---
title: "Okta Resources collector"
canonical: "https://docs.devo.com/space/latest/94656839/Okta%20Resources%20collector"
format: markdown
---
> Macro (excerpt-include)



> Macro (toc)

## Purpose

An analyst wants to detect suspicious identity access patterns in [Okta](https://www.okta.com/). Using the Okta Resources collector to send authentication logs to Devo, the analyst will find privilege escalation events. As a result, the analyst will remove malicious accounts, preventing them from accessing sensitive company resources.

## Example tables

| **Table** | **Description** |
| --- | --- |
| `auth.okta.system` | System events related to organization audit trail |
| `auth.okta.apps` | Application management events |
| `auth.okta.events` | Authentication events |
| `auth.okta.groups` | Group management events |
| `auth.okta.policies` | Policy management events |
| `auth.okta.users` | User management events |
| `auth.okta.clients` | Client application registration events |
| `auth.okta.idps` | Identity provider management events |
| `auth.okta.zones` | Network zone management events |
| `gateway.okta.oag.access` | Access Gateway access events |
| `gateway.okta.oag.audit` | Access Gateway audit events |
| `gateway.okta.oag.monitor` | Access Gateway monitoring events |
| Union tables that use these tags: `auth.all` | Union tables collect information for monitoring purposes. |

## Configuration requirements

To run this collector, there are some configurations detailed below that you need to consider.

| **Configuration** | **Details** |
| --- | --- |
| Getting Okta credentials | You will need to create an **api_token** and get the **okta_url** to run this collector. |

## Authorize it

The user creating the API token must have permissions to access apps in the API. Permissions to access "logs" is strongly recommended.

1. Log in to your [Okta admin portal](https://developer.okta.com/).
2. Navigate to **Security → API -> Tokens** option and click on the **"Create Token"** button.

![image](media://10cbba4a-bc78-40be-adb0-19312dfb2cf1)

3. Enter a name for your token that describes its purpose (e.g., "Devo Collector").

![image](media://c75e765b-31cf-477f-ac72-15514c908122)

4. **Copy the token value** immediately, as it will only be shown once.

![image](media://d763b509-9900-421e-853a-d890a6c6b016)

5. Create an **API integration **in Okta with **read-only **permissions for: *System,* *Log, Users, Groups, Applications*, *Identity Providers*, *Network,* *Zones, Policies.*
6. Click **Dashboard **and save the **okta_url** that is displayed in the top right corner (it will be used later in the config file).

![image](media://e02e15dd-e53c-4621-930f-5fec03bbae3a)

## Run it

In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Okta Resources** collector instance.  Insert this parameters template, replacing the values enclosed in `< >`.  The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new).

```
"inputs": {
    "okta": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        "logs": {
        "request_period_in_seconds": "<REQUEST_PERIOD_IN_SECONDS>",
          "requests_limits": [
            {
              "period": "<PERIOD_VALUE>",
              "number_of_requests": "<NUMBER_OF_REQUESTS>"
            }
          ],
          "start_time": "<START_TIME_IN_UTC>"
        },
      "credentials": {
        "okta_url": "<OKTA_URL_VALUE>",
        "api_token": "<API_TOKEN_VALUE>"
      }
    }
  }
}
```

## Secure it

Devo Exchange provides these resources:

## Monitor it

Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source  using the query

```
from auth.okta.system  
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.

## Parameters

### Example

