{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { "author": "Microsoft - support@microsoft.com", "comments": "Solution template for Okta Single Sign-On" }, "parameters": { "location": { "type": "string", "minLength": 1, "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" } }, "workspace-location": { "type": "string", "defaultValue": "", "metadata": { "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" } }, "workspace": { "defaultValue": "", "type": "string", "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, "resourceGroupName": { "type": "string", "defaultValue": "[resourceGroup().name]", "metadata": { "description": "resource group name where Microsoft Sentinel is setup" } }, "subscription": { "type": "string", "defaultValue": "[last(split(subscription().id, '/'))]", "metadata": { "description": "subscription id where Microsoft Sentinel is setup" } }, "workbook1-name": { "type": "string", "defaultValue": "Okta Single Sign-On", "minLength": 1, "metadata": { "description": "Name for the workbook" } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Okta Single Sign-On", "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-okta", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { "analyticRuleVersion1": "1.1.0", "_analyticRulecontentId1": "884be6e7-e568-418e-9c12-89229865ffde", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '884be6e7-e568-418e-9c12-89229865ffde')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('884be6e7-e568-418e-9c12-89229865ffde')))]", "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','884be6e7-e568-418e-9c12-89229865ffde','-', '1.1.0')))]" }, "analyticRuleObject2": { "analyticRuleVersion2": "1.1.0", "_analyticRulecontentId2": "2954d424-f786-4677-9ffc-c24c44c6e7d5", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '2954d424-f786-4677-9ffc-c24c44c6e7d5')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('2954d424-f786-4677-9ffc-c24c44c6e7d5')))]", "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','2954d424-f786-4677-9ffc-c24c44c6e7d5','-', '1.1.0')))]" }, "analyticRuleObject3": { "analyticRuleVersion3": "1.1.0", "_analyticRulecontentId3": "e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508')))]", "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508','-', '1.1.0')))]" }, "analyticRuleObject4": { "analyticRuleVersion4": "1.1.0", "_analyticRulecontentId4": "78d2b06c-8dc0-40e1-91c8-66d916c186f3", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '78d2b06c-8dc0-40e1-91c8-66d916c186f3')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('78d2b06c-8dc0-40e1-91c8-66d916c186f3')))]", "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','78d2b06c-8dc0-40e1-91c8-66d916c186f3','-', '1.1.0')))]" }, "analyticRuleObject5": { "analyticRuleVersion5": "1.1.0", "_analyticRulecontentId5": "41e843a8-92e7-444d-8d72-638f1145d1e1", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '41e843a8-92e7-444d-8d72-638f1145d1e1')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('41e843a8-92e7-444d-8d72-638f1145d1e1')))]", "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','41e843a8-92e7-444d-8d72-638f1145d1e1','-', '1.1.0')))]" }, "analyticRuleObject6": { "analyticRuleVersion6": "1.1.0", "_analyticRulecontentId6": "c2697b81-7fe9-4f57-ba1d-de46c6f91f9c", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c2697b81-7fe9-4f57-ba1d-de46c6f91f9c')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c2697b81-7fe9-4f57-ba1d-de46c6f91f9c')))]", "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c2697b81-7fe9-4f57-ba1d-de46c6f91f9c','-', '1.1.0')))]" }, "analyticRuleObject7": { "analyticRuleVersion7": "1.1.0", "_analyticRulecontentId7": "9f82a735-ae43-4c03-afb4-d5d153e1ace1", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9f82a735-ae43-4c03-afb4-d5d153e1ace1')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9f82a735-ae43-4c03-afb4-d5d153e1ace1')))]", "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9f82a735-ae43-4c03-afb4-d5d153e1ace1','-', '1.1.0')))]" }, "analyticRuleObject8": { "analyticRuleVersion8": "1.1.0", "_analyticRulecontentId8": "e36c6bd6-f86a-4282-93a5-b4a1b48dd849", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e36c6bd6-f86a-4282-93a5-b4a1b48dd849')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e36c6bd6-f86a-4282-93a5-b4a1b48dd849')))]", "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e36c6bd6-f86a-4282-93a5-b4a1b48dd849','-', '1.1.0')))]" }, "analyticRuleObject9": { "analyticRuleVersion9": "1.0.0", "_analyticRulecontentId9": "35846296-4052-4de2-8098-beb6bb5f2203", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35846296-4052-4de2-8098-beb6bb5f2203')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35846296-4052-4de2-8098-beb6bb5f2203')))]", "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35846296-4052-4de2-8098-beb6bb5f2203','-', '1.0.0')))]" }, "uiConfigId1": "OktaSSO", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "OktaSSO", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "dataConnectorCCPVersion": "1.0.0", "_dataConnectorContentIdConnectorDefinition2": "OktaSSOv2", "dataConnectorTemplateNameConnectorDefinition2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition2')))]", "_dataConnectorContentIdConnections2": "OktaSSOv2Connections", "dataConnectorTemplateNameConnections2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections2')))]", "dataCollectionEndpointId2": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "blanks": "[replace('b', 'b', '')]", "TemplateEmptyObject": "[json('{}')]", "huntingQueryObject1": { "huntingQueryVersion1": "1.0.0", "_huntingQuerycontentId1": "5309ea6b-463c-4449-a3c4-2fc8ee0080ee", "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5309ea6b-463c-4449-a3c4-2fc8ee0080ee')))]" }, "huntingQueryObject2": { "huntingQueryVersion2": "1.0.0", "_huntingQuerycontentId2": "c5134bac-044d-447a-a260-d1d439653ae7", "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c5134bac-044d-447a-a260-d1d439653ae7')))]" }, "huntingQueryObject3": { "huntingQueryVersion3": "1.0.0", "_huntingQuerycontentId3": "96fb9b37-e2b7-45f6-9b2a-cb9cdfd2b0fc", "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('96fb9b37-e2b7-45f6-9b2a-cb9cdfd2b0fc')))]" }, "huntingQueryObject4": { "huntingQueryVersion4": "1.0.0", "_huntingQuerycontentId4": "18667b4a-18e5-4982-ba75-92ace62bc79c", "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('18667b4a-18e5-4982-ba75-92ace62bc79c')))]" }, "huntingQueryObject5": { "huntingQueryVersion5": "1.0.0", "_huntingQuerycontentId5": "38da2aa3-4778-4d88-9178-3c5c14758b05", "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('38da2aa3-4778-4d88-9178-3c5c14758b05')))]" }, "huntingQueryObject6": { "huntingQueryVersion6": "1.0.0", "_huntingQuerycontentId6": "4355f601-1421-4ac4-b2ce-88f0859cc101", "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('4355f601-1421-4ac4-b2ce-88f0859cc101')))]" }, "huntingQueryObject7": { "huntingQueryVersion7": "1.0.0", "_huntingQuerycontentId7": "f262fc3a-0acc-4c8b-9a73-fdc09f55fff2", "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('f262fc3a-0acc-4c8b-9a73-fdc09f55fff2')))]" }, "huntingQueryObject8": { "huntingQueryVersion8": "1.0.0", "_huntingQuerycontentId8": "708c33ec-22a2-4739-b248-c14919500cdd", "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('708c33ec-22a2-4739-b248-c14919500cdd')))]" }, "huntingQueryObject9": { "huntingQueryVersion9": "1.0.0", "_huntingQuerycontentId9": "37381608-bcd7-46bc-954e-1fd418023c26", "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('37381608-bcd7-46bc-954e-1fd418023c26')))]" }, "huntingQueryObject10": { "huntingQueryVersion10": "1.0.0", "_huntingQuerycontentId10": "6a9199ec-bc32-4935-9f82-4aa848edb3fc", "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6a9199ec-bc32-4935-9f82-4aa848edb3fc')))]" }, "OktaCustomConnector": "OktaCustomConnector", "_OktaCustomConnector": "[variables('OktaCustomConnector')]", "TemplateEmptyArray": "[json('[]')]", "playbookVersion1": "1.0", "playbookContentId1": "OktaCustomConnector", "_playbookContentId1": "[variables('playbookContentId1')]", "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-lc-',uniquestring(variables('_playbookContentId1'))))]", "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','lc','-', uniqueString(concat(variables('_solutionId'),'-','LogicAppsCustomConnector','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", "Okta-EnrichIncidentWithUserDetails": "Okta-EnrichIncidentWithUserDetails", "_Okta-EnrichIncidentWithUserDetails": "[variables('Okta-EnrichIncidentWithUserDetails')]", "playbookVersion2": "1.0", "playbookContentId2": "Okta-EnrichIncidentWithUserDetails", "_playbookContentId2": "[variables('playbookContentId2')]", "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", "playbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2'))))]", "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", "Okta-PromptUser": "Okta-PromptUser", "_Okta-PromptUser": "[variables('Okta-PromptUser')]", "playbookVersion3": "1.0", "playbookContentId3": "Okta-PromptUser", "_playbookContentId3": "[variables('playbookContentId3')]", "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", "playbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3'))))]", "_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]", "Okta-ResponseFromTeams": "Okta-ResponseFromTeams", "_Okta-ResponseFromTeams": "[variables('Okta-ResponseFromTeams')]", "playbookVersion4": "1.0", "playbookContentId4": "Okta-ResponseFromTeams", "_playbookContentId4": "[variables('playbookContentId4')]", "playbookId4": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId4'))]", "playbookTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId4'))))]", "_playbookcontentProductId4": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId4'),'-', variables('playbookVersion4'))))]", "workbookVersion1": "1.2", "workbookContentId1": "OktaSingleSignOnWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "parserObject1": { "_parserName1": "[concat(parameters('workspace'),'/','OktaSSO')]", "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'OktaSSO')]", "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('OktaSSO-Parser')))]", "parserVersion1": "1.0.0", "parserContentId1": "OktaSSO-Parser" }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "FailedLoginsFromUnknownOrInvalidUser_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query searches for numerous login attempts to the management console with an unknown or invalid user name.", "displayName": "Failed Logins from Unknown or Invalid User", "enabled": false, "query": "let FailureThreshold = 15;\nlet FailedLogins = OktaSSO\n| where eventType_s =~ \"user.session.start\" and outcome_reason_s =~ \"VERIFICATION_ERROR\"\n| summarize count() by actor_alternateId_s, client_ipAddress_s, bin(TimeGenerated, 5m)\n| where count_ > FailureThreshold\n| project client_ipAddress_s, actor_alternateId_s;\nOktaSSO\n| join kind=inner (FailedLogins) on client_ipAddress_s, actor_alternateId_s\n| where eventType_s =~ \"user.session.start\" and outcome_reason_s =~ \"VERIFICATION_ERROR\"\n| summarize count() by actor_alternateId_s, ClientIP = client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', \"\"), Country = column_ifexists('client_geographicalContext_country_s', \"\"), column_ifexists('published_t', now())\n| sort by column_ifexists('published_t', now()) desc\n| extend timestamp = column_ifexists('published_t', now()), IPCustomEntity = ClientIP, AccountCustomEntity = actor_alternateId_s\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "CredentialAccess" ], "techniques": [ "T1110" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "AccountCustomEntity", "identifier": "FullName" } ], "entityType": "Account" }, { "fieldMappings": [ { "columnName": "IPCustomEntity", "identifier": "Address" } ], "entityType": "IP" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 1", "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "contentKind": "AnalyticsRule", "displayName": "Failed Logins from Unknown or Invalid User", "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "LoginfromUsersfromDifferentCountrieswithin3hours_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query searches for successful user logins to the Okta Console from different countries within 3 hours.", "displayName": "User Login from Different Countries within 3 hours", "enabled": false, "query": "let timeframe = ago(3h);\nlet threshold = 2;\nOktaSSO\n| where column_ifexists('published_t', now()) >= timeframe\n| where eventType_s =~ \"user.session.start\"\n| where outcome_result_s =~ \"SUCCESS\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumOfCountries = dcount(column_ifexists('client_geographicalContext_country_s', int(null))) by actor_alternateId_s\n| where NumOfCountries >= threshold\n| extend timestamp = StartTime, AccountCustomEntity = actor_alternateId_s\n", "queryFrequency": "PT3H", "queryPeriod": "PT3H", "severity": "High", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "InitialAccess" ], "techniques": [ "T1078" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "AccountCustomEntity", "identifier": "FullName" } ], "entityType": "Account" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 2", "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", "displayName": "User Login from Different Countries within 3 hours", "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "PasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.", "displayName": "Potential Password Spray Attack", "enabled": false, "query": "let FailureThreshold = 15;\nlet FailedEvents = OktaSSO\n| where eventType_s =~ \"user.session.start\"and outcome_reason_s in (\"VERIFICATION_ERROR\",\"INVALID_CREDENTIALS\")\n| summarize dcount(actor_alternateId_s) by client_ipAddress_s, bin(TimeGenerated, 5m)\n| where dcount_actor_alternateId_s > FailureThreshold\n| project client_ipAddress_s, TimeGenerated;\nOktaSSO\n| where eventType_s =~ \"user.session.start\"and outcome_reason_s in (\"VERIFICATION_ERROR\",\"INVALID_CREDENTIALS\")\n| summarize Users = make_set(actor_alternateId_s) by client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', \"\"), Country = column_ifexists('client_geographicalContext_country_s', \"\"), bin(TimeGenerated, 5m)\n| join kind=inner (FailedEvents) on client_ipAddress_s, TimeGenerated\n| sort by TimeGenerated desc\n| extend timestamp = TimeGenerated, IPCustomEntity = client_ipAddress_s\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "CredentialAccess" ], "techniques": [ "T1110" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "IPCustomEntity", "identifier": "Address" } ], "entityType": "IP" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 3", "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "contentKind": "AnalyticsRule", "displayName": "Potential Password Spray Attack", "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "PhishingDetection_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query detects cases in which Okta FastPass effectively prevented access to a known phishing website.", "displayName": "Okta Fast Pass phishing Detection", "enabled": false, "query": "OktaSSO\n| where eventType_s == 'user.authentication.auth_via_mfa'\n| where outcome_result_s == 'FAILURE'\n| where outcome_reason_s == 'FastPass declined phishing attempt'\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,\n outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_city_s, client_geographicalContext_country_s\n| extend Location = strcat(client_geographicalContext_city_s, \"-\", client_geographicalContext_country_s)\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "InitialAccess" ], "techniques": [ "T1566" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" }, { "fieldMappings": [ { "columnName": "client_ipAddress_s", "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { "UserAgent": "client_userAgent_rawUserAgent_s", "Location": "Location" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 4", "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "contentKind": "AnalyticsRule", "displayName": "Okta Fast Pass phishing Detection", "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "NewDeviceLocationCriticalOperation_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query identifies users seen login from new geo location/country as well as a new device and performing critical operations.", "displayName": "New Device/Location sign-in along with critical operation", "enabled": false, "query": "let timeframe = 1h;\nlet RiskyOperations = dynamic([\"policy.rule.update\",\"policy.rule.create\",\"policy.rule.delete\", \"policy.rule.deactivate\", \"policy.lifecycle.update\", \"policy.rule.modify\", \"policy.lifecycle.create\", \"policy.lifecycle.delete\", \"policy.lifecycle.deactivate\", \"policy.lifecycle.modify\", \"network_zone.rule.disabled\", \"system.api_token.create\", \"system.api_token.revoke\", \"application.policy.sign_on.update\", \"application.policy.sign_on.rule.delete\",\"user.mfa.factor.deactivate\", \"user.mfa.factor.reset_all\", \"system.mfa.factor.deactivate\", \"user.mfa.attempt_bypass\"]);\nlet UserLoginNewCountryDevice = OktaSSO\n| where eventType_s == \"user.session.start\"\n| where outcome_result_s == \"SUCCESS\"\n| where parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).behaviors)).[\"New Country\"] == \"POSITIVE\"\n| where parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).behaviors)).[\"New Geo-Location\"] == \"POSITIVE\"\n| where parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).behaviors)).