

The identifier of the client.

type: keyword

outcome

Fields that let you store information about the outcome.

okta.outcome.reason

The reason of the outcome.

type: keyword

okta.outcome.result

The result of the outcome. Must be one of: SUCCESS, FAILURE, SKIPPED, ALLOW, DENY, CHALLENGE, UNKNOWN.

type: keyword

okta.target

The list of targets.

type: flattened

transaction

Fields that let you store information about related transaction.

okta.transaction.id

Identifier of the transaction.

type: keyword

okta.transaction.type

The type of transaction. Must be one of "WEB", "JOB".

type: keyword

debug_context

Fields that let you store information about the debug context.

debug_data

The debug data.

okta.debug_context.debug_data.device_fingerprint

The fingerprint of the device.

type: keyword

okta.debug_context.debug_data.factor

The factor used for authentication.

type: keyword

okta.debug_context.debug_data.request_id

The identifier of the request.

type: keyword

okta.debug_context.debug_data.request_uri

The request URI.

type: keyword

okta.debug_context.debug_data.threat_suspected

Threat suspected.

type: keyword

okta.debug_context.debug_data.risk_behaviors

The set of behaviors that contribute to a risk assessment.

type: keyword

okta.debug_context.debug_data.risk_level

The risk level assigned to the sign in attempt.

type: keyword

okta.debug_context.debug_data.risk_reasons

The reasons for the risk.

type: keyword

okta.debug_context.debug_data.url

The URL.

type: keyword

okta.debug_context.debug_data.flattened

The complete debug_data object.

type: flattened

suspicious_activity

The suspicious activity fields from the debug data.

okta.debug_context.debug_data.suspicious_activity.browser

The browser used.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_city

The city where the suspicious activity took place.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_country

The country where the suspicious activity took place.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_id

The event ID.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_ip

The IP of the suspicious event.

type: ip

okta.debug_context.debug_data.suspicious_activity.event_latitude

The latitude where the suspicious activity took place.

type: float

okta.debug_context.debug_data.suspicious_activity.event_longitude

The longitude where the suspicious activity took place.

type: float

okta.debug_context.debug_data.suspicious_activity.event_state

The state where the suspicious activity took place.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_transaction_id

The event transaction ID.

type: keyword

okta.debug_context.debug_data.suspicious_activity.event_type

The event type.

type: keyword

okta.debug_context.debug_data.suspicious_activity.os

The OS of the system from where the suspicious activity occurred.

type: keyword

okta.debug_context.debug_data.suspicious_activity.timestamp

The timestamp of when the activity occurred.

type: date

authentication_context

Fields that let you store information about authentication context.

okta.authentication_context.authentication_provider

The information about the authentication provider. Must be one of OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, FACTOR_PROVIDER.

type: keyword

okta.authentication_context.authentication_step

The authentication step.

type: integer

okta.authentication_context.credential_provider

The information about credential provider. Must be one of OKTA_CREDENTIAL_PROVIDER, RSA, SYMANTEC, GOOGLE, DUO, YUBIKEY.

type: keyword

okta.authentication_context.credential_type

The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID.

type: keyword

okta.authentication_context.issuer

The information about the issuer.

type: array

okta.authentication_context.external_session_id

The session identifier of the external session if any.

type: keyword

okta.authentication_context.interface

The interface used. e.g., Outlook, Office365, wsTrust

type: keyword

security_context

Fields that let you store information about security context.

as

The autonomous system.

okta.security_context.as.number

The AS number.

type: integer

organization

The organization that owns the AS number.

okta.security_context.as.organization.name

The organization name.

type: keyword

okta.security_context.isp

The Internet Service Provider.

type: keyword

okta.security_context.domain

The domain name.

type: keyword

okta.security_context.is_proxy

Whether it is a proxy or not.

type: boolean

request

Fields that let you store information about the request, in the form of list of ip_chain.

okta.request.ip_chain

List of ip_chain objects.

type: flattened