Transcription
Integrate OKTA SSOEventTracker v9.x and abovePublication Date: April 2, 2019
Integrate OKTA SSOAbstractThis guide provides instructions to configure OKTA SSO to send the event logs to EventTracker Enterprise.Once events are configured to send to EventTracker Manager, alerts, dashboard and reports can be configuredinto EventTracker.ScopeThe configurations detailed in this guide are consistent with EventTracker Enterprise version 9.x and later,and OKTA SSO.AudienceOKTA SSO users, who wish to forward event logs to EventTracker Manager and monitor events using EventTracker Enterprise.The information contained in this document represents the current view of EventTracker. on theissues discussed as of the date of publication. Because EventTracker must respond to changingmarket conditions, it should not be interpreted to be a commitment on the part of EventTracker,and EventTracker cannot guarantee the accuracy of any information presented after the date ofpublication.This document is for informational purposes only. EventTracker MAKES NO WARRANTIES, EXPRESSOR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.Complying with all applicable copyright laws is the responsibility of the user. Without limiting therights under copyright, this paper may be freely distributed without permission from EventTracker,if its content is unaltered, nothing is added to the content and credit to EventTracker is provided.EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectualproperty rights covering subject matter in this document. Except as expressly provided in anywritten license agreement from EventTracker, the furnishing of this document does not give youany license to these patents, trademarks, copyrights, or other intellectual property.The example companies, organizations, products, people and events depicted herein are fictitious.No association with any real company, organization, product, person or event is intended or shouldbe inferred. 2019 EventTracker Security LLC. All rights reserved. The names of actual companies and productsmentioned herein may be the trademarks of their respective owners.1
Integrate OKTA SSOTable of ContentsAbstract . 1Scope . 1Audience . 1Overview. 3Prerequisites . 3Configure OKTA SSO to forward logs to EventTracker . 3Get API Key . 3Integration Steps . 5EventTracker Knowledge Pack (KP) . 7Alerts . 7Reports . 7Dashboards . 9Import Knowledge Pack into EventTracker . 12Tokens Template . 12Flex Reports . 13Alerts . 16Knowledge Objects . 17Dashlets . 18Verify Knowledge Pack in EventTracker . 21Token Template . 21Flex Reports . 21Alerts . 22Knowledge Object . 23Dashlets . 242
Integrate OKTA SSOOverviewOKTA SSO an enterprise-grade, identity management service, is built for the cloud, but compatible with manyon-premises applications. With OKTA , IT can manage any employee's access to any application or device. OKTAruns in the cloud, on a secure, reliable, extensively audited platform, which integrates deeply with on-premisesapplications, directories, and identity management systems.Prerequisites PowerShell 5 or later should be installed on EventTracker Agent workstation.Admin credentials on EventTracker Agent workstation.Admin credential on OKTA admin console.Configure OKTA SSO to forward logs to EventTrackerGet API Key1. Sign-in to the OKTA SSO Admin console.Figure 13
Integrate OKTA SSO2. Hover over Security and select API.Figure 23. Click Create Token.Figure 34. Give the token a name and click Create Token to proceed.Figure 44
Integrate OKTA SSO5. A Token Value will be generated, this is the API key. Copy this, it will be used in the integrator later.Figure 56. Click OK to exit.Integration Steps1. Contact EventTracker Support to download OKTA Integrator.2. After download, run OKTAIntegrator.exe on EventTracker Agent machine.Figure 65
Integrate OKTA SSO3. Browse the location where you want to extract the OKTA integrator files and click Install button.4. Now, provide the OKTA admin URL and API key which we created in previous step and click ValidateCredential.Figure 75. If API key and URL is proper it will enable Finish buttonFigure 86. Click Finish button to complete the OKTA integration.Figure 96
Integrate OKTA SSOEventTracker Knowledge Pack (KP)Once logs are received in EventTracker; alerts, reports and dashboards can be configured in EventTracker.Following are the KP items available for OKTA SSO:Alerts OKTA SSO-Login Failed: This alert will be triggered whenever the login failure occurs for user in OKTASSO.Reports OKTA SSO-Application changes: This report provides information related to application changes.Figure 10 OKTA SSO-Application membership changes: This report provides information related to applicationmembership changes.Figure 11 OKTA SSO-Policy changes: This report provides information related to policy changes.Figure 127