[\"New Device\"] == \"POSITIVE\"\n| summarize by timekey = bin(TimeGenerated, timeframe), actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, authenticationContext_externalSessionId_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d\n| extend Location = strcat(client_geographicalContext_city_s, \"-\", client_geographicalContext_country_s);\nlet RiskyOperationsObserved = OktaSSO\n| where eventType_s in (RiskyOperations)\n| where outcome_result_s == \"SUCCESS\"\n| summarize by timekey = bin(TimeGenerated, timeframe), actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, authenticationContext_externalSessionId_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d;\nUserLoginNewCountryDevice\n| join kind=inner (RiskyOperationsObserved) on timekey, actor_displayName_s, client_ipAddress_s\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "InitialAccess", "Persistence" ], "techniques": [ "T1078", "T1556" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" }, { "fieldMappings": [ { "columnName": "client_ipAddress_s", "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { "Location": "Location", "SessionId": "authenticationContext_externalSessionId_s" }, "alertDetailsOverride": { "alertDisplayNameFormat": "New Device/Location {{Location}} sign-in along with critical operation", "alertDescriptionFormat": "This query identifies users seen login from new geo location/country {{Location}} as well as a new device and performing critical operations\n" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 5", "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "contentKind": "AnalyticsRule", "displayName": "New Device/Location sign-in along with critical operation", "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "MFAFatigue_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "MFA fatigue attack is a cybersecurity threat where attackers exploit user exhaustion from multi-factor authentication prompts to trick them into providing their MFA details thus compromising their own security. The query identifies MFA fatigue attempts in the Okta data. \n Ref: https://sec.okta.com/everythingisyes.", "displayName": "MFA Fatigue (OKTA)", "enabled": false, "query": "let PushThreshold = 10;\nOktaSSO\n| where ((eventType_s ==\"user.authentication.auth_via_mfa\" and debugContext_debugData_factor_s == \"OKTA_VERIFY_PUSH\") or eventType_s == \"system.push.send_factor_verify_push\" or eventType_s == \"user.mfa.okta_verify.deny_push\") \n| summarize IPAddress = make_set(client_ipAddress_s,100), City = make_set(client_geographicalContext_city_s,100),\n successes = countif(eventType_s == \"user.authentication.auth_via_mfa\"),\n denies = countif(eventType_s == \"user.mfa.okta_verify.deny_push\"),\n pushes = countif(eventType_s == \"system.push.send_factor_verify_push\") by TimeGenerated, authenticationContext_externalSessionId_s, actor_alternateId_s,actor_displayName_s, outcome_result_s \n| summarize lasttime = max(TimeGenerated), firsttime = min(TimeGenerated),\n successes = sum(successes), failures = sum(denies), pushes = sum(pushes) by authenticationContext_externalSessionId_s, actor_alternateId_s,actor_displayName_s, outcome_result_s \n| extend seconds = lasttime - firsttime\n| where pushes > (PushThreshold)\n| extend totalattempts = successes + failures\n| extend finding = case(\n failures == pushes and pushes > 1, \"Authentication attempts not successful because multiple pushes denied\",\n totalattempts == 0, \"Multiple pushes sent and ignored\",\n successes > 0 and pushes > 3, \"Multiple pushes sent, eventual successful authentication!\",\n \"Normal authentication pattern\")\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "CredentialAccess" ], "techniques": [ "T1621" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 6", "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "contentKind": "AnalyticsRule", "displayName": "MFA Fatigue (OKTA)", "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "HighRiskAdminActivity_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "The Okta risk engine auto-assigns risk levels to each login attempt. This query identifies admin operations originating from events associated with high-risk profiles.", "displayName": "High-Risk Admin Activity", "enabled": false, "query": "let AdminActivity = dynamic([\"iam.role.create\",\"iam.role.permissions.add\",\"user.session.access_admin_app\",\"user.mfa.factor.suspend\", \"user.account.privilege.grant\", \"group.privilege.grant\", \"system.api_token.create\", \"user.session.impersonation.grant\"]);\nlet AdminOperations = OktaSSO\n| where eventType_s in (AdminActivity)\n| where outcome_result_s =~ 'SUCCESS' \n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d, authenticationContext_externalSessionId_s;\nlet HighRiskEvents = OktaSSO\n| where eventType_s in ('policy.evaluate_sign_on' , 'user.session.start')\n| where parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).risk)).level =~ \"HIGH\"\n| where outcome_result_s =~ 'SUCCESS'\n| extend reasons = tostring(parse_json(tostring(parse_json(debugContext_debugData_logOnlySecurityData_s).risk)).reasons)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_userAgent_browser_s, client_device_s, client_userAgent_rawUserAgent_s, client_ipAddress_s, client_geographicalContext_country_s, client_geographicalContext_city_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d, authenticationContext_externalSessionId_s, reasons;\nAdminOperations\n| join kind=inner (HighRiskEvents) on actor_displayName_s, client_ipAddress_s, authenticationContext_externalSessionId_s\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "Persistence" ], "techniques": [ "T1098" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" }, { "fieldMappings": [ { "columnName": "client_ipAddress_s", "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { "SessionId": "authenticationContext_externalSessionId_s" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 7", "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "contentKind": "AnalyticsRule", "displayName": "High-Risk Admin Activity", "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "DeviceRegistrationMaliciousIP_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "This query identifies Device Registration from IP addresses identified as malicious by Okta ThreatInsight.", "displayName": "Device Registration from Malicious IP", "enabled": false, "query": "let Events = dynamic([\"device.enrollment.create\"]);\nlet ThreatInsightOperations = dynamic([\"security.threat.detected\", \"security.attack.start\", \"security.attack.end\" ]);\nlet DeviceRegistrations = OktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s == \"SUCCESS\"\n| extend oktaDeviceId_ = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).oktaDeviceId), NewDevice_osPlatform = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).osPlatform), NewDevice_osVersion = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).osVersion), displayName_ = tostring(parse_json(target_s)[0].displayName)\n| extend Location = strcat(client_geographicalContext_city_s, \" | \", client_geographicalContext_state_s,\" | \", client_geographicalContext_country_s)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, displayMessage_s, outcome_result_s,\noutcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), column_ifexists('debugContext_debugData_threatSuspected_s',\"\"), client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, NewDevice_osPlatform, NewDevice_osVersion, eventType_s, Location ;\nlet ThreatInsightEvents = OktaSSO\n| where eventType_s in (ThreatInsightOperations)\n| extend SuspiciousIP = actor_displayName_s\n| project TimeGenerated, debugContext_debugData_threatDetections_s, client_userAgent_rawUserAgent_s, severity_s, outcome_result_s, eventType_s, displayMessage_s, SuspiciousIP, transaction_id_s;\nDeviceRegistrations \n| join kind=inner (ThreatInsightEvents) on $left.client_ipAddress_s == $right.SuspiciousIP\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "Persistence" ], "techniques": [ "T1098" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" }, { "fieldMappings": [ { "columnName": "client_ipAddress_s", "identifier": "Address" } ], "entityType": "IP" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 8", "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "contentKind": "AnalyticsRule", "displayName": "Device Registration from Malicious IP", "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "UserSessionImpersonation_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "A user has started a session impersonation, gaining access with the impersonated users permissions. This typically signifies Okta admin access and should only happen if anticipated and requested.", "displayName": "User Session Impersonation(Okta)", "enabled": false, "query": "Okta_CL\n| where eventType_s == \"user.session.impersonation.initiate\" and outcome_result_s == \"SUCCESS\"\n// Expand the JSON array in 'target_s' field to extract detailed information about the event\n| mv-expand parsed_json = todynamic(target_s) // Unpack and understand the details from the 'target_s' JSON array\n// Enhance visibility by extending columns with extracted details for better analysis\n| extend TargetUser_id = tostring(parsed_json.id), \n TargetUser_type = tostring(parsed_json.type), \n TargetUser_alternateId = tostring(parsed_json.alternateId), \n TargetUser_displayName = tostring(parsed_json.displayName), \n Target_detailEntry = tostring(parsed_json.detailEntry) \n// Project event details to gain insights into the security context, including actor and target user information\n| project TimeGenerated, actor_alternateId_s, actor_displayName_s, TargetUser_alternateId, \n TargetUser_displayName, TargetUser_type, TargetUser_id, \n eventType_s, outcome_result_s\n", "queryFrequency": "PT6H", "queryPeriod": "PT6H", "severity": "Medium", "suppressionDuration": "PT1H", "suppressionEnabled": false, "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", "requiredDataConnectors": [ { "dataTypes": [ "Okta_CL" ], "connectorId": "OktaSSO" }, { "dataTypes": [ "OktaSSO" ], "connectorId": "OktaSSOv2" } ], "tactics": [ "PrivilegeEscalation" ], "techniques": [ "T1134", "T1134" ], "entityMappings": [ { "fieldMappings": [ { "columnName": "actor_alternateId_s", "identifier": "Name" }, { "columnName": "actor_displayName_s", "identifier": "DisplayName" } ], "entityType": "Account" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", "properties": { "description": "Okta Single Sign-On Analytics Rule 9", "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "kind": "AnalyticsRule", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "contentKind": "AnalyticsRule", "displayName": "User Session Impersonation(Okta)", "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "Okta Single Sign-On data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", "title": "Okta Single Sign-On (using Azure Functions)", "publisher": "Okta", "descriptionMarkdown": "The [Okta Single Sign-On (SSO)](https://www.okta.com/products/single-sign-on/) connector provides the capability to ingest audit and event logs from the Okta API into Microsoft Sentinel. The connector provides visibility into these log types in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", "graphQueries": [ { "metricName": "Total data received", "legend": "Okta Logs", "baseQuery": "Okta_CL" } ], "sampleQueries": [ { "description": "Top 10 Active Applications", "query": "Okta_CL \n| mv-expand todynamic(target_s) \n| where target_s.type == \"AppInstance\" \n| summarize count() by tostring(target_s.alternateId) \n| top 10 by count_" }, { "description": "Top 10 Client IP Addresses", "query": "Okta_CL \n| summarize count() by client_ipAddress_s \n| top 10 by count_" } ], "dataTypes": [ { "name": "Okta_CL", "lastDataReceivedQuery": "Okta_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ "Okta_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "availability": { "status": 1, "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions on the workspace are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "action": true } } ], "customs": [ { "name": "Microsoft.Web/sites permissions", "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." }, { "name": "Okta API Token", "description": "An Okta API Token is required. See the documentation to learn more about the [Okta System Log API](https://developer.okta.com/docs/reference/api/system-log/)." } ] }, "instructionSteps": [ { "description": ">**NOTE:** This connector uses Azure Functions to connect to Okta SSO to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { "description": ">**NOTE:** This connector has been updated, if you have previously deployed an earlier version, and want to update, please delete the existing Okta Azure Function before redeploying this version." }, { "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { "description": "**STEP 1 - Configuration steps for the Okta SSO API**\n\n [Follow these instructions](https://developer.okta.com/docs/guides/create-an-api-token/create-the-token/) to create an API Token." }, { "description": "**Note** - For more information on the rate limit restrictions enforced by Okta, please refer to the **[documentation](https://developer.okta.com/docs/reference/rl-global-mgmt/)**." }, { "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Okta SSO connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Okta SSO API Authorization Token, readily available.", "instructions": [ { "parameters": { "fillWith": [ "WorkspaceId" ], "label": "Workspace ID" }, "type": "CopyableLabel" }, { "parameters": { "fillWith": [ "PrimaryKey" ], "label": "Primary Key" }, "type": "CopyableLabel" } ] }, { "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "This method provides an automated deployment of the Okta SSO connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentineloktaazuredeployv2-solution)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Token** and **URI**. \n - Use the following schema for the `uri` value: `https:///api/v1/logs?since=` Replace `` with your domain. [Click here](https://developer.okta.com/docs/reference/api-overview/#url-namespace) for further details on how to identify your Okta domain namespace. There is no need to add a time value to the URI, the Function App will dynamically append the inital start time of logs to UTC 0:00 for the current UTC date as time value to the URI in the proper format. \n - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." }, { "title": "Option 2 - Manual Deployment of Azure Functions", "description": "Use the following step-by-step instructions to deploy the Okta SSO connector manually with Azure Functions (Deployment via Visual Studio Code).", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Step 1 - Deploy a Function App", "description": "1. Download the [Azure Function App](https://aka.ms/sentineloktaazurefunctioncodev2) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." }, { "title": "Step 2 - Configure the Function App", "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following five (5) application settings individually, with their respective string values (case-sensitive): \n\t\tapiToken\n\t\tworkspaceID\n\t\tworkspaceKey\n\t\turi\n\t\tlogAnalyticsUri (optional)\n - Use the following schema for the `uri` value: `https:///api/v1/logs?since=` Replace `` with your domain. [Click here](https://developer.okta.com/docs/reference/api-overview/#url-namespace) for further details on how to identify your Okta domain namespace. There is no need to add a time value to the URI, the Function App will dynamically append the inital start time of logs to UTC 0:00 for the current UTC date as time value to the URI in the proper format.\n - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://.ods.opinsights.azure.us. \n5. Once all application settings have been entered, click **Save**." } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId1')]", "contentKind": "DataConnector", "displayName": "Okta Single Sign-On (using Azure Functions)", "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" ], "location": "[parameters('workspace-location')]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { "title": "Okta Single Sign-On (using Azure Functions)", "publisher": "Okta", "descriptionMarkdown": "The [Okta Single Sign-On (SSO)](https://www.okta.com/products/single-sign-on/) connector provides the capability to ingest audit and event logs from the Okta API into Microsoft Sentinel. The connector provides visibility into these log types in Microsoft Sentinel to view dashboards, create custom alerts, and to improve monitoring and investigation capabilities.", "graphQueries": [ { "metricName": "Total data received", "legend": "Okta Logs", "baseQuery": "Okta_CL" } ], "dataTypes": [ { "name": "Okta_CL", "lastDataReceivedQuery": "Okta_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ "Okta_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { "description": "Top 10 Active Applications", "query": "Okta_CL \n| mv-expand todynamic(target_s) \n| where target_s.type == \"AppInstance\" \n| summarize count() by tostring(target_s.alternateId) \n| top 10 by count_" }, { "description": "Top 10 Client IP Addresses", "query": "Okta_CL \n| summarize count() by client_ipAddress_s \n| top 10 by count_" } ], "availability": { "status": 1, "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "read and write permissions on the workspace are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "action": true } } ], "customs": [ { "name": "Microsoft.Web/sites permissions", "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." }, { "name": "Okta API Token", "description": "An Okta API Token is required. See the documentation to learn more about the [Okta System Log API](https://developer.okta.com/docs/reference/api/system-log/)." } ] }, "instructionSteps": [ { "description": ">**NOTE:** This connector uses Azure Functions to connect to Okta SSO to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { "description": ">**NOTE:** This connector has been updated, if you have previously deployed an earlier version, and want to update, please delete the existing Okta Azure Function before redeploying this version." }, { "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { "description": "**STEP 1 - Configuration steps for the Okta SSO API**\n\n [Follow these instructions](https://developer.okta.com/docs/guides/create-an-api-token/create-the-token/) to create an API Token." }, { "description": "**Note** - For more information on the rate limit restrictions enforced by Okta, please refer to the **[documentation](https://developer.okta.com/docs/reference/rl-global-mgmt/)**." }, { "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Okta SSO connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Okta SSO API Authorization Token, readily available.", "instructions": [ { "parameters": { "fillWith": [ "WorkspaceId" ], "label": "Workspace ID" }, "type": "CopyableLabel" }, { "parameters": { "fillWith": [ "PrimaryKey" ], "label": "Primary Key" }, "type": "CopyableLabel" } ] }, { "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Option 1 - Azure Resource Manager (ARM) Template", "description": "This method provides an automated deployment of the Okta SSO connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentineloktaazuredeployv2-solution)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **API Token** and **URI**. \n - Use the following schema for the `uri` value: `https:///api/v1/logs?since=` Replace `` with your domain. [Click here](https://developer.okta.com/docs/reference/api-overview/#url-namespace) for further details on how to identify your Okta domain namespace. There is no need to add a time value to the URI, the Function App will dynamically append the inital start time of logs to UTC 0:00 for the current UTC date as time value to the URI in the proper format. \n - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." }, { "title": "Option 2 - Manual Deployment of Azure Functions", "description": "Use the following step-by-step instructions to deploy the Okta SSO connector manually with Azure Functions (Deployment via Visual Studio Code).", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Step 1 - Deploy a Function App", "description": "1. Download the [Azure Function App](https://aka.ms/sentineloktaazurefunctioncodev2) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." }, { "title": "Step 2 - Configure the Function App", "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following five (5) application settings individually, with their respective string values (case-sensitive): \n\t\tapiToken\n\t\tworkspaceID\n\t\tworkspaceKey\n\t\turi\n\t\tlogAnalyticsUri (optional)\n - Use the following schema for the `uri` value: `https:///api/v1/logs?since=` Replace `` with your domain. [Click here](https://developer.okta.com/docs/reference/api-overview/#url-namespace) for further details on how to identify your Okta domain namespace. There is no need to add a time value to the URI, the Function App will dynamically append the inital start time of logs to UTC 0:00 for the current UTC date as time value to the URI in the proper format.