Okta
Integrating Okta with ThreatDefence allows user and authentication activity to be streamed into ThreatDefence for centralized monitoring and incident response. This provides visibility into login attempts, policy enforcement, and identity-related risks, enabling faster detection and response to account misuse, phishing, and unauthorized access.
Before You Begin
Sign in to Okta as a user with administrator permissions.
The following roles have the necessary permissions: Read Only Admin, Super Admin, or Org Admin.
ThreatDefence recommends creating and using a dedicated Read Only Admin role specifically for generating the Okta API token.
Important Notes:
The API token inherits the permissions of the user who created it. If that user’s role changes, the token permissions also change.
To ensure uninterrupted collection, the user must remain active for as long as the token is in use.
The token-creating user must have these Okta permissions:
View users
View groups
View System Log
Step 1. Create an Okta API Token
Sign in to Okta with administrator permissions.
Go to Security → API.
On the Tokens tab, click Create Token.
Enter a descriptive name for the token, for example: ThreatDefence - Log Integration.
Under API calls made with this token must originate from, select Any IP.
Click Create Token.
Copy the Token value and store it securely (e.g., a password vault).
⚠️ The token value cannot be retrieved again after closing this form.
Confirm the new token appears in the list of active API tokens.
Step 2. Configure Okta ThreatInsight
Okta ThreatInsight helps reduce noise by logging malicious or suspicious IP activity.
In the Admin Console, go to Security → General.
Locate Okta ThreatInsight settings and click Edit.
Select Log authentication attempts from malicious IPs.
(Optional) If you’ve configured trusted IPs (e.g., gateways, Okta agents), you can select Log and enforce security based on threat level.
In the Exempt Zones field, add network zones containing IPs you trust.
Click Save.
Step 3. Enable Security Notification Emails
In the Admin Console, go to Security → General.
Under Security notification emails, click Edit.
In the Report suspicious activity via email list, select Enabled.
Click Save.
Step 4. (Optional) Enable Phishing-Resistant Authentication
For stronger authentication security, configure phishing-resistant factors such as WebAuthn or Okta FastPass.
Configure WebAuthn and Okta Verify authenticators.
Configure Okta FastPass.
Create authenticator enrollment policies for WebAuthn and FastPass.
Configure authentication policies requiring WebAuthn or FastPass as a possession factor.
See Okta’s official documentation for detailed setup guidance.
Step 5. Provide Okta Credentials to ThreatDefence
Send the following details to your ThreatDefence representative at 📧 [email protected]:
API Token
Okta Tenant URL
Once provided, ThreatDefence will configure ingestion so Okta activity is correlated with other security telemetry for monitoring, detection, and incident response.
Last updated