Splunk Add-on for Okta Identity Cloud
Overview
Details
- Handles System Log event ingestion using Okta's REST API endpoints and simplifies data correlation.
- Can periodically ingest Okta Universal Directory (UD) data, including users, groups, and apps. This data is not treated as time-series events.
- Provides the inputs and CIM-compatible knowledge to use with other Splunk apps.
The Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions: 1) Updating user's lifecycle/status, 2) Add or Remove a user from a group. In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details.
The Splunk Add-on for Okta Identity Cloud provides support of the below-mentioned sourcetypes:
OktaIM2:log
OktaIM2:user
OktaIM2:group
OktaIM2:app
OktaIM2:groupUser
OktaIM2:appUser
Overview
The Splunk Add-on for Okta Identity Cloud provides complete data collection parity with the Okta Identity Cloud Add-on for Splunk, and corresponding features except the following two adaptive response actions: 1) Updating user's lifecycle/status, 2) Add or Remove a user from a group.
In addition to this, Splunk built TA provides comprehensive CIM coverage, high reliability and multiple features and enhancements. Please see the Reference section of the documentation for more details.
The Splunk Add-on for Okta Identity Cloud provides support of the below-mentioned sourcetypes
OktaIM2:log
OktaIM2:user
OktaIM2:group
OktaIM2:app
OktaIM2:groupUser
OktaIM2:appUser
Migrate from Okta Identity Cloud Add-on for Splunk to the Splunk Add-on for Okta Identity Cloud
If you have already installed the Okta Identity Cloud Add-on for Splunk in a Splunk instance and want to install Splunk Add-on for Okta Identity Cloud in the same Splunk instance, you must first:
Disable inputs for the Okta Identity Cloud Add-on for Splunk.
Disable the Okta Identity Cloud Add-on for Splunk.
This prevents clashing of modinputs, data collection mechanism, and the sourcetypes present in both add-ons.
To disable inputs for Okta Identity Cloud Add-on for Splunk, navigate to the Inputs page and select "Disable" in the dropdown for that add-on.
To disable the Okta Identity Cloud Add-on for Splunk, navigate to Apps > Manage Apps and select the "Disable" option for the add-on.
Once the Okta Identity Cloud Add-on for Splunk is disabled and Splunk Add-on for Okta Identity Cloud is installed, Users will need to Configure Credentials and Configure Inputs in the Splunk Add-on for Okta Identity Cloud to collect the data.
If both add-ons are enabled on the same Splunk instance you may experience data loss and errors.
Refer to "CIM compatibility of Okta System Logs" section of the document to view the CIM data models mapped with respective eventTpes of Okta System Logs in Splunk Add-on for Okta Identity Cloud
For more information, visit the Splunk Add-on for Okta IdentitIy Cloud Documentation
Splunk Docs