\n - Note: If using Azure Key Vault secrets for any of the values above, use the`@Microsoft.KeyVault(SecretUri={Security Identifier})`schema in place of the string values. Refer to [Key Vault references documentation](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) for further details.\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: https://.ods.opinsights.azure.us. \n5. Once all application settings have been entered, click **Save**." } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] } ], "id": "[variables('_uiConfigId1')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition2'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", "displayName": "Okta Single Sign-On (Preview)", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": {}, "variables": {}, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "OktaSSOv2", "title": "Okta Single Sign-On (Preview)", "publisher": "Microsoft", "logo": "OktaLogo.svg", "descriptionMarkdown": "The [Okta Single Sign-On (SSO)](https://www.okta.com/products/single-sign-on/) data connector provides the capability to ingest audit and event logs from the Okta Sysem Log API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform and uses the Okta System Log API to fetch the events. The connector supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "OktaSSO", "graphQueries": [ { "metricName": "Total data received", "legend": "Okta SSO Events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "Get Sample of Okta SSO Events", "query": "{{graphQueriesTableName}}\n | take 10" }, { "description": "Total Events by uuid", "query": "{{graphQueriesTableName}}\n | summarize count() by OriginalEventUid" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max (TimeGenerated)\n|where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Okta API Token", "description": "An Okta API token. Follow the [following instructions](https://developer.okta.com/docs/guides/create-an-api-token/main/) to create an See the [documentation](https://developer.okta.com/docs/reference/api/system-log/) to learn more about Okta System Log API." } ] }, "instructionSteps": [ { "description": "To enable the Okta Single Sign-On for Microsoft Sentinel, provide the required information below and click on Connect.\n>", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Endpoint", "columnValue": "properties.request.apiEndpoint" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add domain", "title": "Add domain", "subtitle": "Add domain", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "Textbox", "parameters": { "label": "Okta Domain Name", "placeholder": "Okta Domain Name (e.g., myDomain.okta.com)", "type": "text", "name": "domainname" } }, { "type": "Textbox", "parameters": { "label": "API Key", "placeholder": "API Key", "type": "password", "name": "apikey" } } ] } ] } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections2')]", "kind": "ResourcesDataConnector" } ] } } }, { "name": "oktassov2-ccp", "apiVersion": "2022-06-01", "type": "Microsoft.Insights/dataCollectionRules", "location": "[parameters('workspace-location')]", "kind": "[variables('blanks')]", "properties": { "streamDeclarations": { "Custom-OktaSSO_CL": { "columns": [ { "name": "uuid", "type": "string" }, { "name": "DomainName", "type": "string" }, { "name": "published", "type": "datetime" }, { "name": "eventType", "type": "string" }, { "name": "version", "type": "string" }, { "name": "severity", "type": "string" }, { "name": "legacyEventType", "type": "string" }, { "name": "displayMessage", "type": "string" }, { "name": "actor", "type": "dynamic" }, { "name": "client", "type": "dynamic" }, { "name": "outcome", "type": "dynamic" }, { "name": "target", "type": "dynamic" }, { "name": "transaction", "type": "dynamic" }, { "name": "debugContext", "type": "dynamic" }, { "name": "authenticationContext", "type": "dynamic" }, { "name": "securityContext", "type": "dynamic" }, { "name": "request", "type": "dynamic" } ] } }, "dataSources": "[variables('TemplateEmptyObject')]", "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "clv2ws1" } ] }, "dataFlows": [ { "streams": [ "Custom-OktaSSO_CL" ], "destinations": [ "clv2ws1" ], "transformKql": "let OktaASIMSev = parse_json('{\"DEBUG\": \"Informational\",\"INFO\": \"Informational\",\"WARN\": \"Medium\", \"ERROR\": \"High\"}');\nlet OktaASIMEventResult = parse_json('{\"SUCCESS\": \"Success\",\"ALLOW\": \"Success\",\"DENY\": \"Failure\", \"SKIPPED\": \"Failure\",\"FAILURE\": \"Failure\",\"CHALLENGE\": \"Partial\", \"UNKNOWN\": \"NA\"}');\nlet OktaDvcAction = parse_json('{\"SUCCESS\": \"\",\"ALLOW\": \"Allow\",\"DENY\": \"Deny\", \"SKIPPED\": \"Drop\",\"FAILURE\": \"\",\"CHALLENGE\": \"\", \"UNKNOWN\": \"\"}');\nlet OktaActorUserType = parse_json('{\"SystemPrincipal\": \"System Principal\",\"PublicClientApp\": \"Application\",\"User\": \"Regular\"}');\nsource | extend userId = iff((tostring(actor.id) == \"unknown\"), \"\", tostring(actor.id)),username = iff((tostring(actor.alternateId) contains \"@\"),tostring(actor.alternateId),\"\") | project TimeGenerated = todatetime(published), DomainName, ActorDetailEntry = actor.detailEntry,ActorDisplayName = tostring(actor.displayName),OriginalUserId = tostring(actor.id),OriginalActorAlternateId = tostring(actor.alternateId),ActorUserId = userId,ActorUserIdType = iff(isempty(userId),\"\", \"OktaId\"),ActorUsername = username,ActorUsernameType = iff(isempty(username), \"\", \"UPN\"),ActorUserType = tostring(OktaActorUserType[tostring(actor.type)]),OriginalUserType = tostring(actor.type),AuthenticationContextAuthenticationProvider = tostring(authenticationContext.authenticationProvider),AuthenticationContextAuthenticationStep = toint(authenticationContext.authenticationStep),AuthenticationContextCredentialProvider = tostring(authenticationContext.credentialProvider),LogonMethod = tostring(authenticationContext.credentialType),ActorSessionId = tostring(authenticationContext.externalSessionId),AuthenticationContextInterface = tostring(authenticationContext.interface),AuthenticationContextIssuerId = tostring(authenticationContext.issuer.id),AuthenticationContextIssuerType = tostring(authenticationContext.issuer.type),OriginalClientDevice = tostring(client.device),SrcDeviceType = iff(tostring(client.device) == \"Computer\", \"Computer\", \"\"),SrcGeoCity = tostring(client.geographicalContext.city),SrcGeoCountry = tostring(client.geographicalContext.country),SrcGeoLatitude = toreal(client.geographicalContext.geolocation.lat), SrcGeoLongtitude = toreal(client.geographicalContext.geolocation.lon), SrcGeoPostalCode = tostring(client.geographicalContext.postalCode), SrcGeoRegion = tostring(client.geographicalContext.state), SrcDvcIdType = iff(isempty(client.id),\"\", \"OktaId\"),SrcDvcId = tostring(client.id),SrcIpAddr = tostring(client.ipAddress), ActingAppName = tostring(client.userAgent.browser),ActingAppType = \"Browser\",SrcDvcOs = tostring(client.userAgent.os), HttpUserAgent = tostring(client.userAgent.rawUserAgent), SrcZone = tostring(client.zone), DebugData = debugContext.debugData, EventMessage = displayMessage,EventOriginalType = eventType,LegacyEventType = legacyEventType,EventOriginalUid = uuid,EventOriginalResultDetails = tostring(outcome.reason), EventResult = tostring(OktaASIMEventResult[tostring(outcome.result)]), OriginalOutcomeResult = tostring(outcome.result),Request = request,SecurityContextAsNumber = toint(securityContext.asNumber), SecurityContextAsOrg = tostring(securityContext.asOrg),SecurityContextDomain = tostring(securityContext.domain),SrcIsp = tostring(securityContext.isp), SecurityContextIsProxy = tobool(securityContext.isProxy),EventSeverity = tostring(OktaASIMSev[severity]),OriginalSeverity = severity,OriginalTarget = target,Version = version,TransactionType = tostring(transaction.type), TransactionId = tostring(transaction.id), TransactionDetail = transaction.detail,DvcAction = tostring(OktaDvcAction[tostring(outcome.result)]) \n", "outputStream": "Custom-OktaV2_CL" } ], "dataCollectionEndpointId": "[variables('dataCollectionEndpointId2')]" } }, { "name": "OktaV2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { "name": "OktaV2_CL", "columns": [ { "name": "ActingAppName", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActingAppType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorDetailEntry", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorDisplayName", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorSessionId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorUserId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorUserIdType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorUsername", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorUsernameType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "ActorUserType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextAuthenticationProvider", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextAuthenticationStep", "type": "int", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextCredentialProvider", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextInterface", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextIssuerId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "AuthenticationContextIssuerType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "DebugData", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "DomainName", "type": "string" }, { "name": "DvcAction", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventMessage", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventOriginalResultDetails", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventOriginalType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventOriginalUid", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventResult", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "EventSeverity", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "HttpUserAgent", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "LegacyEventType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "LogonMethod", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalActorAlternateId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalClientDevice", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalOutcomeResult", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalSeverity", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalTarget", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalUserId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "OriginalUserType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "Request", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "SecurityContextAsNumber", "type": "int", "isDefaultDisplay": false, "isHidden": false }, { "name": "SecurityContextAsOrg", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SecurityContextDomain", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SecurityContextIsProxy", "type": "boolean", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcDeviceType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcDvcId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcDvcOs", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoCity", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoCountry", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoLatitude", "type": "real", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoLongtitude", "type": "real", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoPostalCode", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcGeoRegion", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcIpAddr", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcIsp", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcZone", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "TimeGenerated", "type": "datetime", "isDefaultDisplay": false, "isHidden": false }, { "name": "TransactionDetail", "type": "dynamic", "isDefaultDisplay": false, "isHidden": false }, { "name": "TransactionId", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "TransactionType", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "Version", "type": "string", "isDefaultDisplay": false, "isHidden": false }, { "name": "SrcDvcIdType", "type": "string", "isDefaultDisplay": false, "isHidden": false } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition2'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition2'))]", "apiVersion": "2022-09-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "OktaSSOv2", "title": "Okta Single Sign-On (Preview)", "publisher": "Microsoft", "logo": "OktaLogo.svg", "descriptionMarkdown": "The [Okta Single Sign-On (SSO)](https://www.okta.com/products/single-sign-on/) data connector provides the capability to ingest audit and event logs from the Okta Sysem Log API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform and uses the Okta System Log API to fetch the events. The connector supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security event data into a custom columns so that queries don't need to parse it again, thus resulting in better performance.", "graphQueriesTableName": "OktaSSO", "graphQueries": [ { "metricName": "Total data received", "legend": "Okta SSO Events", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "Get Sample of Okta SSO Events", "query": "{{graphQueriesTableName}}\n | take 10" }, { "description": "Total Events by uuid", "query": "{{graphQueriesTableName}}\n | summarize count() by OriginalEventUid" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}|summarize Time = max (TimeGenerated)\n|where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors" } ], "availability": { "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "write": true, "read": true, "delete": true } } ], "customs": [ { "name": "Okta API Token", "description": "An Okta API token. Follow the [following instructions](https://developer.okta.com/docs/guides/create-an-api-token/main/) to create an See the [documentation](https://developer.okta.com/docs/reference/api/system-log/) to learn more about Okta System Log API." } ] }, "instructionSteps": [ { "description": "To enable the Okta Single Sign-On for Microsoft Sentinel, provide the required information below and click on Connect.\n>", "instructions": [ { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnName": "Endpoint", "columnValue": "properties.request.apiEndpoint" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "isPrimary": true, "label": "Add domain", "title": "Add domain", "subtitle": "Add domain", "contextPaneType": "DataConnectorsContextPane", "instructionSteps": [ { "instructions": [ { "type": "Textbox", "parameters": { "label": "Okta Domain Name", "placeholder": "Okta Domain Name (e.g., myDomain.okta.com)", "type": "text", "name": "domainname" } }, { "type": "Textbox", "parameters": { "label": "API Key", "placeholder": "API Key", "type": "password", "name": "apikey" } } ] } ] } } ] } ] } } }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition2')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition2'))]", "contentId": "[variables('_dataConnectorContentIdConnectorDefinition2')]", "kind": "DataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "version": "[variables('dataConnectorCCPVersion')]", "contentId": "[variables('_dataConnectorContentIdConnections2')]", "kind": "ResourcesDataConnector" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections2'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections2')]", "displayName": "Okta Single Sign-On (Preview)", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorCCPVersion')]", "parameters": { "apikey": { "defaultValue": "-NA-", "type": "securestring", "minLength": 1 }, "domainname": { "defaultValue": "Enter domainname value", "type": "string", "minLength": 1 }, "connectorDefinitionName": { "defaultValue": "Okta Single Sign-On (Preview)", "type": "string", "minLength": 1 }, "innerWorkspace": { "defaultValue": "[parameters('workspace')]", "type": "string" }, "dcrConfig": { "defaultValue": { "dataCollectionEndpoint": "data collection Endpoint", "dataCollectionRuleImmutableId": "data collection rule immutableId" }, "type": "object" } }, "variables": { "_dataConnectorContentIdConnections2": "[variables('_dataConnectorContentIdConnections2')]" }, "resources": [ { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections2')))]", "apiVersion": "2022-01-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections2'))]", "contentId": "[variables('_dataConnectorContentIdConnections2')]", "kind": "ResourcesDataConnector", "version": "[variables('dataConnectorCCPVersion')]", "source": { "sourceId": "[variables('_solutionId')]", "name": "[variables('_solutionName')]", "kind": "Solution" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } }, { "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'OktaDCV1_', parameters('domainname'))]", "apiVersion": "2024-09-01", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "RestApiPoller", "properties": { "connectorDefinitionName": "OktaSSOv2", "dcrConfig": { "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", "streamName": "Custom-OktaSSO_CL" }, "dataType": "Okta System Log API", "addOnAttributes": { "DomainName": "[[parameters('domainname')]" }, "response": { "eventsJsonPaths": [ "$" ], "format": "json" }, "paging": { "pagingType": "LinkHeader" }, "auth": { "apiKeyName": "Authorization", "ApiKey": "[[parameters('apikey')]", "apiKeyIdentifier": "SSWS", "type": "APIKey" }, "request": { "apiEndpoint": "[[concat('https://', parameters('domainname'), '/api/v1/logs')]", "rateLimitQPS": 1, "paginatedCallsPerSecond": 1.0, "queryWindowInMin": 5, "httpMethod": "GET", "retryCount": 3, "timeoutInSeconds": 60, "headers": { "Accept": "application/json", "User-Agent": "Scuba" }, "queryParameters": { "limit": "1000" }, "rateLimitConfig": { "evaluation": { "checkMode": "OnlyWhen429" }, "extraction": { "source": "DefaultHeaders" }, "retryStrategy": { "useResetOrRetryAfterHeaders": true } }, "startTimeAttributeName": "since", "endTimeAttributeName": "until" }, "isActive": true } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections2'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('_solutionVersion')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "AdminPrivilegeGrant_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Admin privilege granted (Okta)", "category": "Hunting Queries", "query": "let Events = dynamic([\"group.privilege.grant\", \"user.account.privilege.grant\"]);\nOktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s =~ \"SUCCESS\"\n| extend Target=parsejson(target_s)\n| mvexpand bagexpansion=array (Target)\n| evaluate bag_unpack(Target)\n| extend Target_Id = tostring(column_ifexists('id', \"\")), Target_type = tostring(column_ifexists('type', \"\")), Target_user = tostring(column_ifexists('displayName', \"\")), Target_alternateId = tostring(column_ifexists('alternateId', \"\"))\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_id_s, actor_type_s, actor_alternateId_s, actor_displayName_s, Target_alternateId, Target_Id, Target_type, Target_user,column_ifexists('debugContext_debugData_privilegeGranted_s', \"\"),domain_s,\n authenticationContext_externalSessionId_s, eventType_s, displayMessage_s, transaction_id_s, uuid_g\n", "version": 2, "tags": [ { "name": "description", "value": "Query checks for admin permissions granted to users/groups, often used by adversaries for access and privilege elevation." }, { "name": "tactics", "value": "Persistence" }, { "name": "techniques", "value": "T1098" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 1", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "contentKind": "HuntingQuery", "displayName": "Admin privilege granted (Okta)", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "CreateAPIToken_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Create API Token (Okta)", "category": "Hunting Queries", "query": "let Events = dynamic([\"system.api_token.create\"]);\nOktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s =~ \"SUCCESS\"\n", "version": 2, "tags": [ { "name": "description", "value": "Okta API tokens are used to authenticate requests to Okta APIs. This query searches for attempts to create new API Token.