The Investigation Insights – Okta integration searches emails in Okta to provide user login and user context information to analysts. Enabling analysts to have informed decisions about who a user is.
Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 10,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, T-Mobile, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.
Integrated Dataminr Products
Agentic Threat Intelligence Platform
Investigation Insights
Okta with Investigation Insights
Okta
With this playbook app, you can automate processes during an internal security investigation when it’s critical to quickly get user information or suspend users involved with a security incident.
- As part of a security process orchestration, get user account information, including groups and applications the user has access to. This information can be used for making automated decisions about next steps to take in the investigation as well as help analysts have the information they need without having to collect it manually.
- During a security investigation it’s often necessary to suspend a user’s account for a period of time while the investigation takes place and analysts can confirm that the account is not compromised. This action can be automated as part of a Workflow or Playbook. Later in the process, the account can be unsuspended and the password can be reset automatically.
The Playbook app contains the following actions:
- Get User – This action fetches a user from your Okta Organization.
- Get User Applications – This action fetches appLinks for all direct or indirect (via group membership) assigned applications.
- Get User Groups – This action fetches the groups of which the user is a member.
- Reset Password – This action generates a one-time token (OTT) that can be used to reset a user’s password. The OTT link can be automatically emailed to the user or returned to the API caller and distributed using a custom flow. This operation will transition the user to the status of RECOVERY, and the user will not be able to log in or initiate a forgot-password flow until they complete the reset flow.
- Suspend User – This action suspends a user. This operation can be performed only on users with an ACTIVE status. The user will have a status of SUSPENDED when the process is complete.
This app is a set of actions to interact with the Okta API. For full details on using the Okta API, please see here.
This app can be found in the Dataminr App Catalog under the name: Okta.
Looking for Integration Not Shown