```
{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "okta": {
      "id": "<short_unique_id>",
      "enabled": true,
      "autoconfig": {
      "enabled": "<autoconfig_status>",
      "refresh_interval_in_seconds": "<refresh_interval>"
      },
      "credentials": {
        "okta_url": "<okta_url_value>",
        "api_token": "<api_token_value>"
      },
      "services": {
        "logs": {
          "request_period_in_seconds": "<request_period_in_seconds>",
          "requests_limits": [
            {
              "period": "<period_value>",
              "number_of_requests": "<number_of_requests>"
            }
          ],
          "override_tag": "<override_tag_value>",
          "start_time": "<start_time_in_utc>"
        },
        "apps": {
          "request_period_in_seconds": "<request_period_in_seconds>",
          "requests_limits": [
            {
              "period": "<period_value>",
              "number_of_requests": "<number_of_requests>"
            }
          ],
          "override_tag": "<override_tag_value>"
        },
        "idps": {
          "request_period_in_seconds": "<request_period_in_seconds>",
          "requests_limits": [
            {
              "period": "<period_value>",
              "number_of_requests": "<number_of_requests>"
            }
          ],
          "override_tag": "<override_tag_value>"
        },
      }
    }
  }
}

```

### Details

| **Parameter** | **Data Type** | **Necessity** | **Details** |
| --- | --- | --- | --- |
| `id` | `string` | `Mandatory` | Five **unique** digits. |
| `input` | `boolean` | `Mandatory` | Use this param to enable or disable the given input logic when running the collector. If the value is `true,` the input will be run. If the value is `false`, it will be ignored. |
| `autoconfig_status` | `boolean` | `Mandatory` | Use this param to enable or disable the autoconfig service.<br>This collector cannot run without `autoconfig_status = false`. |
| `refresh_interval` | `integer` | `Mandatory` | By default, the auto-config service will run every 600 seconds. This parameter allows you to customize this behavior. `This is Mandatory only if use "autoconfig"` |
| `override_tag` | `string` | `Optional` | This parameter allows defining a custom devo tag. |
| `request_period_in_seconds` | `integer` | `Optional` | Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds |
| `start_time_in_utc` | `string` | `Mandatory` | Initial time period used when fetching data from the endpoint.<br>Due to the large amount of data produced by this service, using this parameter is discouraged except in special cases.<br>This parameter can be left blank, removed or commented.<br>**Format** `<yyyy-MM-dd'T'HH:mm:ss'Z'>`<br>**Example:** `2024-10-21T10:15:30Z` |
| `period` | `string` | `Mandatory` | Defines the reference time period used by the rate limiter. By default uses the same Okta Basic Rate Limiter: 60 seconds.  
`s: second`  
`m: minute`  
`h: hour`  
`d: day`  
`w: week`  
`M: month`  
`y: year`  
**Example:** "30s" , "1m", "1h"<br>If you do not need this feature (Local Rate Limiter), remove the following definition from the service/endpoint:  
**requests_limits:**<br>- **period: <period_value>**  
**number_of_requests: <number_of_requests>** |
| `number_of_requests` | `integer` | `Mandatory` | Defines the maximum number of calls that can be made in the period_value. Check in Okta site your limits per endpoint based on your Okta tier.<br>If you do not need this feature (Local Rate Limiter), remove the following definition from the service/endpoint:  
**requests_limits:**<br>- **period: <period_value>**  
**number_of_requests: <number_of_requests>** |
| `okta_url` | `string` | `Mandatory` | Domain to authenticate to the service. Ex:<br>`subdomain.domain.com` |
| `api_token` | `string` | `Mandatory` | API token to authenticate to the service. |

## Troubleshooting

This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors.

| Error Type | Error Id | Error Message | Cause | Solution |
| --- | --- | --- | --- | --- |
| InitVariablesError | 1 | initial_start_time_in_utc is not set as per the datetime_format : `{datetime_format}` | The date in config is not as per required format | Ensure the date format is correct. |
| InitVariablesError | 2 | initial_start_time_in_utc is in the future | The date in config is not in the past period | Ensure the date period is correct. |
| SetupError | 100 | HTTP Error occurred while retrieving events from okta server | Okta API call is failing | Check the credentials and ensure that the collector has the necessary permissions to access the Okta API. |