\n Refrence: https://developer.okta.com/docs/reference/api/event-types/" }, { "name": "tactics", "value": "PrivilegeEscalation" }, { "name": "techniques", "value": "T1134" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 2", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "contentKind": "HuntingQuery", "displayName": "Create API Token (Okta)", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "ImpersonationSession_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Initiate impersonation session (Okta)", "category": "Hunting Queries", "query": "let Events = dynamic([\"user.session.impersonation.initiate\", \"user.session.impersonation.grant\", \"user.session.impersonation.extend\", \"user.session.impersonation.end\", \"user.session.impersonation.revoke\"]);\nOktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s =~ \"SUCCESS\"\n", "version": 2, "tags": [ { "name": "description", "value": "User.session.impersonation, usually triggered by Okta Support, are rare. This query checks for impersonation events used in LAPSUS$ breach." }, { "name": "tactics", "value": "InitialAccess" }, { "name": "techniques", "value": "T1195" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 3", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "contentKind": "HuntingQuery", "displayName": "Initiate impersonation session (Okta)", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "RareMFAOperation_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Rare MFA Operations (Okta)", "category": "Hunting Queries", "query": "let Events = dynamic([\"user.mfa.factor.update\", \"system.mfa.factor.deactivate\", \"user.mfa.attempt_bypass\", \"user.mfa.factor.reset_all\"]);\nOktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s =~ \"SUCCESS\"\n| extend Target=parsejson(target_s)\n| mvexpand bagexpansion=array (Target)\n| evaluate bag_unpack(Target)\n| extend Target_Id = tostring(column_ifexists('id', \"\")), Target_type = tostring(column_ifexists('type', \"\")), Target_user = tostring(column_ifexists('displayName', \"\")), Target_alternateId = tostring(column_ifexists('alternateId', \"\"))\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_id_s, actor_type_s, actor_alternateId_s, actor_displayName_s, Target_alternateId, Target_Id, Target_type, Target_user,debugContext_debugData_requestUri_s,\n debugContext_debugData_requestId_s, domain_s, authenticationContext_externalSessionId_s, eventType_s, displayMessage_s, transaction_id_s, uuid_g, client_userAgent_rawUserAgent_s, client_userAgent_os_s, client_userAgent_browser_s, \n client_ipAddress_s, column_ifexists('client_geographicalContext_city_s', \"\"), column_ifexists('client_geographicalContext_state_s', \"\"), column_ifexists('client_geographicalContext_country_s', \"\"), column_ifexists('securityContext_isp_s', \"\")\n", "version": 2, "tags": [ { "name": "description", "value": "MFA prevents credential compromise. This query checks for rare MFA operations like deactivation, update, reset, and bypass attempts often used by adversaries to compromise networks/accounts." }, { "name": "tactics", "value": "Persistence" }, { "name": "techniques", "value": "T1098" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 4", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]", "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject4').huntingQueryVersion4]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "contentKind": "HuntingQuery", "displayName": "Rare MFA Operations (Okta)", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "UserPasswordReset_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "User password reset(Okta)", "category": "Hunting Queries", "query": "let Events = dynamic([\"user.account.reset_password\"]);\nOktaSSO\n| where eventType_s in (Events)\n| where outcome_result_s =~ \"SUCCESS\"\n", "version": 2, "tags": [ { "name": "description", "value": "Adversaries often manipulate accounts for access. This query checks for admin attempts to reset user passwords in Okta logs." }, { "name": "tactics", "value": "Persistence" }, { "name": "techniques", "value": "T1098" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 5", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]", "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject5').huntingQueryVersion5]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "contentKind": "HuntingQuery", "displayName": "User password reset(Okta)", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "NewDeviceRegistration_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "New device registration from unfamiliar location", "category": "Hunting Queries", "query": "let Events = dynamic([\"device.enrollment.create\"]);\nlet DeviceRegistrations = OktaSSO\n | where eventType_s in (Events)\n | where outcome_result_s == \"SUCCESS\"\n | extend oktaDeviceId_ = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).oktaDeviceId), NewDevice_osPlatform = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).osPlatform), NewDevice_osVersion = tostring(parse_json(tostring(parse_json(target_s)[0].detailEntry)).osVersion), displayName_ = tostring(parse_json(target_s)[0].displayName)\n | extend Location = strcat(client_geographicalContext_city_s, \" | \", client_geographicalContext_state_s,\" | \", client_geographicalContext_country_s)\n | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, displayMessage_s, outcome_result_s,\n outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), column_ifexists('debugContext_debugData_threatSuspected_s',\"\"), client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, NewDevice_osPlatform, NewDevice_osVersion, eventType_s, Location ;\nlet UserLogins = OktaSSO\n | where TimeGenerated > ago(14d)\n | where eventType_s =~ \"user.session.start\"\n | where outcome_result_s =~ \"SUCCESS\"\n | extend Location = strcat(client_geographicalContext_city_s, \" | \", client_geographicalContext_state_s,\" | \", client_geographicalContext_country_s)\n | project actor_alternateId_s, actor_displayName_s, Location;\nDeviceRegistrations\n | join kind=leftanti (\n UserLogins\n )\non Location, actor_alternateId_s\n | extend Account_0_Name = actor_displayName_s\n | extend IP_0_Address = client_ipAddress_s\n", "version": 2, "tags": [ { "name": "description", "value": "This query identifies new device being registered from a location where the user does not normally login from" }, { "name": "tactics", "value": "Persistence" }, { "name": "techniques", "value": "T1098" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 6", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]", "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject6').huntingQueryVersion6]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", "contentKind": "HuntingQuery", "displayName": "New device registration from unfamiliar location", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "LoginsVPSProvider_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_7", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Logins originating from VPS Providers", "category": "Hunting Queries", "query": "let IP_Data = (externaldata(network:string)\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/VPS_Networks.csv\"] with (format=\"csv\"));\nOktaSSO\n| where eventType_s =~ \"user.session.start\"\n| where outcome_result_s =~ \"SUCCESS\"\n| evaluate ipv4_lookup(IP_Data, client_ipAddress_s, network, return_unmatched = false)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,\noutcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s\n| extend Account_0_Name = actor_displayName_s\n| extend IP_0_Address = client_ipAddress_s\n", "version": 2, "tags": [ { "name": "description", "value": "This query searches for successful logons from known VPS provider network ranges.\n This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed." }, { "name": "tactics", "value": "InitialAccess" }, { "name": "techniques", "value": "T1078" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 7", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]", "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject7').huntingQueryVersion7]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", "contentKind": "HuntingQuery", "displayName": "Logins originating from VPS Providers", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "LoginNordVPN_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_8", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Sign-ins from Nord VPN Providers", "category": "Hunting Queries", "query": "let nord_vpn_feed = (externaldata(id:int,ip_address: string,search_keywords: dynamic,categories:dynamic,name: string,domain:string,price:int,flag:string,country:string,location:dynamic ,load: int ,features:dynamic)\n [@\"https://raw.githubusercontent.com/microsoft/mstic/master/nordvpn-servers.csv\"] with (format=\"csv\", ignoreFirstRecord=True));\nOktaSSO\n| where eventType_s =~ \"user.session.start\"\n| where outcome_result_s =~ \"SUCCESS\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,\n outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s\n| join kind= inner nord_vpn_feed on $left.client_ipAddress_s == $right.ip_address\n| extend Account_0_Name = actor_displayName_s\n| extend IP_0_Address = client_ipAddress_s\n", "version": 2, "tags": [ { "name": "description", "value": "This query searches for sign-in activity from Nord VPN providers.\nThe purpose is to identify any unfamiliar sign-in attempts from VPN providers, that are not typically observed among users in the organization." }, { "name": "tactics", "value": "InitialAccess" }, { "name": "techniques", "value": "T1078" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 8", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]", "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject8').huntingQueryVersion8]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", "contentKind": "HuntingQuery", "displayName": "Sign-ins from Nord VPN Providers", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "LoginFromMultipleLocations_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_9", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Okta Login from multiple locations", "category": "Hunting Queries", "query": "let starttime = ago(4d);\nlet endtime = ago(2d);\nlet common_locations = (OktaSSO\n | where TimeGenerated between(starttime..endtime)\n //| where eventType_s =~ 'user.session.start'\n | extend locationString= strcat(client_geographicalContext_country_s, \"/\",client_geographicalContext_state_s, \"/\", client_geographicalContext_city_s)\n | where locationString != \"//\"\n | summarize count() by locationString\n //modify the most common location value(below) based on your enviornment \n | take 20\n | project locationString);\nlet signIns = (OktaSSO\n | where TimeGenerated between(starttime..endtime)\n // | where eventType_s =~ 'user.session.start'\n | extend locationString= strcat(client_geographicalContext_country_s, \"/\",client_geographicalContext_state_s, \"/\", client_geographicalContext_city_s)\n | where locationString != \"//\" and locationString !endswith \"/\"\n | where locationString !in (common_locations));\n // Adjust these to tune your query\nlet lookupWindow = 10m;\nlet lookupBin = lookupWindow / 2.0; // lookup bin = equal to 1/2 of the lookup window\nlet threshold = 5;\nlet users = (signIns\n| summarize dcount(locationString) by actor_displayName_s\n| where dcount_locationString > threshold\n| project actor_displayName_s);\nsignIns\n | where actor_displayName_s in (users)\n | project-rename Start=TimeGenerated\n | extend TimeKey = bin(Start, lookupBin)\n | join kind = inner (\n signIns\n | project-rename End=TimeGenerated, EndLocationString=locationString\n // TimeKey on the right side of the join - emulates this authentication appearing several times\n | extend TimeKey = range(bin(End - lookupWindow, lookupBin),\n bin(End, lookupBin), lookupBin)\n | mvexpand TimeKey to typeof(datetime) // translate TimeKey arrange range to a column\n ) on actor_displayName_s, TimeKey\n | where End > Start\n | project tostring(Start), tostring(End), locationString, EndLocationString, timeSpan = End - Start, actor_displayName_s, client_ipAddress_s, client_userAgent_rawUserAgent_s, client_userAgent_browser_s, client_device_s, displayMessage_s, outcome_result_s, outcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_geographicalContext_geolocation_lat_d, client_geographicalContext_geolocation_lon_d, eventType_s\n | where locationString != EndLocationString\n | summarize ips=make_set(client_ipAddress_s,100), UAs=make_set(client_userAgent_rawUserAgent_s,100) by timeSpan, actor_displayName_s, locationString, EndLocationString, Start, End, client_userAgent_rawUserAgent_s, client_userAgent_browser_s, client_device_s\n | extend Account_0_Name = actor_displayName_s\n", "version": 2, "tags": [ { "name": "description", "value": "This query identifies accounts associated with multiple authentications from different geographical locations in a short period of time." }, { "name": "tactics", "value": "CredentialAccess" }, { "name": "techniques", "value": "T1110" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 9", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]", "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject9').huntingQueryVersion9]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "contentKind": "HuntingQuery", "displayName": "Okta Login from multiple locations", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "LegacyAuthentication_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", "name": "Okta_Single_Sign-On_Hunting_Query_10", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Okta login attempts using Legacy Auth", "category": "Hunting Queries", "query": "OktaSSO\n| where debugContext_debugData_requestUri_s has 'sso/wsfed/active'\n| where outcome_result_s == 'SUCCESS'\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by actor_alternateId_s, actor_displayName_s, client_userAgent_os_s, client_ipAddress_s, client_geographicalContext_state_s,displayMessage_s, outcome_result_s,eventType_s,\noutcome_reason_s, column_ifexists('debugContext_debugData_logOnlySecurityData_s', \"\"), debugContext_debugData_threatSuspected_s, client_userAgent_rawUserAgent_s,client_userAgent_browser_s, severity_s, client_geographicalContext_country_s, client_geographicalContext_city_s\n| extend Account_0_Name = actor_displayName_s\n| extend IP_0_Address = client_ipAddress_s\n", "version": 2, "tags": [ { "name": "description", "value": "This query identifies use of legacy authentication protocol in the Okta Logs." }, { "name": "tactics", "value": "CredentialAccess" }, { "name": "techniques", "value": "T1556" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]", "properties": { "description": "Okta Single Sign-On Hunting Query 10", "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]", "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "kind": "HuntingQuery", "version": "[variables('huntingQueryObject10').huntingQueryVersion10]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "contentKind": "HuntingQuery", "displayName": "Okta login attempts using Legacy Auth", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "OktaCustomConnector Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", "parameters": { "CustomConnectorName": { "defaultValue": "OktaCustomConnector", "type": "String", "metadata": { "description": "Name of the okta Connector" } }, "Service EndPoint": { "defaultValue": "https://{yourOktaDomain}", "type": "String", "metadata": { "description": "enter the okta endpoint (ex: https://{yourOktaDomain})" } } }, "variables": { "operationId-GetUser": "GetUser", "_operationId-GetUser": "[[variables('operationId-GetUser')]", "operationId-UpdateUser": "UpdateUser", "_operationId-UpdateUser": "[[variables('operationId-UpdateUser')]", "operationId-SuspendUser": "SuspendUser", "_operationId-SuspendUser": "[[variables('operationId-SuspendUser')]", "operationId-UnsuspendUser": "UnsuspendUser", "_operationId-UnsuspendUser": "[[variables('operationId-UnsuspendUser')]", "operationId-ResetPassword": "ResetPassword", "_operationId-ResetPassword": "[[variables('operationId-ResetPassword')]", "operationId-GetUserGroups": "GetUserGroups", "_operationId-GetUserGroups": "[[variables('operationId-GetUserGroups')]", "operationId-ClearUserSessions": "ClearUserSessions", "_operationId-ClearUserSessions": "[[variables('operationId-ClearUserSessions')]", "operationId-RemoveMemberfromGroup": "RemoveMemberfromGroup", "_operationId-RemoveMemberfromGroup": "[[variables('operationId-RemoveMemberfromGroup')]", "operationId-AddUserToGroup": "AddUserToGroup", "_operationId-AddUserToGroup": "[[variables('operationId-AddUserToGroup')]", "operationId-ListGroupMembers": "ListGroupMembers", "_operationId-ListGroupMembers": "[[variables('operationId-ListGroupMembers')]", "operationId-ListUserFactors": "ListUserFactors", "_operationId-ListUserFactors": "[[variables('operationId-ListUserFactors')]", "operationId-ResetFactor": "ResetFactor", "_operationId-ResetFactor": "[[variables('operationId-ResetFactor')]", "operationId-ListGroups": "ListGroups", "_operationId-ListGroups": "[[variables('operationId-ListGroups')]", "operationId-ExpirePassword": "ExpirePassword", "_operationId-ExpirePassword": "[[variables('operationId-ExpirePassword')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "playbookContentId1": "OktaCustomConnector", "playbookId1": "[[resourceId('Microsoft.Web/customApis', parameters('CustomConnectorName'))]", "workspace-name": "[parameters('workspace')]", "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" }, "resources": [ { "type": "Microsoft.Web/customApis", "apiVersion": "2016-06-01", "name": "[[parameters('CustomConnectorName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "connectionParameters": { "api_key": { "type": "securestring", "uiDefinition": { "displayName": "API Key", "description": "The API Key for this api", "tooltip": "Provide your API Key", "constraints": { "tabIndex": 2, "clearText": false, "required": "true" } } } }, "backendService": { "serviceUrl": "[[parameters('Service EndPoint')]" }, "brandColor": "#FFFFFF", "description": "This is the Okta Custom Connector", "displayName": "[[parameters('CustomConnectorName')]", "iconUri": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAOAAAADhCAMAAADmr0l2AAAAYFBMVEVUrNL///9PqtFMqdCj0ueGxN55u9rx+PxEps/5+/3p9PlIqNCLxuBar9T2+/3R6fPd7va+3u3l8vhpttdvuNiWzOPI4++p1Oi02ep8v9zW6/SCv9y32urE4vCn0ubf7/Z7cYjhAAAO2UlEQVR4nN2d57qqOhCGwwQBCUWkiLrR+7/LTbGkJ2pwgd9z/pztorykTSaTCfJm1TYL4/2paOs6OAYpuint/6eu2+K0j8NsO+8boPluHZ66f/WmSgkhGABxAsAkImm1qf91p3C+t5gJMMv9c1UijAEJaAwmAoxRWZ39PJvnTdwDZvumTqPIhMZjRlFaN3v3lI4Bs/yQpATbkrHCJE0OrkvSKeCprlJsXW7SssRpVZ9cvpMzwPBao+jNouMKMkL11Vm34whw357BCd2NEc7t3s2bOQHMk/KzmikKcJnkLt7tc8C4KyPHdDfGqOziPweM29Jh1eSFy/ZTxA8BD+UshfcUlIe/A4zblMyLN4ikH5Xi+4DZP+c9i1x9f/Pv/dH/bcCm+grdjbFqvgy4O87TcyoJo+Pui4Chn87YdcqFU/8t6+YdwLz6TuNjBbh6Z+R/HTDefLd2UojR5vX+9GXApvp67XwKv97ZvApYp39UfJMgrWcFzKsvjOx6kRdb4kuA7d8W3yRI25kAs3oBeIPAf8GwsQfcBX9ePe8igf2obw2YzzktelW4tG6ItoD/ltD8noL0n1PA7EIWxdcTkotdQ7QCzPzFNL+niF1XYwOYHRdWfJPgaENoARgeF1h+g8jRYn5hBow3iyy/QWBhfBsB4/KvMXQqjYQmwHhut9lngtJUSw2A4XnRfEMtNRDqARfaf9Iy9aVawGyp/SctoifUAW6XMn3QC3xdHIMO8LAg81onrPPuawD/raB+TiIay1sNmC9r/qATpOrZkxJwt+wBkBWUyhmwCjD85tLD54JK1ZWqAOvVNMBJROVOVAD+W1X5DQJFRyMHPKXmOy5NqTy8Rgq4XVcDnASVdLyXAq6tAU6SN0MZYPfXr/quOjvAeI0VdBBUkumvBDBZiQkqCic2gM0qG+AkIi4fCoDZWivoIIlBIwD6q62gg7BvAjytZw4hEwjDPQ94XnUB9kV41gMWK+5hJpFCBxhWf/1+n6sKNYDrm0SI4qYVDOB+0W56W5V7JeBl9S1wELmoALMfqKCDIFMArnuMf4oZ7SnA/Zr8aDoB3QopwPZH+HrCVgYY/8AYeBc1MXwCrt+IeYoyZ56APzEG3lWKgE301y/lUlEjACY/08UMgoQH3K17HsjrOVLcAQ8/xdcTHljAcPnRBq8J7lFQN8Ddj1hpT+EdA1j/HmDNAP4cX09IA+Y/ZMXcRXIK8LcGwUm3oXAEdORrwjeJmTkkjyd3zdY6Ju/TCJi7WNCFsr4pMd8OkuKu2RYjp9iSEdCJL6Z62Ldm9zgElFdhriF48s0gV6M8pl09piBhCCjn5VwdwDTWD4B7FzWUcYQsAhCl+xtg52KmtEDAqLsBOnnCAgHHgWIAdDJTWiJgOgHGTubyCwREUTwCdk4GoiUCkm4EdDOTWCLgMKPoAQMnD1giIAQDoKM1syUCDitpyFXo8hIBh1Bn5BVubrZEQISKHvDgxpp/H3BD8FNuYcnBQ1vLThR6ofE/+XRPB3i7bLrB+A80YOE/VcuW8OBx8f3yx/0M6QVxvUVWUwmMqqTtdnGvXXc5VxJGDSDUeTxp35UiIK2tsBkMcLm5dKfh6mvXJhXqCzk4xXfpF237CQUKzZ0oRknDLOzvu0RAVAMCPZGarAolYMYBAk6KK/Popk7pRfhMb4aVIdqb8ADXsRAsvN0fOUQlILAbb6IXAAGOV/HRcU3dcWuwM/foavgLfFbkUjwdmdqhAsRs5onsBUASKJKrUO4AA2B0RfrwUIgOyg2IYU03cQUgUz+9e6CDFSBJLNLjGABJg/QLu6ksDPqhlvpLOSBXP73D7Z8tAOFgk/3XBFgg7R7B1JCAJ3+WoRSQq5+PDW0WgPyl7wFCrQMEZEww1GoB+fqZ3zsmC0DLjH9mwKPmV4uPeHl8cRGwH2aZvz09RiQjINSW2alNvehRA2j1kMfILALyGzWoRWQToHoz2euAynEeUqscX3uiAMQJ+5L0hj0G8Jo/1QTj75F1ml8ToMaM4feNbk91VZZBzW+2vGApIK5ZvowOlmZnEyh9aroXv0ln5wdlWdWNWK4mQB07U0GzIh1SFAPgKOiY59wipBhAP0LcO2Yb2ixgAXlzElI2v29znLJ2Y5IWfNV+HxAzsc8xNQADbBjCqZ9hAMOGT5fNLrHo54NsAW4Typ7AAZfb+H3AkrZxQzahE/uYqfMQdywwH4EtJT0gM/pmCftpuH0DbwMC/RWF7Vr4TFeVwAjYcvM2PSC1TtWXH1eBoWLK8H1Aegz0BWOA2Zs/2pc6wIafl2oBmW9bCPM9dnR9GzCl9m3vJcZORLWxE9EDnoSrtYCEtn8lC1+ErqTvAkJKfSaZU4PQRRhpASU78rWAETX+igU4TNMdAFLxiNKviIDeQjP0MkpA2Y58LSD21L9NcgAIm+c9rtK/oHvZwVxQAsq8dlpA6tvGUq87UI9+G5AqoEb6ByXVEo66EtzIapkl4FVqaQFlTM0GyAxWiQ4wdw9IPdoMKF+fp6toLv0DOj2GtgS9Rlwb+BCQqjwmwFQxXaJ7qlj6F/R4q22Dsq6QAeTy8ozrsjeF8jZIPdo8XQrkP9C9qOwzsr2oHlDSz9Cfh3d7EerKj3vRAMlvASn9iSX9YERNpjL9OOix3qnx9nQXxa/fRVQn2UgaMLOZ3OSySJQ+GaqniiXtlKpHXm4E9Fr+RWl7mgunZiaistpDG6Nmn4wiMxVji4pFGNGTKYkt2vDuKnZOwNqyIdsLAV1CotuWMA/a6tfG8EHlF2XmfBlvrGE601dWIR4wwXw+Ny4DMuuUuTKEbDo/PlqenciYIt1IgU7yMgba2vZCdnM2YdwRTSoADi6LhH0RLgkrZqZ1Ozb9esFeRyNg3l0ls1afik5oryhjNllZ6D+iQAFjNvvs5I0XnE70UDpoy9RSYNNOxD4hjzkVMO6qbYvuy6IApOY9Yf2EWFOGZI/U6SfZT7U7pmPEK0oT1mtwq1+i2xCfWbdjxnTYmCuJ8FKl6XDSG2JtsYG+vj86kHnb/BSpVoahjJEy2lfoFq/Fpa4PBZ/gq5Z71caSYCFixrEmpre5du3lMnSbzIRo0L471PWlUDgT4+7iK4qpClGmigFgW+EkiSf4pPKLIrGW0q4dVbK33XA/Ilnz0Xuh+ZH29pAkQ+qdu2CTQje8fzr54suZc/5SfR7Is7tm4w3TVw8GkxrMw0shTXIAZa6yp54JLBXLZ3wtpWa/RJLeZgAcrztbfFzmxtJJA/zrARt1vC82piP36Y8lARRq6Z7yP/GLhxSgrIm+AdjP6ZA2iaFpfYka21RL2Hw1oPd6Y0ku8BugsfpwV0oBhzkd8jJNMB6gi6ZtZ7Q7UR2EwOU3vVLdNm8NUIB9Gepq6eHIBF8oAINsiDbUhSUBJMqFLNZhoomT4cYb2nbCwnFKGbWIqFze6m1HwqbgkgNuxnDKVmuv4rSQIoact1oDyNc22nwEvqCegP395REQWTMc+wRpQRvEspBC0o6AJ0OwGtk0wnPCjj97SRvKxdZS9ldcHuhSpACHo5YKoRSz5m7z4ZoaTKSApyko3eS3ARRcmBq/8wMhSIzp9gTriKYXcoLgMnnWkoyZAQJwZ57u2+CJgsvnjzLAyJsAzdFqADg9Hoo8jpuih5Nuv4JDvB8VX8Xs47gs4unn+CQ6gvvbD5C7OA5DIaMGYBT4RRPHeXHYpNyjoWfshstkVXS0+AZAq4DK8WjnKBqOfVb8BY5ukpr3hNx/VpmGhJC0LKUOIDxeLTtxeji9N1JcNi4vDIC7xWyPVMVqWlwn+VeyuwH+UpoOWuNAMgAKHonf0BQGMfoYfyEZl6gpPdcI+DO5gGjdsj1MXuJfy4Mw6OYWmADXkrb/Fd28ZhNguJiBwp1ISAF6a86aKhfcglFugMVP5QMadF9cuAEu/HCeN3R3ad0Abfe/rEaPcKH7YmK3wuz2Oj2i6e+AWzfbJJciCLYcoMFxsTaRhzvwARj+VD8ahQLgzyTfHEQ5iJ6Aux/qZqh1oyfgD40UdEgpFXPiJG3OIkSvzNFBNUs/is9WTJASDZj/SEca5QrAH5n3sgvgDKB8mXR1ypWAP9GRcnve2Fz3P5BllI+d4I5jWH8R8hu7OMDQkFpg8QIufkk4MaRYOyB3noYAuPiDd/USw0+EU3vWbbCJ4VPiwVJLPHveVkQMOxYBw/U62GQnY0vOPpNvBFmFJPv+ZcfzidsF1yGQxcXLAFd2gutdUMmiaqQnSJoiZ5YpIo2XlR9yusbDQxSBg3JAZRjwcqUKqlOcw7u6xRhF/LD6JOXduqxuQKrDsJWHfa+rGaojd9XHta/J063ZGaYG5PdTLVjy8HYjYFytpAyx7PxdC0Bvt5KTikpVB2MCXMl6jGSHji2g16ygKwV96jA9oGyL+MJkSv1mAHSVIHc2KbZ42QOK24sXJcw70V4H1O1t+nOZ6qcV4IIJLfhsAPu+dJHtEAz9pz2gd1ri5InJpvAhoHcNFtfV4OBqfm9rQG8fLMzyxkfLTbCWgEMmgwVVU4DaNn2lLaDnXRbUmaYX8/u+DOh1SzFqQJ95+G3AwSG8AERQZl/9GNDLfPPzZ+dDkp3NrgCHMf+PxwtsNbq/D+jFyd8C2iQX/wjQ84ryzwoRl8bJgwNA77r5o0GfbOyMl08Bx3n+17tTAJu5gyNAL/a/PSZC6r/a+j4BHBIEqTYbz4IXCRkT5gb0vDz4Vj3th3aT52UOQC9rvzOJwkH70tDuDLC33Yp07ooKkZg8/HuAvQox6YNLPBS8PvK5BfSyYjNXWwTYyDOhfBWwRzxtyAxDPyGb08d4TgB7hYcqddrh4LRSn6bzktwADlle/FKXg+8VASl9yckL78kVoDckqDsqU428QBdFx+49o0Uqh4C9tl1S8SlfXmCDvmYmneVpL5ZyC9grzttzGb1+zB7gqDy3ucOym+QcsFcYn/zjlN/GhnNKxXM8nGI33QqrOQAnXTv/HJRjakyQGQMwZjpCaRmc/e6NiZ6l5gMclF3zovXrY1WmhFNaVsfab4v86qq/lGtewEnbMBwzVjXFTc2QvCoOQ7fdiVz/AaHTvVGGDIbCAAAAAElFTkSuQmCC", "swagger": { "swagger": "2.0", "info": { "title": "Default title", "description": "This is a okta connector", "version": "1.0" }, "host": "$substring([parameters('Service EndPoint')],8 )", "basePath": "/", "schemes": [ "https" ], "consumes": "[variables('TemplateEmptyArray')]", "produces": "[variables('TemplateEmptyArray')]", "paths": { "/api/v1/users/{userId}": { "get": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "User ID", "title": "id" }, "status": { "type": "string", "description": "User Status", "title": "status" }, "created": { "type": "string", "description": "Created date time", "title": "created" }, "activated": { "type": "string", "description": "This indicate the user status", "title": "activated" }, "statusChanged": { "type": "string", "description": "user changed the status", "title": "statusChanged" }, "lastLogin": { "type": "string", "description": "lastLogin", "title": "lastLogin" }, "lastUpdated": { "type": "string", "description": "Last time updated date time", "title": "lastUpdated" }, "passwordChanged": { "type": "string", "description": "When user changed the password", "title": "passwordChanged" }, "profile": { "type": "object", "properties": { "firstName": { "type": "string", "description": "User FirstName", "title": "firstName" }, "lastName": { "type": "string", "description": "User last name", "title": "lastName" }, "email": { "type": "string", "description": "User email", "title": "email" }, "login": { "type": "string", "description": "User Login ID", "title": "login" }, "mobilePhone": { "type": "string", "description": "Mobile number of the user", "title": "mobilePhone" } }, "description": "profile" }, "credentials": { "type": "object", "properties": { "password": { "type": "object", "description": "password" }, "recovery_question": { "type": "object", "properties": { "question": { "type": "string", "description": "question" } }, "description": "recovery_question" }, "provider": { "type": "object", "properties": { "type": { "type": "string", "description": "type" }, "name": { "type": "string", "description": "User name", "title": "name" } }, "description": "provider" } }, "description": "credentials" } } } } }, "operationId": "[[variables('_operationId-GetUser')]", "summary": "Get User", "description": "Action used to fetch user details", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)", "x-ms-summary": "userId" } ] }, "put": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "User ID", "title": "id" }, "status": { "type": "string", "description": "User status", "title": "status" }, "created": { "type": "string", "description": "User created date and time", "title": "created" }, "activated": { "type": "string", "description": "User status", "title": "activated" }, "statusChanged": { "type": "string", "description": "User status changed", "title": "statusChanged" }, "lastLogin": { "type": "string", "description": "Last login data and time", "title": "lastLogin" }, "lastUpdated": { "type": "string", "description": "Last updated data and time", "title": "lastUpdated" }, "passwordChanged": { "type": "string", "description": "user changed password", "title": "passwordChanged" }, "type": { "type": "object", "properties": { "id": { "type": "string", "description": "User Unique id", "title": "id" } }, "description": "type" }, "profile": { "type": "object", "properties": { "login": { "type": "string", "description": "User's Login ID", "title": "login" }, "firstName": { "type": "string", "description": "User's Firstname", "title": "firstName" }, "lastName": { "type": "string", "description": "User's Last name", "title": "lastName" }, "nickName": { "type": "string", "description": "User nick name", "title": "nickName" }, "displayName": { "type": "string", "description": "User display name", "title": "displayName" }, "email": { "type": "string", "description": "User email", "title": "email" }, "secondEmail": { "type": "string", "description": "User alternate email", "title": "secondEmail" }, "profileUrl": { "type": "string", "description": "User profile URL", "title": "profileUrl" }, "preferredLanguage": { "type": "string", "description": "User language which preferred", "title": "preferredLanguage" }, "userType": { "type": "string", "description": "Type of the user", "title": "userType" }, "organization": { "type": "string", "description": "User working organization", "title": "organization" }, "title": { "type": "string", "description": "title" }, "division": { "type": "string", "description": "User division which he/she belonging", "title": "division" }, "department": { "type": "string", "description": "Department of the user which he belonging", "title": "department" }, "costCenter": { "type": "string", "description": "[variables('blanks')]", "title": "costCenter" }, "employeeNumber": { "type": "string", "description": "[variables('blanks')]", "title": "employeeNumber" }, "mobilePhone": { "type": "string", "description": "User contact number", "title": "mobilePhone" }, "primaryPhone": { "type": "string", "description": "User primary contact", "title": "primaryPhone" }, "streetAddress": { "type": "string", "description": "Address of the user", "title": "streetAddress" }, "city": { "type": "string", "description": "City of the User", "title": "city" }, "state": { "type": "string", "description": "User State", "title": "state" }, "zipCode": { "type": "string", "description": "User address zipcode", "title": "zipCode" }, "countryCode": { "type": "string", "description": "User country code where is living", "title": "countryCode" } }, "description": "profile" }, "credentials": { "type": "object", "properties": { "password": { "type": "object", "description": "password" }, "recovery_question": { "type": "object", "properties": { "question": { "type": "string", "description": "question" } }, "description": "recovery_question" }, "provider": { "type": "object", "properties": { "type": { "type": "string", "description": "Enities", "title": "type" }, "name": { "type": "string", "description": "User name", "title": "name" } }, "description": "provider" } }, "description": "credentials" } } } } }, "summary": "Update User", "x-ms-visibility": "important", "operationId": "[[variables('_operationId-UpdateUser')]", "description": "Action used to updates user's profile or credentials using strict-update semantics", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/users/{userId}/lifecycle/suspend": { "post": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "Response": { "type": "string", "description": "Response" }, "StatusCode": { "type": "string", "description": "StatusCode" } } } } }, "summary": "Suspend User", "operationId": "[[variables('_operationId-SuspendUser')]", "description": "Action uses to suspend existing user and returns them to the \"De-active\" state", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/users/{userId}/lifecycle/unsuspend": { "post": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "Response": { "type": "string", "description": "Response" }, "StatusCode": { "type": "string", "description": "StatusCode" } } } } }, "summary": "Unsuspend User", "operationId": "[[variables('_operationId-UnsuspendUser')]", "description": "Action uses to unsuspend a user and returns them to the ACTIVE state", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/users/{userId}/lifecycle/reset_password": { "post": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "resetPasswordUrl": { "type": "string", "description": "resetPasswordUrl" } } } } }, "operationId": "[[variables('_operationId-ResetPassword')]", "description": "Action used to resets password with a temp password or password link.", "summary": "Reset Password", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" }, { "name": "sendEmail", "in": "query", "required": false, "type": "boolean", "default": false, "description": "If sendEmail is false, returns a link for the user to reset their password." } ] } }, "/api/v1/users/{userId}/groups": { "get": { "responses": { "default": { "description": "default", "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "id" }, "profile": { "type": "object", "properties": { "name": { "type": "string", "description": "name" }, "description": { "type": "string", "description": "description" } }, "description": "profile" } } } } } }, "operationId": "[[variables('_operationId-GetUserGroups')]", "description": "Action used fetch groups detail of the particular user", "summary": "Get User Groups", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/users/{userId}/sessions": { "delete": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "Response": { "type": "string", "description": "Response" }, "StatusCode": { "type": "string", "description": "StatusCode" } } } } }, "summary": "Clear User Sessions", "operationId": "[[variables('_operationId-ClearUserSessions')]", "description": "Action used to clear/delete all provider sessions", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/groups/{groupId}/users/{userId}": { "delete": { "responses": { "default": { "description": "default" } }, "summary": "Group-RemoveMember", "description": "Action used to remove/delete existing member from group", "operationId": "[[variables('_operationId-RemoveMemberfromGroup')]", "x-ms-visibility": "important", "parameters": [ { "name": "groupId", "in": "path", "required": true, "type": "string", "description": "Please enter group id (Unique identifier of the group)" }, { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] }, "put": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "Response": { "type": "string", "description": "Response" }, "StatusCode": { "type": "string", "description": "StatusCode" } } } } }, "summary": "Group – Add member", "description": "Action used to add new user to the group", "operationId": "[[variables('_operationId-AddUserToGroup')]", "x-ms-visibility": "important", "parameters": [ { "name": "groupId", "in": "path", "required": true, "type": "string", "description": "Please enter group id (Unique identifier of the group)" }, { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" } ] } }, "/api/v1/groups/{groupId}/users": { "get": { "responses": { "default": { "description": "default" } }, "summary": "ListGroupMembers", "description": "Action used to list all the member group", "operationId": "[[variables('_operationId-ListGroupMembers')]", "x-ms-visibility": "important", "parameters": [ { "name": "groupId", "in": "path", "required": true, "type": "string", "description": "Please enter group id (Unique identifier of the group)" } ] } }, "/api/v1/users/{userId}/factors": { "get": { "responses": { "default": { "description": "default", "schema": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Factor ID", "title": "id" }, "factorType": { "type": "string", "description": "Type of the factor", "title": "factorType" }, "provider": { "type": "string", "description": "Provider Name", "title": "provider" }, "vendorName": { "type": "string", "description": "Vendor Name", "title": "vendorName" }, "status": { "type": "string", "description": "Factor Status", "title": "status" }, "created": { "type": "string", "description": "created date", "title": "created" }, "lastUpdated": { "type": "string", "description": "Last updated date", "title": "lastUpdated" }, "profile": { "type": "object", "properties": { "question": { "type": "string", "description": "question" }, "questionText": { "type": "string", "description": "questionText" }, "credentialId": { "type": "string", "description": "User login ID", "title": "credentialId" }, "phoneNumber": { "type": "string", "description": "Contact Number", "title": "phoneNumber" } }, "description": "profile" }, "_links": { "type": "object", "properties": { "questions": { "type": "object", "properties": { "href": { "type": "string", "description": "href" }, "hints": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "string" }, "description": "allow" } }, "description": "hints" } }, "description": "questions" }, "self": { "type": "object", "properties": { "href": { "type": "string", "description": "href" }, "hints": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "string" }, "description": "allow" } }, "description": "hints" } }, "description": "self" }, "user": { "type": "object", "properties": { "href": { "type": "string", "description": "href" }, "hints": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "string" }, "description": "allow" } }, "description": "hints" } }, "description": "user" }, "next": { "type": "object", "properties": { "name": { "type": "string", "description": "User factors