Integrate Okta Workforce Identity Alerts with Red Canary. 

Prerequisites

To connect Okta Workforce Identity to Red Canary, we highly recommend configuring the following Okta settings to ensure Red Canary receives the correct alert activity from Okta. 

1. From your Okta administration dashboard, click the Security dropdown, and then click General.
   1. Under Security Notification Emails, enable the following:
      1. New sign-on notification email
      2. Authenticator enrolled notification email
      3. Authenticator reset notification email
      4. Report Suspicious activity via email
         
         
   2. Under Okta Threat Insight Settings, select either of the following:
      1. Action: Log authentication attempts from malicious IPs
      2. Action: Log and enforce security based on threat level
         

Alert types

Okta offers the following alert types to Red Canary:

• Suspicious activity events
• Malicious IP addresses

Integrate Red Canary with Okta Workforce Identity

To send Okta Workforce Identity alerts to Red Canary,  you’ll need to…

• Have an Okta account with a Read-Only Administrator role.
• Obtain an Okta API key.
• Connect the API key to Red Canary.

Step 1: Okta–Create a user account

Note: If you already have an Okta account with a Read-Only Administrator role, see Get an Okta API key later on in this article.

1. From your Okta administration dashboard, click the Directory dropdown, and then click People.
   
   
2. Click Add person to create a new user account. 
   
   
3. Fill in the relevant information and click Save.
   
   
4. Once the user account is created, click the Security dropdown (1), click Administrators (2), and then click the Admins tab (3).
   
   
5. Click +Add administrator. 
6. Under the Admin dropdown, type and select the name of the user account you just created.
   
   
7. Under the Role dropdown, select Read-Only Administrator.
   
   
8. Click Save Changes.

Step 2: Okta–Get an Okta API key

Generate an Okta API key in Okta to connect to Red Canary. Once you’ve connected Okta to Red Canary, Okta will send alert data to Red Canary.

1. Once you’ve created your user account, log in to Otka with the Read-Only Administrator account to get the Okta API key.
2. Click the Security (1) dropdown; and then click API (2); and then click Create Token (3).
3. Name your token, and then click Create Token.
   
   
4. Copy the API key so you can connect Okta to Red Canary. 
5. Click OK, got it to continue.
   
   
6. With your API key copied, log in to Red Canary.

Step 3: Red Canary–Connect the API Key

Connect your Okta API key to Red Canary in order to start receiving the Okta alerts.

1. From your Red Canary dashboard, click the Integrations dropdown, and then click Alert Sources.
2. In the search bar, type and select Okta Workforce Identity.
   
   
3. To configure your new alert source, scroll down and click Okta Workforce Identity.
   
4. Click Edit Configuration.
5. Enter a Name for your external alert source.  
6. Select a display category.
7. Under the Ingest Format/Method dropdown, select Okta Workforce Identity via API Poll (Required for Red Canary Threat Investigation Service).
   Note: We recommend selecting Okta Workforce Identity via API Poll (Required for Red Canary Threat Investigation Service) as the ingest method because the API option provides more data than the other available options.
   
   
8. Enter your Okta Domain.
   Note: Enter your Okta Domain as exampledomain do not enter exampledomain.okta.com
9. Paste the Okta API Token you copied from Okta.
   
   
10. Click Save.

Confirm that the integration was successful

To confirm that the Okta integration was successful, you can generate an alert by removing or setting up a security method factor. This will send an email that you can report as suspicious and thereby ensure that the integration is active.

1. From your My Apps dashboard, click on the profile dropdown, and then click Settings.
   
   
2. Under Security Methods, click Remove or Set up another on any factor. This will trigger an alert and notify you by email.
   
   
3. In your email, look for the Red Canary Okta Notice and click Report Suspicious Activity.
   
   
4. From your Red Canary dashboard, click Alert Sources.
5. Scroll down and click on Okta Workforce Identity.
   
   
6. After a few minutes, you will see the activity you just reported at the top of the Recent Alerts list.