Integrate OKTA SSO OKTA SSO-System events: This report provides information related to system events.Figure 13 OKTA SSO-User authentication details: This report provides information related to user authenticationdetails.Figure 14 OKTA SSO-User management: This report provides information related to user management.Figure 15 OKTA SSO-User session details: This report provides information related to user session details.Figure 168
Integrate OKTA SSO OKTA SSO-Admin access: This report provides information related to admin access.Figure 17Dashboards OKTA - Login Activities by System TypeFigure 18 OKTA - Login Activities by StatusFigure 199
Integrate OKTA SSO OKTA - Login Activities by CountryFigure 20 OKTA - Login Failed by CountryFigure 2110
Integrate OKTA SSO OKTA - Login Activities by Device TypeFigure 22 OKTA - Login Activities by BrowserFigure 2311
Integrate OKTA SSO OKTA – ActivitiesFigure 24Import Knowledge Pack into EventTrackerOnce logs are received in EventTracker; alert, reports and dashboards can be configured in EventTracker.Following are the sequence to upload KP items: Token TemplateFlex ReportAlertsKnowledge ObjectDashboardsTokens Template1. Logon to EventTracker Enterprise.2. Click the Admin menu, and then click Parsing Rules.3. Select Template tab, locate the Token Template OKTA SSO.ettd file.Figure 2512
Integrate OKTA SSO4. Select all the reports by clicking on the check box.5. Click the Import icon.Figure 26Templates are now imported successfully.Figure 27Flex Reports1. Launch EventTracker Control Panel.2. Double click Export/Import Utility, and then click the Import tab.13
Integrate OKTA SSOFigure 283. Click Reports option, and select new (.etcrx) from the option.Figure 2914
Integrate OKTA SSO4. Locate the file named Reports OKTA SSO.etcrx, and select all the check box.Figure 305. Click the Import button to import the reports. EventTracker displays success message.Figure 3115
Integrate OKTA SSOAlerts1. Click Alert option, and then click the browsebutton.Figure 322. Locate Alerts OKTA SSO.isalt file, and then click the Open button.3. To import alerts, click the Import button.EventTracker displays success message.Figure 334. Click the OK button, and then click the Close button.16
Integrate OKTA SSOKnowledge Objects1. Click Knowledge objects under Admin option in the EventTracker manager page.2. Click on ‘Import’ option.3. Locate the file named KO OKTA SSO.etko.Figure 344. Now select all the check box and then click Upload.Figure 3517
Integrate OKTA SSO5. Knowledge objects are now imported successfully.Figure 36DashletsIn EventTracker 9.0, we have added new feature which will help to import/export of dashlet. Following is theprocedure to do that:1. Login into EventTracker Enterprise Web console.Figure 3718
Integrate OKTA SSO2. Go to My Dashboard option.Figure 383. Click import button and select .etwd File.Figure 3919
Integrate OKTA SSOFigure 404. Click upload and select Dashboard which you want to import.Figure 415. Click Import button. It will upload all selected dashboards.20
Integrate OKTA SSOVerify Knowledge Pack in EventTrackerToken Template1. Logon to EventTracker Enterprise.2. Click the Admin menu, and then click Parsing Rules.3. In Template tab to view imported template, scroll down and click OKTA SSO group folder. Templatesare displayed in the template pane.Figure 42Flex Reports1. Logon to EventTracker Enterprise.2. Click the Reports menu, and then Configuration.3. Select Defined in report type.4. In Report Groups Tree to view imported Scheduled Reports, scroll down and click OKTA SSO groupfolder.Reports are displayed in the Reports configuration pane.21
Integrate OKTA SSOFigure 43Alerts1. Logon to EventTracker Enterprise.2. Click the Admin menu, and then click Alerts.Figure 443. In the Search box, type ‘OKTA’, and then click the Go button.Alert Management page will display all the imported alerts.22
Integrate OKTA SSOFigure 454. To activate the imported alerts, select the respective checkbox in the Active column.EventTracker displays message box.Figure 465. Click OK, and then click the Activate Now button.NOTE: Specify appropriate systems in alert configuration for better performance.Knowledge Object1. Logon to EventTracker Enterprise.2. Click the Admin menu, and then click Knowledge Object.3. In Knowledge Object Group Tree to view imported knowledge object, scroll down and click OKTA SSOgroup folder.Knowledge Objects are displayed in the pane.23
Integrate OKTA SSOFigure 47Dashlets1. Logon to EventTracker Enterprise.2. Click the Dashboard menu, and then My Dashboard.3. Then click on Customize Dashlet buttonand search for “OKTA”Figure 4824
OKTA SSO an enterprise-grade, identity management service, is built for the cloud, but compatible with many on-premises applications. With OKTA , IT can manage any employee's access to any application or device. OKTA runs in the cloud, on a secure, reliable, extensively audited platform, which integrates deeply with on-premises