name", "title": "name" }, "href": { "type": "string", "description": "href" }, "hints": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "string" }, "description": "allow" } }, "description": "hints" } }, "description": "next" }, "verify": { "type": "object", "properties": { "href": { "type": "string", "description": "href" }, "hints": { "type": "object", "properties": { "allow": { "type": "array", "items": { "type": "string" }, "description": "allow" } }, "description": "hints" } }, "description": "verify" } }, "description": "_links" }, "_embedded": { "type": "object", "properties": { "activation": { "type": "object", "properties": { "timeStep": { "type": "integer", "format": "int32", "description": "Time Stamp", "title": "timeStep" }, "sharedSecret": { "type": "string", "description": "Share Secret", "title": "sharedSecret" }, "encoding": { "type": "string", "description": "Encoding format", "title": "encoding" }, "keyLength": { "type": "integer", "format": "int32", "description": "key Length", "title": "KeyLength" } }, "description": "activation" } }, "description": "_embedded" } } } } } }, "summary": "List User Factors", "operationId": "[[variables('_operationId-ListUserFactors')]", "description": "Action used to fetch all the factors which user belonging", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)", "x-ms-summary": "[variables('blanks')]" } ] } }, "/api/v1/users/{userId}/factors/{factorId}": { "delete": { "responses": { "default": { "description": "default" } }, "summary": "Reset Factor", "description": "Action used to reset the factor object of the user", "operationId": "[[variables('_operationId-ResetFactor')]", "x-ms-visibility": "important", "parameters": [ { "name": "userId", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)", "x-ms-visibility": "important" }, { "name": "factorId", "in": "path", "required": true, "type": "string", "description": "Please enter factor id (Unique identifier of the factor)", "x-ms-visibility": "important" } ] } }, "/api/v1/groups": { "get": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "Group ID", "title": "id" }, "created": { "type": "string", "description": "Group Created date", "title": "created" }, "type": { "type": "string", "description": "Type of the Group", "title": "type" }, "profile": { "type": "object", "properties": { "name": { "type": "string", "description": "Group Name", "title": "name" }, "description": { "type": "string", "description": "Description of the group", "title": "description" } }, "description": "profile" } } } } }, "summary": "List Groups", "description": "Action used to fetch list of group details", "operationId": "[[variables('_operationId-ListGroups')]", "x-ms-visibility": "important", "parameters": "[variables('TemplateEmptyArray')]" } }, "/api/v1/users/{userID}/lifecycle/expire_password": { "post": { "responses": { "default": { "description": "default", "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "User Id", "title": "id" }, "status": { "type": "string", "description": "status" }, "created": { "type": "string", "description": "User created date", "title": "created" }, "activated": { "type": "string", "description": "activated" }, "statusChanged": { "type": "string", "description": "user status changed", "title": "statusChanged" }, "lastLogin": { "type": "string", "description": "Last login date", "title": "lastLogin" }, "lastUpdated": { "type": "string", "description": "lastUpdated" }, "passwordChanged": { "type": "string", "description": "passwordChanged" }, "profile": { "type": "object", "properties": { "firstName": { "type": "string", "description": "User First Name", "title": "firstName" }, "lastName": { "type": "string", "description": "User Last Name", "title": "lastName" }, "email": { "type": "string", "description": "User Email", "title": "email" }, "login": { "type": "string", "description": "User login id", "title": "login" }, "mobilePhone": { "type": "string", "description": "User contact number", "title": "mobilePhone" } }, "description": "profile" }, "credentials": { "type": "object", "properties": { "password": { "type": "object", "description": "password" }, "recovery_question": { "type": "object", "properties": { "question": { "type": "string", "description": "question" } }, "description": "recovery_question" }, "provider": { "type": "object", "properties": { "type": { "type": "string", "description": "Type of the user", "title": "type" }, "name": { "type": "string", "description": "User name", "title": "name" } }, "description": "provider" } }, "description": "credentials" } } } } }, "summary": "Expire Password", "operationId": "[[variables('_operationId-ExpirePassword')]", "description": "Action used to change the existing password when current password expired", "x-ms-visibility": "important", "parameters": [ { "name": "userID", "in": "path", "required": true, "type": "string", "description": "Please enter user id (Unique identifier of the user)" }, { "name": "tempPassword", "in": "query", "required": false, "type": "string", "default": false, "description": "If tempPassword is included in the request, the user's password is reset to a temporary password that is returned, and then the temporary password is expired" } ] } } }, "securityDefinitions": { "API Key": { "type": "apiKey", "in": "header", "name": "Authorization" } }, "security": [ { "API Key": "[variables('TemplateEmptyArray')]" } ], "tags": "[variables('TemplateEmptyArray')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[[concat(variables('workspace-name'),'/Microsoft.SecurityInsights/',concat('LogicAppsCustomConnector-', last(split(variables('playbookId1'),'/'))))]", "properties": { "parentId": "[[variables('playbookId1')]", "contentId": "[variables('_playbookContentId1')]", "kind": "LogicAppsCustomConnector", "version": "[variables('playbookVersion1')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ], "metadata": { "comments": "This OKTA connector uses okta API to perform different actions on the user accounts.", "lastUpdateTime": "2024-01-16T12:09:51.660Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", "notes": [ "Initial version" ] } } }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_playbookContentId1')]", "contentKind": "LogicAppsCustomConnector", "displayName": "OktaCustomConnector", "contentProductId": "[variables('_playbookcontentProductId1')]", "id": "[variables('_playbookcontentProductId1')]", "version": "[variables('playbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "Okta-EnrichIncidentWithUserDetails Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", "parameters": { "PlaybookName": { "defaultValue": "Okta-EnrichIncidentWithUserDetails", "type": "string", "metadata": { "description": "Name of the Logic Apps resource to be created" } }, "CustomConnectorName": { "defaultValue": "OktaCustomConnector", "type": "string", "metadata": { "description": "Name of the custom connector which interacts with Okta" } } }, "variables": { "AzureSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", "OKTAConnectionName": "[[concat('oktaconnector-', parameters('PlaybookName'))]", "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-2": "[[variables('connection-2')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" }, "resources": [ { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('OKTAConnectionName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "api": { "id": "[[variables('_connection-1')]" } } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('AzureSentinelConnectionName')]", "location": "[[variables('workspace-location-inline')]", "kind": "V1", "properties": { "displayName": "[[variables('AzureSentinelConnectionName')]", "parameterValueType": "Alternative", "api": { "id": "[[variables('_connection-2')]" } } }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", "name": "[[parameters('PlaybookName')]", "location": "[[variables('workspace-location-inline')]", "tags": { "hidden-SentinelTemplateName": "UserEnrichment-Okta", "hidden-SentinelTemplateVersion": "1.0", "LogicAppsCategory": "security", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]" ], "properties": { "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { "$connections": { "type": "Object" } }, "triggers": { "When_Azure_Sentinel_incident_creation_rule_was_triggered_(Private_Preview_only)": { "type": "ApiConnectionWebhook", "inputs": { "body": { "callback_url": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "path": "/incident-creation" } } }, "actions": { "Entities_-_Get_Accounts": { "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/entities/account" } }, "For_each-risky_account_received_from_the_incident": { "foreach": "@body('Entities_-_Get_Accounts')?['Accounts']", "actions": { "Add_a_comment_to_the_incident_with_the_information_collected": { "runAfter": { "Create_HTML_table_format_of_user_group_details": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", "message": "

OKTA Playbook performed the following actions:
\n
\nGot User information from OKTA :
\n
\nUser id:  @{body('Get_User')?['id']}
\nUser name:   @{body('Get_User')?['credentials']?['provider']?['name']}
\nUser login: @{body('Get_User')?['profile']?['login']}
\nUser email: @{body('Get_User')?['profile']?['email']}
\nUser status: @{body('Get_User')?['status']}
\nUser created: @{body('Get_User')?['created']}
\nUser activated: @{body('Get_User')?['activated']}
\nUser statusChanged: @{body('Get_User')?['statusChanged']}
\nUser lastLogin: @{body('Get_User')?['lastLogin']}
\nUser lastUpdated: @{body('Get_User')?['lastUpdated']}
\nUser passwordChanged: @{body('Get_User')?['passwordChanged']}
\n
\nUser is part of below Groups :
\n@{body('Create_HTML_table_format_of_user_group_details')}

" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/Incidents/Comment" } }, "Create_HTML_table_format_of_user_group_details": { "runAfter": { "For_each_user_group": [ "Succeeded" ] }, "type": "Table", "inputs": { "columns": [ { "header": "GroupID", "value": "@item()?['GroupId']" }, { "header": "GroupName", "value": "@item()?['GroupName']" }, { "header": "GroupDescription", "value": "@item()?['GroupDescription']" } ], "format": "HTML", "from": "@variables('User Groups')" }, "description": "prepare html table format to attach in the incident" }, "For_each_user_group": { "foreach": "@body('Get_User_Groups')", "actions": { "Append_groups_to_group_array_variable": { "runAfter": { "Compose_array_of_groups_for_updating_incident_with_group_details": [ "Succeeded" ] }, "type": "AppendToArrayVariable", "inputs": { "name": "User Groups", "value": "@outputs('Compose_array_of_groups_for_updating_incident_with_group_details')" } }, "Compose_array_of_groups_for_updating_incident_with_group_details": { "type": "Compose", "inputs": { "GroupDescription": "@items('For_each_user_group')?['profile']?['description']", "GroupId": "@items('For_each_user_group')?['id']", "GroupName": "@items('For_each_user_group')?['profile']?['name']" } } }, "runAfter": { "Get_User_Groups": [ "Succeeded" ] }, "type": "Foreach", "description": "For each user group preparing the list of groups with required details to comment in the incident" }, "Get_User": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "get", "path": "/api/v1/users/@{encodeURIComponent(items('For_each-risky_account_received_from_the_incident')?['Name'])}" }, "description": "This gets the user details from Okta" }, "Get_User_Groups": { "runAfter": { "Get_User": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "get", "path": "/api/v1/users/@{encodeURIComponent(items('For_each-risky_account_received_from_the_incident')?['Name'])}/groups" }, "description": "This gets the user groups from Okta" } }, "runAfter": { "Initialize_variable_to_collect_group_details": [ "Succeeded" ] }, "type": "Foreach" }, "Initialize_variable_to_collect_group_details": { "runAfter": { "Entities_-_Get_Accounts": [ "Succeeded" ] }, "type": "InitializeVariable", "inputs": { "variables": [ { "name": "User Groups", "type": "array" } ] } } } }, "parameters": { "$connections": { "value": { "OktaCustomConnector": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "connectionName": "[[variables('OKTAConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "connectionName": "[[variables('AzureSentinelConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" } } } } } } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", "properties": { "parentId": "[variables('playbookId2')]", "contentId": "[variables('_playbookContentId2')]", "kind": "Playbook", "version": "[variables('playbookVersion2')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_OktaCustomConnector')]", "version": "[variables('playbookVersion1')]" } ] } } } ], "metadata": { "title": "User enrichment - Okta", "description": "This playbook will collect user information from Okta and post a report on the incident.", "prerequisites": [ "1. Okta Custom Connector needs to be deployed prior to the deployment of this playbook under the same resource group.", "2. Generate an API key. [Learn how](https://developer.okta.com/docs/guides/create-an-api-token/overview/)" ], "lastUpdateTime": "2021-07-28T00:00:00Z", "entities": [ "Account" ], "tags": [ "Enrichment" ], "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", "notes": [ "Initial version" ] } } }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_playbookContentId2')]", "contentKind": "Playbook", "displayName": "Okta-EnrichIncidentWithUserDetails", "contentProductId": "[variables('_playbookcontentProductId2')]", "id": "[variables('_playbookcontentProductId2')]", "version": "[variables('playbookVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName3')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "Okta-PromptUser Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", "parameters": { "PlaybookName": { "defaultValue": "Okta-PromptUser", "type": "string", "metadata": { "description": "Name of the Logic App/Playbook" } }, "Teams GroupId": { "defaultValue": "TeamgroupId", "type": "string", "metadata": { "description": "GroupId of the Team channel" } }, "Teams ChannelId": { "defaultValue": "TeamChannelId", "type": "string", "metadata": { "description": "Team ChannelId" } }, "CustomConnectorName": { "defaultValue": "OktaCustomConnector", "type": "string", "metadata": { "description": "Name of the custom connector which interacts with Okta" } } }, "variables": { "AzureSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", "OKTAConnectionName": "[[concat('oktaconnector-', parameters('PlaybookName'))]", "TeamsConnectionName": "[[concat('teamsconnector-', parameters('PlaybookName'))]", "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-2": "[[variables('connection-2')]", "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]", "_connection-3": "[[variables('connection-3')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" }, "resources": [ { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('OKTAConnectionName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "api": { "id": "[[variables('_connection-1')]" } } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('AzureSentinelConnectionName')]", "location": "[[variables('workspace-location-inline')]", "kind": "V1", "properties": { "displayName": "[[variables('AzureSentinelConnectionName')]", "parameterValueType": "Alternative", "api": { "id": "[[variables('_connection-2')]" } } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('TeamsConnectionName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "api": { "id": "[[variables('_connection-3')]" } } }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", "name": "[[parameters('PlaybookName')]", "location": "[[variables('workspace-location-inline')]", "tags": { "hidden-SentinelTemplateName": "PromptUser-Okta", "hidden-SentinelTemplateVersion": "1.0", "LogicAppsCategory": "security", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]" ], "properties": { "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { "$connections": { "type": "Object" } }, "triggers": { "When_Azure_Sentinel_incident_creation_rule_was_triggered_(Private_Preview_only)": { "type": "ApiConnectionWebhook", "inputs": { "body": { "callback_url": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "path": "/incident-creation" } } }, "actions": { "Entities_-_Get_Accounts": { "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/entities/account" } }, "For_each-risky_account_received_from_the_incident": { "foreach": "@body('Entities_-_Get_Accounts')?['Accounts']", "actions": { "Condition_based_on_the_user_confirmation": { "actions": { "Add_a_comment_to_the_incident_with_the_information_collected_and_conclusion": { "type": "ApiConnection", "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", "message": "

OKTA Playbook performed the following actions:
\n
\nGot User information from OKTA :
\n
\nUser id:  @{body('Get_User')?['id']}
\nUser name:   @{body('Get_User')?['credentials']?['provider']?['name']}
\nUser login: @{body('Get_User')?['profile']?['login']}
\nUser email: @{body('Get_User')?['profile']?['email']}
\nUser status: @{body('Get_User')?['status']}
\nUser created: @{body('Get_User')?['created']}
\nUser activated: @{body('Get_User')?['activated']}
\nUser statusChanged: @{body('Get_User')?['statusChanged']}
\nUser lastLogin: @{body('Get_User')?['lastLogin']}
\nUser lastUpdated: @{body('Get_User')?['lastUpdated']}
\nUser passwordChanged: @{body('Get_User')?['passwordChanged']}
\n
\nActions taken on Sentinel:
\n
\nIncident will be closed as the user confirmed that it was him.

" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/Incidents/Comment" } }, "Update_incident_to_close_it": { "runAfter": { "Add_a_comment_to_the_incident_with_the_information_collected_and_conclusion": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "body": { "classification": { "ClassificationAndReason": "Benign Positive - Suspicious But Expected" }, "incidentArmId": "@triggerBody()?['object']?['id']", "status": "Closed" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "put", "path": "/Incidents" } } }, "runAfter": { "Post_an_Adaptive_Card_to_a_Teams_user_and_wait_for_a_response": [ "Succeeded" ] }, "else": { "actions": { "Add_a_comment_to_the_incident_with_the_information_collected": { "runAfter": { "Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "body": { "incidentArmId": "@triggerBody()?['object']?['id']", "message": "

OKTA Playbook ran and performed the following actions:
\n
\nGot User information from OKTA :
\n
\nUser id:  @{body('Get_User')?['id']}
\nUser name:   @{body('Get_User')?['credentials']?['provider']?['name']}
\nUser login: @{body('Get_User')?['profile']?['login']}
\nUser email: @{body('Get_User')?['profile']?['email']}
\nUser status: @{body('Get_User')?['status']}
\nUser created: @{body('Get_User')?['created']}
\nUser activated: @{body('Get_User')?['activated']}
\nUser statusChanged: @{body('Get_User')?['statusChanged']}
\nUser lastLogin: @{body('Get_User')?['lastLogin']}
\nUser lastUpdated: @{body('Get_User')?['lastUpdated']}
\nUser passwordChanged: @{body('Get_User')?['passwordChanged']}
\n
\nActions taken on Okta:
\n
\nCleared the user sessions and reset the password of the user.
