{
  "Name": "Okta Single Sign-On",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/okta_logo.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Okta Single Sign-On (SSO)](https://www.okta.com/products/single-sign-on) solution for Microsoft Sentinel provides the capability to ingest [audit and event logs](https://www.okta.com/integrate/documentation/isv-syslog-references/) into Microsoft Sentinel using the Okta API.\r\n  \r\n  **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n  a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n\r\n\n  b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview)\r\n\n\r\n\n c. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)",
  "Analytic Rules": [
    "Analytic Rules/FailedLoginsFromUnknownOrInvalidUser.yaml",
    "Analytic Rules/LoginfromUsersfromDifferentCountrieswithin3hours.yaml",
    "Analytic Rules/PasswordSpray.yaml",
    "Analytic Rules/PhishingDetection.yaml",
    "Analytic Rules/NewDeviceLocationCriticalOperation.yaml",
    "Analytic Rules/MFAFatigue.yaml",
    "Analytic Rules/HighRiskAdminActivity.yaml",
    "Analytic Rules/DeviceRegistrationMaliciousIP.yaml",
    "Analytic Rules/UserSessionImpersonation.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/OktaSingleSign-On/Connector_REST_API_FunctionApp_Okta.json",
    "Data Connectors/OktaNativePollerConnectorV2/OktaSSOv2_DataConnectorDefinition.json"
  ],
  "Hunting Queries": [
    "Hunting Queries/AdminPrivilegeGrant.yaml",
    "Hunting Queries/CreateAPIToken.yaml",
    "Hunting Queries/ImpersonationSession.yaml",
    "Hunting Queries/RareMFAOperation.yaml",
    "Hunting Queries/UserPasswordReset.yaml",
    "Hunting Queries/NewDeviceRegistration.yaml",
    "Hunting Queries/LoginsVPSProvider.yaml",
    "Hunting Queries/LoginNordVPN.yaml",
    "Hunting Queries/LoginFromMultipleLocations.yaml",
    "Hunting Queries/LegacyAuthentication.yaml"
  ],
  "Playbooks": [
    "Playbooks/OktaCustomConnector/azuredeploy.json",
    "Playbooks/OktaPlaybooks/Okta-EnrichIncidentWithUserDetails/azuredeploy.json",
    "Playbooks/OktaPlaybooks/Okta-PromptUser/azuredeploy.json",
    "Playbooks/OktaPlaybooks/Okta-ResponseFromTeams/azuredeploy.json"
  ],
  "Workbooks": [
    "Workbooks/OktaSingleSignOn.json"
  ],
  "Parsers": [
    "Parsers/OktaSSO.yaml"
  ],
  "Metadata": "SolutionMetadata.json",
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Okta Single Sign-On\\",
  "Version": "3.1.10",
  "TemplateSpec": true,
  "Is1PConnector": false
}