| SetupError | 101 | Connecting Error occurred while retrieving events from okta server | Okta API call is failing | Check the credentials and ensure that the collector has the necessary permissions to access the Okta API. |
| PullError | 300 | HTTP Error occurred while fetching siem event from okta server | Okta API call is failing | Check the credentials and ensure that the collector has the necessary permissions to access the Okta API. |
| PullError | 301 | HTTP Error occurred while fetching siem event from okta server | Okta API call is failing | Check the credentials and ensure that the collector has the necessary permissions to access the Okta API. |
| PullError | 302 | Some error occurred while retrieving events from Okta server. | Okta API call is failing | Check the credentials and ensure that the collector has the necessary permissions to access the Okta API. |

## API Endpoints

| **Endpoint** | **Service** | **Table** |
| --- | --- | --- |
| `/v1/logs` | `logs` | `auth.okta.system` |
| `/v1/apps` | `apps` | `auth.okta.apps` |
| `/v1/clients` | `clients` | `auth.okta.clients` |
| `/v1/groups` | `groups` | `auth.okta.groups` |
| `/v1/idps` | `idps` | `auth.okta.idps` |
| `/v1/users` | `users` | `auth.okta.users` |
| `/v1/zones` | `zones` | `auth.okta.zones` |

### Rate limits

The number of API requests for an organization is limited for all APIs in order to protect the service for all users. The number of Okta-generated emails that can be sent also has rate limits.

Okta has two types of API rate limits:

- <u>[Org-wide rate limits](https://developer.okta.com/docs/reference/rate-limits/#org-wide-rate-limits)</u> that vary by API endpoint. These limits are applied on a per-minute or per-second basis, and some are also applied on a per-user basis. For example, if your org sends a request to list applications more than one hundred times in a minute, the org-wide rate limit is exceeded. These limits protect against denial-of-service attacks and help ensure that adequate resources are available for all customers.
- <u>[Concurrent rate limits](https://developer.okta.com/docs/reference/rate-limits/#concurrent-rate-limits)</u> on the number of simultaneous transactions. For example, if you sent 77 very long-lasting requests to any API endpoint simultaneously, you might exceed the concurrent rate limit.

Okta has one type of email rate limit:

- <u>[Okta-Generated Email Message Rate Limits](https://developer.okta.com/docs/reference/rate-limits/#okta-generated-email-message-rate-limits)</u> that vary by email type. Okta enforces rate limits on the number of Okta-generated email messages that are sent to customers and customer users. For example, if the number of emails sent to a given user exceeds the per-minute limit for a given email type, subsequent emails of that type are dropped for that user until that minute elapses.

Rate limits may be changed to protect customers. We provide advance warning of changes when possible.

Check the following web pages for more information on Okta rate limits:

- [Additional rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-additional-limits/)
- [Other endpoint rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-global-other-endpoints/)
- [Management rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-global-mgmt/)
- [Authentication/End-user rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-global-enduser/)
- [System Log events for rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-system-log-events/)
- [Previous rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-previous/)
- [DynamicScale rate limits | Okta Developer](https://developer.okta.com/docs/reference/rl-dynamic-scale/)

# Devo Collector features

| **Feature** | **Details** |
| --- | --- |
| Allow parallel downloading (`multipod`) | `Not allowed` |
| Running Environments | `Collector Server` |
| Populated Devo events | table |
| Flattening preprocessing | no |

## Release Notes

- **Version 2.1.1 **(2025-04-22)
  - Updated type of ID in schema
- **Version 2.1.0 **(2025-04-15)
  - Added support for obfuscation functionality
  - Upgraded the DCSDK from `1.13.1` to `1.15.0`
- **Version 2.0.1** (2025-01-13)
  - Resolved the `Last ID` parameter issue that was not persisting in the URL and allowed override it.
- **Version 2.0.0** (2024-12-06)
  - Upgraded the DCSDK from 1.12.4 to 1.13.1 and improvements in controlled stop.
  - Upgraded Docker image to `1.3.1`
  - Refactor the code.
- **Version 1.9.0** (2024-08-19)
  - Upgrade DCSDK to `1.12.4`.
  - Upgrade the Docker Base image to `1.3.0`.
- **Version 1.0.0** (2021-01-15)
  - Initial release with support for System Logs, Apps, Users, Groups, IDPs, and Zones.