\n
\nActions taken on Sentinel:
\n
\nInformed the SOC admin about the risky user and asked him to investigate further

" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/Incidents/Comment" } }, "Clear_User_Sessions": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "delete", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/sessions" }, "description": "This clears the user sessions in Okta" }, "Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response": { "runAfter": { "Reset_Password": [ "Succeeded" ] }, "type": "ApiConnectionWebhook", "inputs": { "body": { "body": { "messageBody": "{\n \"type\": \"AdaptiveCard\",\n \"body\": [\n {\n \"type\": \"TextBlock\",\n \"size\": \"large\",\n \"weight\": \"bolder\",\n \"text\": \"Microsoft Sentinel playbook has taken an action on a risky user\",\n \"wrap\": true\n },\n {\n \"type\": \"ColumnSet\",\n \"columns\": [\n {\n \"type\": \"Column\",\n \"items\": [\n {\n \"type\": \"Image\",\n \"style\": \"Person\",\n \"url\": \"https://connectoricons-prod.azureedge.net/releases/v1.0.1391/1.0.1391.2130/azuresentinel/icon.png\",\n \"size\": \"Small\"\n }\n ],\n \"width\": \"auto\"\n } \n ]\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Possible compromised user detected by the @{triggerBody()?['object']?['properties']?['severity']} Incident @{triggerBody()?['object']?['properties']?['title']}\",\n \"wrap\": true,\n \"weight\":\"bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Incident number: @{triggerBody()?['object']?['properties']?['incidentNumber']}\",\n \"wrap\": true,\n \"weight\":\"bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Incident description\",\n \"wrap\": true,\n \"weight\":\"bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \" @{triggerBody()?['object']?['properties']?['description']}\",\n \"wrap\": true \n },\n \n {\n \"type\": \"TextBlock\",\n \"text\": \"[Click here to view Incident]()\",\n \"wrap\":\"true\"\n }, \n \n {\n \"type\": \"ColumnSet\",\n \"columns\": [\n \n {\n \"type\": \"Column\",\n \"items\": [\n \n {\n \"type\": \"TextBlock\",\n \"text\": \"The Okta user in risk:\",\n \"wrap\": true,\n \"weight\":\"bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"User ID: @{body('Get_User')?['id']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"First and Last name: @{body('Get_User')?['profile']?['firstName']} @{body('Get_User')?['profile']?['lastName']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"User display name: @{items('For_each-risky_account_received_from_the_incident')?['Name']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Action taken:\",\n \n \"weight\": \"bolder\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"User password was reset\",\n \n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"User sessions were cleared\",\n\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Please investigate further in Okta.\",\n \"weight\":\"bolder\",\n \"wrap\": true\n }\n ],\n \"width\": \"auto\"\n \n }\n ]\n }\n \n ], \n \"actions\": [\n {\n \"type\": \"Action.Submit\",\n \"title\": \"OK\"\n }\n ],\n \n \"$schema\": \"http://adaptivecards.io/schemas/adaptive-card.json\",\n \"version\": \"1.2\"\n}", "recipient": { "channelId": "[[parameters('Teams ChannelId')]" }, "shouldUpdateCard": true }, "notificationUrl": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['teams']['connectionId']" } }, "path": "/flowbot/actions/flowcontinuation/recipienttypes/channel/$subscriptions", "queries": { "groupId": "[[parameters('Teams GroupId')]" } } }, "Reset_Password": { "runAfter": { "Clear_User_Sessions": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "post", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/lifecycle/reset_password" }, "description": "Reset password link for Okta will be sent to user" } } }, "expression": { "or": [ { "equals": [ "@body('Post_an_Adaptive_Card_to_a_Teams_user_and_wait_for_a_response')?['submitActionId']", "This was me" ] } ] }, "type": "If", "description": "user confirmation will be captured here if he has done the malicious activity on the user account" }, "Get_User": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "get", "path": "/api/v1/users/@{encodeURIComponent(items('For_each-risky_account_received_from_the_incident')?['Name'])}" }, "description": "Gets the user details from Okta" }, "Post_an_Adaptive_Card_to_a_Teams_user_and_wait_for_a_response": { "runAfter": { "Get_User": [ "Succeeded" ] }, "type": "ApiConnectionWebhook", "inputs": { "body": { "body": { "messageBody": "{\n \"type\": \"AdaptiveCard\",\n \"body\": [\n {\n \"type\": \"TextBlock\",\n \"size\": \"large\",\n \"weight\": \"bolder\",\n \"text\": \"New Incident from MicrosoftSentinel. Please respond ASAP\",\n \"wrap\": true\n },\n {\n \"type\": \"ColumnSet\",\n \"columns\": [\n {\n \"type\": \"Column\",\n \"items\": [\n {\n \"type\": \"Image\",\n \"style\": \"Person\",\n \"url\": \"https://connectoricons-prod.azureedge.net/releases/v1.0.1391/1.0.1391.2130/azuresentinel/icon.png\",\n \"size\": \"Small\"\n }\n ],\n \"width\": \"auto\"\n }\n ]\n },\n {\n \"type\": \"TextBlock\",\n \"size\": \"Medium\",\n \"text\": \"Incident Description \",\n \"wrap\": true,\n \"weight\": \"Bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"size\": \"Medium\",\n \"text\":\" @{triggerBody()?['object']?['properties']?['description']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"size\": \"Medium\",\n \"text\": \"Please confirm it was you\",\n \"wrap\": true,\n \"weight\": \"Bolder\"\n }\n ],\n \"actions\": [\n {\n \"type\": \"Action.Submit\",\n \"title\": \"This was me\"\n },\n {\n \"type\": \"Action.Submit\",\n \"title\": \"This was not me\"\n }\n ],\n \"$schema\": \"http://adaptivecards.io/schemas/adaptive-card.json\",\n \"version\": \"1.2\"\n}", "recipient": { "to": "@body('Get_User')?['profile']?['email']" }, "shouldUpdateCard": true }, "notificationUrl": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['teams']['connectionId']" } }, "path": "/flowbot/actions/flowcontinuation/recipienttypes/user/$subscriptions" } } }, "runAfter": { "Entities_-_Get_Accounts": [ "Succeeded" ] }, "type": "Foreach" } } }, "parameters": { "$connections": { "value": { "OktaCustomConnector": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "connectionName": "[[variables('OKTAConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "connectionName": "[[variables('AzureSentinelConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" } } }, "teams": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]", "connectionName": "[[variables('TeamsConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]" } } } } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]", "properties": { "parentId": "[variables('playbookId3')]", "contentId": "[variables('_playbookContentId3')]", "kind": "Playbook", "version": "[variables('playbookVersion3')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_OktaCustomConnector')]", "version": "[variables('playbookVersion1')]" } ] } } } ], "metadata": { "title": "Prompt Okta user", "description": "This playbook uses the OKTA connector to prompt the risky user on Teams. User is asked action was taken by them. Based on the user confirmation the SOC admin is notified to investige on the user account. Also, comment is added to the incident with user information and summary of actions taken.", "prerequisites": [ "1. Okta Custom Connector needs to be deployed prior to the deployment of this playbook under the same resource group.", "2. Generate an API key. [Learn how](https://developer.okta.com/docs/guides/create-an-api-token/overview/)" ], "lastUpdateTime": "2021-07-28T00:00:00Z", "entities": [ "Account" ], "tags": [ "Enrichment" ], "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", "notes": [ "Initial version" ] } } }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_playbookContentId3')]", "contentKind": "Playbook", "displayName": "Okta-PromptUser", "contentProductId": "[variables('_playbookcontentProductId3')]", "id": "[variables('_playbookcontentProductId3')]", "version": "[variables('playbookVersion3')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('playbookTemplateSpecName4')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "Okta-ResponseFromTeams Playbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", "parameters": { "PlaybookName": { "defaultValue": "Okta-ResponseFromTeams", "type": "String", "metadata": { "description": "Name of the Logic App/Playbook" } }, "SOC Email": { "defaultValue": "", "type": "String", "metadata": { "description": "Email alias of the SOC team" } }, "Teams GroupId": { "defaultValue": "TeamgroupId", "type": "String", "metadata": { "description": "GroupId of the Team channel" } }, "Teams ChannelId": { "defaultValue": "TeamChannelId", "type": "String", "metadata": { "description": "Team ChannelId" } }, "CustomConnectorName": { "defaultValue": "OktaCustomConnector", "type": "string", "metadata": { "description": "Name of the custom connector which interacts with Okta" } } }, "variables": { "AzureSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", "OKTAConnectionName": "[[concat('oktaconnector-', parameters('PlaybookName'))]", "TeamsConnectionName": "[[concat('teamsconnector-', parameters('PlaybookName'))]", "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]", "_connection-1": "[[variables('connection-1')]", "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "_connection-2": "[[variables('connection-2')]", "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]", "_connection-3": "[[variables('connection-3')]", "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", "workspace-name": "[parameters('workspace')]", "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" }, "resources": [ { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('OKTAConnectionName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "api": { "id": "[[variables('_connection-1')]" } } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('AzureSentinelConnectionName')]", "location": "[[variables('workspace-location-inline')]", "kind": "V1", "properties": { "displayName": "[[variables('AzureSentinelConnectionName')]", "parameterValueType": "Alternative", "api": { "id": "[[variables('_connection-2')]" } } }, { "type": "Microsoft.Web/connections", "apiVersion": "2016-06-01", "name": "[[variables('TeamsConnectionName')]", "location": "[[variables('workspace-location-inline')]", "properties": { "api": { "id": "[[variables('_connection-3')]" } } }, { "type": "Microsoft.Logic/workflows", "apiVersion": "2017-07-01", "name": "[[parameters('PlaybookName')]", "location": "[[variables('workspace-location-inline')]", "tags": { "hidden-SentinelTemplateName": "ResponseOnOktaUserTeams-Okta", "hidden-SentinelTemplateVersion": "1.0", "LogicAppsCategory": "security", "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" }, "identity": { "type": "SystemAssigned" }, "dependsOn": [ "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]" ], "properties": { "state": "Enabled", "definition": { "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { "$connections": { "type": "Object" } }, "triggers": { "When_Azure_Sentinel_incident_creation_rule_was_triggered_(Private_Preview_only)": { "type": "ApiConnectionWebhook", "inputs": { "body": { "callback_url": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "path": "/incident-creation" } } }, "actions": { "Compose_the_choice_set_dropdown_for_adaptive_card_for_group_names": { "runAfter": { "For_each_group": [ "Succeeded" ] }, "type": "Compose", "inputs": "@outputs('Select_groups')?[0]?['body']" }, "Entities_-_Get_Accounts": { "type": "ApiConnection", "inputs": { "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/entities/account" } }, "For_each-risky_account_received_from_the_incident": { "foreach": "@body('Entities_-_Get_Accounts')?['Accounts']", "actions": { "Add_a_comment_to_the_incident_with_the_information_collected_and_action_taken": { "runAfter": { "Update_incident_to_change_severity_and_status_according_to_choice": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "body": { "incidentArmId": "@body('Update_incident_to_change_severity_and_status_according_to_choice')?['id']", "message": "

OKTA Playbook ran and performed the following actions:
\n
\nGot User information from OKTA :
\n
\nUser id:  @{body('Get_User')?['id']}
\nUser name:   @{body('Get_User')?['credentials']?['provider']?['name']}
\nUser login: @{body('Get_User')?['profile']?['login']}
\nUser email: @{body('Get_User')?['profile']?['email']}
\nUser status: @{body('Get_User')?['status']}
\nUser created: @{body('Get_User')?['created']}
\nUser activated: @{body('Get_User')?['activated']}
\nUser statusChanged: @{body('Get_User')?['statusChanged']}
\nUser lastLogin: @{body('Get_User')?['lastLogin']}
\nUser lastUpdated: @{body('Get_User')?['lastUpdated']}
\nUser passwordChanged: @{body('Get_User')?['passwordChanged']}
\n
\nActions taken on Sentinel:
\n
\nIncident close reason: @{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['incidentStatus']}
\nAction taken on User: @{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')['submitActionId']}

" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "post", "path": "/Incidents/Comment" } }, "Get_User": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "get", "path": "/api/v1/users/@{encodeURIComponent(items('For_each-risky_account_received_from_the_incident')?['Name'])}" }, "description": "This gets the user details from Okta" }, "Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response": { "runAfter": { "Get_User": [ "Succeeded" ] }, "type": "ApiConnectionWebhook", "inputs": { "body": { "body": { "messageBody": " {\n \"type\": \"AdaptiveCard\",\n \"body\": [\n \n {\n \"type\": \"TextBlock\",\n \"size\": \"large\",\n \"weight\": \"bolder\",\n \"text\": \"Suspicious identity - Microsoft Sentinel\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Possible Comprised User detected by the provider\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"@{triggerBody()?['object']?['properties']?['severity']} incident @{triggerBody()?['object']?['properties']?['title']} \",\n \"wrap\": true,\n \"weight\":\"bolder\"\n },\n \n {\n \"type\": \"TextBlock\",\n \"text\": \"Incident description\",\n \"wrap\": true,\n \"weight\": \"Bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\":\" @{triggerBody()?['object']?['properties']?['description']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"[Click here to view the Incident](@{triggerBody()?['object']?['properties']?['incidentUrl']})\",\n \"wrap\": true\n },\n {\n \"type\": \"ColumnSet\",\n \"columns\": [\n {\n \"type\": \"Column\",\n \"items\": [\n \n {\n \"type\": \"TextBlock\",\n \"text\": \"Risky user details from Okta:\",\n \"wrap\": true,\n \"weight\": \"Bolder\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"UserID: @{body('Get_User')?['id']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"First and Last name: @{body('Get_User')?['profile']?['firstName']} @{body('Get_User')?['profile']?['lastName']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"User display name: @{items('For_each-risky_account_received_from_the_incident')?['Name']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Status: @{body('Get_User')?['status']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Status changed: @{body('Get_User')?['statusChanged']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Last login: @{body('Get_User')?['lastLogin']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Last updated: @{body('Get_User')?['lastUpdated']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Password changed: @{body('Get_User')?['passwordChanged']}\",\n \"wrap\": true\n },\n {\n \"type\": \"TextBlock\",\n \"size\": \"Medium\",\n \"weight\": \"Bolder\",\n \"text\": \"Incident configuration:\",\n \"wrap\": true\n }\n ],\n \"width\": \"auto\"\n }\n ]\n },\n {\n \"type\": \"ColumnSet\",\n \"columns\": [\n {\n \"type\": \"Column\",\n \"items\": [\n {\n \"type\": \"Image\",\n \"style\": \"Person\",\n \"url\": \"https://connectoricons-prod.azureedge.net/releases/v1.0.1391/1.0.1391.2130/azuresentinel/icon.png\",\n \"size\": \"Small\"\n }\n ],\n \"width\": \"auto\"\n }\n ]\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Close Azure Sentinal incident?\"\n },\n {\n \"choices\": [\n {\n \"isSelected\": true,\n \"title\": \"Close incident - False Positive\",\n \"value\": \"False Positive - Incorrect Alert Logic\"\n },\n {\n \"title\": \"Close incident - True Positive\",\n \"value\": \"True Positive - Suspicious Activity\"\n },\n {\n \"title\": \"Close incident - Benign Positive\",\n \"value\": \"Benign Positive - Suspicious But Expected\"\n },\n {\n \"title\": \"No\",\n \"value\": \"no\"\n }\n ],\n \"id\": \"incidentStatus\",\n \"style\": \"compact\",\n \"type\": \"Input.ChoiceSet\",\n \"value\": \"Benign Positive - Suspicious But Expected\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Change Microsoft Sentinel incident severity?\"\n },\n {\n \"choices\": [\n {\n \"title\": \"Medium\",\n \"value\": \"Medium\"\n },\n {\n \"title\": \"High\",\n \"value\": \"High\"\n },\n {\n \"title\": \"Low\",\n \"value\": \"Low\"\n },\n {\n \"title\": \"Don't change\",\n \"value\": \"same\"\n }\n ],\n \"id\": \"incidentSeverity\",\n \"style\": \"compact\",\n \"type\": \"Input.ChoiceSet\",\n \"value\": \"@{triggerBody()?['object']?['properties']?['severity']}\"\n },\n {\n \"type\": \"TextBlock\",\n \"text\": \"Response in Okta\",\n \"size\": \"Medium\",\n \"weight\": \"Bolder\"\n },\n {\n \"type\": \"Image\",\n \"style\": \"Person\",\n \"url\": \"https://seekvectorlogo.com/wp-content/uploads/2017/12/okta-vector-logo.png\",\n \"size\": \"Small\"\n }\n ],\n \"actions\": [\n {\n \"type\": \"Action.Submit\",\n \"title\": \"Change user state (suspend)\"\n },\n {\n \"type\": \"Action.Submit\",\n \"title\": \"Change user state (unsuspend)\"\n },\n {\n \"type\": \"Action.Submit\",\n \"title\": \"Expire password\"\n },\n {\n \"type\": \"Action.Submit\",\n \"title\": \"Reset password\"\n },\n {\n \"type\": \"Action.Submit\",\n \"title\": \"Ignore\"\n },\n {\n \"type\": \"Action.ShowCard\",\n \"title\": \"Add user to group\",\n \"card\": {\n \"type\": \"AdaptiveCard\",\n \"body\":[\n {\n \"type\": \"Input.ChoiceSet\",\n \"id\": \"GroupId\",\n \n \"value\": \"1\",\n \"choices\": @{outputs('Select_groups')?[0]?['body']}\n\n }\n ],\n \"actions\": [\n {\n \"type\": \"Action.Submit\",\n \"title\": \"OK\"\n }\n ],\n \"$schema\": \"http://adaptivecards.io/schemas/adaptive-card.json\",\n \"version\": \"1.2\"\n }\n }\n ],\n \"$schema\": \"http://adaptivecards.io/schemas/adaptive-card.json\",\n \"version\": \"1.2\"\n}", "recipient": { "channelId": "[[parameters('Teams ChannelId')]" }, "shouldUpdateCard": true }, "notificationUrl": "@{listCallbackUrl()}" }, "host": { "connection": { "name": "@parameters('$connections')['teams']['connectionId']" } }, "path": "/flowbot/actions/flowcontinuation/recipienttypes/channel/$subscriptions", "queries": { "groupId": "[[parameters('Teams GroupId')]" } } }, "Switch_to_perform_action_choices_on_the_user_in_Okta": { "runAfter": { "Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response": [ "Succeeded" ] }, "cases": { "Case_-_Add_user_to_group": { "case": "OK", "actions": { "Group_–_Add_member": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "put", "path": "/api/v1/groups/@{encodeURIComponent(body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['GroupId'])}/users/@{encodeURIComponent(body('Get_User')?['id'])}" } } } }, "Case_-_Expire_Password": { "case": "Expire password", "actions": { "Expire_Password": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "post", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/lifecycle/expire_password" } } } }, "Case_-_Reset_Password": { "case": "Reset password", "actions": { "Reset_Password": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "post", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/lifecycle/reset_password" } } } }, "Case_-_Suspend_User": { "case": "Change user state (suspend)", "actions": { "Suspend_User": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "post", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/lifecycle/suspend" } } } }, "Case_-_Unsuspend_User": { "case": "Change user state (unsuspend)", "actions": { "Unsuspend_User": { "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "post", "path": "/api/v1/users/@{encodeURIComponent(body('Get_User')?['id'])}/lifecycle/unsuspend" } } } } }, "expression": "@body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')['submitActionId']", "type": "Switch" }, "Update_incident_to_change_severity_and_status_according_to_choice": { "runAfter": { "Switch_to_perform_action_choices_on_the_user_in_Okta": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "body": { "classification": { "ClassificationAndReason": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['incidentStatus']}" }, "incidentArmId": "@triggerBody()?['object']?['id']", "severity": "@{body('Post_an_Adaptive_Card_to_a_Teams_channel_and_wait_for_a_response')?['data']?['incidentSeverity']}", "status": "Closed" }, "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, "method": "put", "path": "/Incidents" } } }, "runAfter": { "Compose_the_choice_set_dropdown_for_adaptive_card_for_group_names": [ "Succeeded" ] }, "type": "Foreach" }, "For_each_group": { "foreach": "@body('List_Groups')", "actions": { "Select_groups": { "type": "Select", "inputs": { "from": "@body('List_Groups')", "select": { "title": "@item()?['profile']?['name']", "value": "@item()?['id']" } }, "description": "preparing the group name and id from the list of groups to display in the adaptive card for user choice" } }, "runAfter": { "List_Groups": [ "Succeeded" ] }, "type": "Foreach", "description": "For each group preparing the list of groups with required details to display in the adaptive card for user choice" }, "List_Groups": { "runAfter": { "Entities_-_Get_Accounts": [ "Succeeded" ] }, "type": "ApiConnection", "inputs": { "host": { "connection": { "name": "@parameters('$connections')['OktaCustomConnector']['connectionId']" } }, "method": "get", "path": "/api/v1/groups" }, "description": "This provides list of groups present in Okta domain" } } }, "parameters": { "$connections": { "value": { "OktaCustomConnector": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('OKTAConnectionName'))]", "connectionName": "[[variables('OKTAConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Web/customApis/', parameters('CustomConnectorName'))]" }, "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "connectionName": "[[variables('AzureSentinelConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", "connectionProperties": { "authentication": { "type": "ManagedServiceIdentity" } } }, "teams": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]", "connectionName": "[[variables('TeamsConnectionName')]", "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]" } } } } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId4'),'/'))))]", "properties": { "parentId": "[variables('playbookId4')]", "contentId": "[variables('_playbookContentId4')]", "kind": "Playbook", "version": "[variables('playbookVersion4')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "criteria": [ { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_OktaCustomConnector')]", "version": "[variables('playbookVersion1')]" } ] } } } ], "metadata": { "title": "Response on Okta user from Teams", "description": "This playbooks sends an adaptive card to the SOC Teams channel with information about the Okta user and incident details. The SOC is allowed to take action such suspend, reset password, expire password, add to group. An informative comment will be posted to the incident.", "prerequisites": [ "1. Okta Custom Connector needs to be deployed prior to the deployment of this playbook under the same resource group.", "2. Generate an API key. [Learn how](https://developer.okta.com/docs/guides/create-an-api-token/overview/)" ], "lastUpdateTime": "2021-07-28T00:00:00Z", "entities": [ "Account" ], "tags": [ "Remediation" ], "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", "notes": [ "Initial version" ] } } }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_playbookContentId4')]", "contentKind": "Playbook", "displayName": "Okta-ResponseFromTeams", "contentProductId": "[variables('_playbookcontentProductId4')]", "id": "[variables('_playbookcontentProductId4')]", "version": "[variables('playbookVersion4')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "OktaSingleSignOn Workbook with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.Insights/workbooks", "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", "kind": "shared", "apiVersion": "2021-08-01", "metadata": { "description": "Gain extensive insight into Okta Single Sign-On (SSO) by analyzing, collecting and correlating Audit and Event events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked." }, "properties": { "displayName": "[parameters('workbook1-name')]", "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"23197862-8ab5-4aa4-8e78-bb26fbf1a6bc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":2419200000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"9df846cc-3ff1-4608-ac3a-7dddc6c709a7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Domain\",\"type\":2,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"OktaSSO\\n| summarize by domain_s\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"defaultValue\":\"value::1\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Administrative\",\"subTarget\":\"General\",\"preText\":\"Session/User Analysis\",\"style\":\"link\"},{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Application\",\"subTarget\":\"Application\",\"style\":\"link\"},{\"cellValue\":\"selectedTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Session/User Analysis\",\"subTarget\":\"Analysis\",\"preText\":\"Session/User Analysis\",\"style\":\"link\"}]},\"name\":\"links - 13\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"fc39a4b9-f38a-4a3e-bf83-845441828fb8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ApplicationList\",\"label\":\"Application\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| mv-expand todynamic(target_s)\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| distinct tostring(target_s.alternateId)\\r\\n| sort by target_s_alternateId asc\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Application\"},\"name\":\"parameters - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"user.session.start\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| summarize Count = count() by Results = outcome_result_s, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"title\":\"Console Login by Result\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Results\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"FAILURE\",\"color\":\"red\"},{\"seriesName\":\"SUCCESS\",\"color\":\"green\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"user.session.start\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where outcome_result_s == \\\"FAILURE\\\"\\r\\n| summarize Total = count() by User = actor_alternateId_s\\r\\n| top 10 by Total\",\"size\":0,\"title\":\"Top 10 Failed Console Logins by User\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"palette\":\"coldHot\"}}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Results\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"FAILURE\",\"color\":\"red\"},{\"seriesName\":\"SUCCESS\",\"color\":\"green\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"user.authentication.auth_via_mfa\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where outcome_result_s == \\\"FAILURE\\\"\\r\\n| summarize count() by actor_alternateId_s\\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 Failed MFA Authentications by User\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"coldHot\"}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"palette\":\"coldHot\"}}],\"labelSettings\":[{\"columnId\":\"actor_alternateId_s\",\"label\":\"User\"},{\"columnId\":\"count_\",\"label\":\"Total\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Results\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"FAILURE\",\"color\":\"red\"},{\"seriesName\":\"SUCCESS\",\"color\":\"green\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"user.authentication.auth_via_mfa\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| summarize Count=count() by Results = outcome_result_s, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"title\":\"MFA Authentications by Result\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Results\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SUCCESS\",\"color\":\"green\"},{\"seriesName\":\"FAILURE\",\"color\":\"red\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 5 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| summarize count() by tostring(target_s.displayName)\\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Active Applications\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Users\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| summarize count() by tostring(target_s.displayName), bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"title\":\"Active Applications\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Users\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"Events by Application\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"application.user_membership.add\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| extend TargetUser = tostring(parse_json(target_s)[0].alternateId)\\r\\n| extend Application = tostring(parse_json(target_s)[1].alternateId)\\r\\n| summarize count() by ['Event Time'] = column_ifexists('published_t', now()), ['Source User'] = actor_alternateId_s, Application, ['Target User'] = TargetUser\\r\\n| project-away count_\\r\\n| sort by ['Event Time'] desc\",\"size\":0,\"title\":\"Users Added to Application\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where eventType_s == \\\"application.user_membership.remove\\\"\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| extend TargetUser = tostring(parse_json(target_s)[0].alternateId)\\r\\n| extend Application = tostring(parse_json(target_s)[1].alternateId)\\r\\n| summarize count() by column_ifexists('published_t', now()), SourceUser = actor_alternateId_s, Application, TargetUser\\r\\n| project-away count_\\r\\n| sort by column_ifexists('published_t', now()) desc\\r\\n\",\"size\":0,\"title\":\"Users Removed from Application\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"General\"},\"customWidth\":\"50\",\"name\":\"query - 18 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where target_s.alternateId in ({ApplicationList}) or '*' in ({ApplicationList})\\r\\n| summarize count() by tostring(target_s.alternateId), bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Total Events by Application\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Application\"},\"customWidth\":\"50\",\"name\":\"query - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where target_s.alternateId in ({ApplicationList}) or '*' in ({ApplicationList})\\r\\n| where eventType_s has \\\"authentication\\\"\\r\\n| where outcome_result_s == \\\"FAILURE\\\"\\r\\n| summarize count() by tostring(target_s.alternateId), bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Failed Logins by Application\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Application\"},\"customWidth\":\"50\",\"name\":\"query - 12 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where target_s.alternateId in ({ApplicationList}) or '*' in ({ApplicationList})\\r\\n| summarize Total = count() by Application = tostring(target_s.alternateId)\\r\\n| top 10 by Total\",\"size\":0,\"title\":\"Top 10 Event Count by Application\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Application\"},\"customWidth\":\"50\",\"name\":\"query - 12 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| mv-expand todynamic(target_s)\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where eventType_s has \\\"authentication\\\"\\r\\n| where target_s.alternateId in ({ApplicationList}) or '*' in ({ApplicationList})\\r\\n| summarize SUCCESS = countif(outcome_result_s == \\\"SUCCESS\\\"), FAILURE = countif(outcome_result_s == \\\"FAILURE\\\"), Total = count() by User = actor_alternateId_s\\r\\n| top 10 by Total\\r\\n\",\"size\":0,\"title\":\"Top 10 User Authentications\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SUCCESS\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"FAILURE\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"palette\":\"coldHot\"}}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Application\"},\"customWidth\":\"50\",\"name\":\"query - 12 - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"427470db-f8f8-461c-adc7-47fe5202b5d1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SessionID\",\"label\":\"Session ID\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"OktaSSO\\r\\n| where actor_alternateId_s !in (\\\"system@okta.com\\\")\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| distinct authenticationContext_externalSessionId_s\\r\\n| sort by authenticationContext_externalSessionId_s asc\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"939a52ae-0662-4483-a52b-35287b151074\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"User\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"OktaSSO\\r\\n| where actor_alternateId_s !in (\\\"system@okta.com\\\")\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| distinct actor_alternateId_s\\r\\n| sort by actor_alternateId_s asc\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"059ad6dc-5f2f-490d-941a-d9f87cf71723\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EventTypes\",\"label\":\"Event Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| distinct eventType_s\\r\\n| sort by eventType_s asc\",\"value\":[\"user.session.start\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"]},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Analysis\"},\"name\":\"parameters - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where authenticationContext_externalSessionId_s in ({SessionID})\\r\\n| extend actor_alternateId_s=replace_string(actor_alternateId_s,@'\\\\','')\\r\\n| where actor_alternateId_s in ({User}) or '*' in ({User})\\r\\n| where eventType_s in ({EventTypes}) or '*' in ({EventTypes})\\r\\n| summarize count(eventType_s) by actor_alternateId_s, bin(column_ifexists('published_t', now()), {TimeRange:grain})\",\"size\":0,\"showAnnotations\":true,\"title\":\"User Events Timeline\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"actor_alternateId_s\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"actor_alternateId_s\",\"sortOrder\":2}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Analysis\"},\"customWidth\":\"50\",\"name\":\"query - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| where authenticationContext_externalSessionId_s in ({SessionID})\\r\\n| extend actor_alternateId_s=replace_string(actor_alternateId_s,@'\\\\','')\\r\\n| where actor_alternateId_s in ({User}) or '*' in ({User})\\r\\n| where eventType_s in ({EventTypes}) or '*' in ({EventTypes})\\r\\n| summarize count() by authenticationContext_externalSessionId_s, column_ifexists('published_t', now()), eventType_s, actor_alternateId_s\\r\\n| sort by authenticationContext_externalSessionId_s asc, column_ifexists('published_t', now()) asc\",\"size\":0,\"title\":\"User Event Details\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"actor_alternateId_s\",\"sortOrder\":2}],\"labelSettings\":[{\"columnId\":\"authenticationContext_externalSessionId_s\",\"label\":\"Session ID\"},{\"columnId\":\"published_t\",\"label\":\"Event Time\"},{\"columnId\":\"eventType_s\",\"label\":\"Event Type\"},{\"columnId\":\"actor_alternateId_s\",\"label\":\"User\"},{\"columnId\":\"count_\",\"label\":\"Total\"}]},\"sortBy\":[{\"itemKey\":\"actor_alternateId_s\",\"sortOrder\":2}]},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Analysis\"},\"customWidth\":\"50\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n| mv-expand todynamic(target_s)\\r\\n| where target_s.type == \\\"AppInstance\\\"\\r\\n| where eventType_s has \\\"authentication\\\"\\r\\n| where authenticationContext_externalSessionId_s in ({SessionID})\\r\\n| extend actor_alternateId_s=replace_string(actor_alternateId_s,@'\\\\','')\\r\\n| where actor_alternateId_s in ({User}) or '*' in ({User})\\r\\n| where eventType_s in ({EventTypes}) or '*' in ({EventTypes})\\r\\n| summarize SUCCESS = countif(outcome_result_s == \\\"SUCCESS\\\"), FAILURE = countif(outcome_result_s == \\\"FAILURE\\\"), Total = count() by actor_alternateId_s, tostring(target_s.alternateId)\\r\\n| sort by actor_alternateId_s asc, target_s_alternateId asc\\r\\n\\r\\n\",\"size\":0,\"title\":\"Application Authentications\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SUCCESS\",\"formatter\":8,\"formatOptions\":{\"palette\":\"green\"}},{\"columnMatch\":\"FAILURE\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"Total\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blue\"}}],\"labelSettings\":[{\"columnId\":\"actor_alternateId_s\",\"label\":\"User\"},{\"columnId\":\"target_s_alternateId\",\"label\":\"Application\"},{\"columnId\":\"SUCCESS\"},{\"columnId\":\"FAILURE\"},{\"columnId\":\"Total\"}]}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Analysis\"},\"customWidth\":\"50\",\"name\":\"query - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"OktaSSO\\r\\n| where domain_s in ({Domain}) or '*' in ({Domain})\\r\\n//| where authenticationContext_externalSessionId_s in ({SessionID})\\r\\n//| extend actor_alternateId_s=replace_string(actor_alternateId_s,@'\\\\','')\\r\\n| where actor_alternateId_s in ({User}) or '*' in ({User})\\r\\n//| where eventType_s in ({EventTypes}) or '*' in ({EventTypes})\\r\\n| summarize count(eventType_s) by \\tCity = client_geographicalContext_city_s, actor_alternateId_s, Country = client_geographicalContext_country_s, latitude = client_geographicalContext_geolocation_lat_d, longitude = client_geographicalContext_geolocation_lon_d, Results = outcome_result_s\",\"size\":0,\"title\":\"User Events by Geo-Location\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Users\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"mapSettings\":{\"locInfo\":\"LatLong\",\"latitude\":\"latitude\",\"longitude\":\"longitude\",\"sizeSettings\":\"count_eventType_s\",\"sizeAggregation\":\"Sum\",\"labelSettings\":\"actor_alternateId_s\",\"legendMetric\":\"count_eventType_s\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"count_eventType_s\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"conditionalVisibility\":{\"parameterName\":\"selectedTab\",\"comparison\":\"isEqualTo\",\"value\":\"Analysis\"},\"customWidth\":\"50\",\"name\":\"query - 3 - Copy - Copy\"}],\"fromTemplateId\":\"sentinel-SSOWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { "description": "@{workbookKey=OktaSingleSignOnWorkbook; logoFileName=okta_logo.svg; description=Gain extensive insight into Okta Single Sign-On (SSO) by analyzing, collecting and correlating Audit and Event events.\nThis workbook provides visibility into message and click events that were permitted, delivered, or blocked.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.2; title=Okta Single Sign-On; templateRelativePath=OktaSingleSignOn.json; subtitle=; provider=Okta}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "operator": "AND", "criteria": [ { "contentId": "Okta_CL", "kind": "DataType" }, { "contentId": "OktaSSO", "kind": "DataType" }, { "contentId": "OktaSSO", "kind": "DataConnector" }, { "contentId": "OktaSSOv2", "kind": "DataConnector" } ] } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('_workbookContentId1')]", "contentKind": "Workbook", "displayName": "[parameters('workbook1-name')]", "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", "name": "[variables('parserObject1').parserTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { "description": "OktaSSO Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", "parameters": {}, "variables": {}, "resources": [ { "name": "[variables('parserObject1')._parserName1]", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Backward Compatibility Parser for Okta SSO", "category": "Microsoft Sentinel Parser", "functionAlias": "OktaSSO", "query": "let Okta_SSO = view () {\nlet Oktav1_empty = datatable(\n actor_alternateId_s:string,\n actor_detailEntry_s:string,\n actor_displayName_s:string,\n actor_id_s:string,\n actor_type_s:string,\n authenticationContext_authenticationProvider_s:string,\n authenticationContext_authenticationStep_d:double,\n authenticationContext_credentialProvider_s:string,\n authenticationContext_credentialType_s:string,\n authenticationContext_externalSessionId_s:string,\n authenticationContext_interface_s:string,\n authenticationContext_issuerId_s:string,\n authenticationContext_issuerType_s:string,\n client_device_s:string,\n client_geographicalContext_city_s:string,\n client_geographicalContext_country_s:string,\n client_geographicalContext_geolocation_lat_d:double,\n client_geographicalContext_geolocation_lon_d:double,\n client_geographicalContext_postalCode_s:string,\n client_geographicalContext_state_s:string,\n client_id_s:string,\n client_ipAddress_s:string,\n client_userAgent_browser_s:string,\n client_userAgent_os_s:string,\n client_userAgent_rawUserAgent_s:string,\n client_zone_s:string,\n debugContext_debugData_s:string,\n displayMessage_s:string,\n eventType_s:string,\n legacyEventType_s:string,\n uuid_g:string,\n outcome_reason_s:string,\n outcome_result_s:string,\n request_ipChain_s:string,\n securityContext_asNumber_d:double,\n securityContext_asOrg_s:string,\n securityContext_domain_s:string,\n securityContext_isp_s:string,\n securityContext_isProxy_b:bool,\n severity_s:string,\n target_s:string,\n transaction_details_s:string,\n transaction_id_s:string,\n transaction_type_s:string,\n version_s:string\n)[];\nlet Oktav2 = OktaV2_CL |\n project TimeGenerated,\n actor_alternateId_s=OriginalActorAlternateId,\n actor_detailEntry_s=tostring(ActorDetailEntry),\n actor_displayName_s=ActorDisplayName,\n actor_id_s=OriginalUserId,\n actor_type_s=OriginalUserType,\n authenticationContext_authenticationProvider_s=AuthenticationContextAuthenticationProvider,\n authenticationContext_authenticationStep_d=toreal(AuthenticationContextAuthenticationStep),\n authenticationContext_credentialProvider_s=AuthenticationContextCredentialProvider,\n authenticationContext_credentialType_s=LogonMethod,\n authenticationContext_externalSessionId_s=ActorSessionId,\n authenticationContext_interface_s=AuthenticationContextInterface,\n authenticationContext_issuerId_s=AuthenticationContextIssuerId,\n authenticationContext_issuerType_s=AuthenticationContextIssuerType,\n client_device_s=OriginalClientDevice,\n client_geographicalContext_city_s=SrcGeoCity,\n client_geographicalContext_country_s=SrcGeoCountry,\n client_geographicalContext_geolocation_lat_d=SrcGeoLatitude,\n client_geographicalContext_geolocation_lon_d=SrcGeoLongtitude,\n client_geographicalContext_postalCode_s=SrcGeoPostalCode,\n client_geographicalContext_state_s=SrcGeoRegion,\n client_id_s=SrcDvcId,\n client_ipAddress_s=SrcIpAddr,\n client_userAgent_browser_s=ActingAppName,\n client_userAgent_os_s=SrcDvcOs,\n client_userAgent_rawUserAgent_s=HttpUserAgent,\n client_zone_s=SrcZone,\n debugContext_debugData_s=tostring(DebugData),\n displayMessage_s=EventMessage,\n eventType_s=EventOriginalType,\n legacyEventType_s=LegacyEventType,\n uuid_g=EventOriginalUid,\n outcome_reason_s=EventOriginalResultDetails,\n outcome_result_s=OriginalOutcomeResult,\n request_ipChain_s=tostring(Request),\n securityContext_asNumber_d=toreal(SecurityContextAsNumber),\n securityContext_asOrg_s=SecurityContextAsOrg,\n securityContext_domain_s=SecurityContextDomain,\n securityContext_isp_s=SrcIsp,\n securityContext_isProxy_b=SecurityContextIsProxy,\n severity_s=OriginalSeverity,\n target_s=tostring(OriginalTarget),\n transaction_details_s=tostring(TransactionDetail),\n transaction_id_s=TransactionId,\n transaction_type_s=TransactionType,\n version_s = Version;\n union isfuzzy=true Oktav1_empty, Oktav2, Okta_CL\n};\nOkta_SSO()\n", "functionParameters": "", "version": 2, "tags": [ { "name": "description", "value": "" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ "[variables('parserObject1')._parserId1]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Backward Compatibility Parser for Okta SSO')]", "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", "version": "[variables('parserObject1').parserVersion1]", "source": { "name": "Okta Single Sign-On", "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } } ] }, "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "Backward Compatibility Parser for Okta SSO", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "2022-10-01", "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", "displayName": "Backward Compatibility Parser for Okta SSO", "category": "Microsoft Sentinel Parser", "functionAlias": "OktaSSO", "query": "let Okta_SSO = view () {\nlet Oktav1_empty = datatable(\n actor_alternateId_s:string,\n actor_detailEntry_s:string,\n actor_displayName_s:string,\n actor_id_s:string,\n actor_type_s:string,\n authenticationContext_authenticationProvider_s:string,\n authenticationContext_authenticationStep_d:double,\n authenticationContext_credentialProvider_s:string,\n authenticationContext_credentialType_s:string,\n authenticationContext_externalSessionId_s:string,\n authenticationContext_interface_s:string,\n authenticationContext_issuerId_s:string,\n authenticationContext_issuerType_s:string,\n client_device_s:string,\n client_geographicalContext_city_s:string,\n client_geographicalContext_country_s:string,\n client_geographicalContext_geolocation_lat_d:double,\n client_geographicalContext_geolocation_lon_d:double,\n client_geographicalContext_postalCode_s:string,\n client_geographicalContext_state_s:string,\n client_id_s:string,\n client_ipAddress_s:string,\n client_userAgent_browser_s:string,\n client_userAgent_os_s:string,\n client_userAgent_rawUserAgent_s:string,\n client_zone_s:string,\n debugContext_debugData_s:string,\n displayMessage_s:string,\n eventType_s:string,\n legacyEventType_s:string,\n uuid_g:string,\n outcome_reason_s:string,\n outcome_result_s:string,\n request_ipChain_s:string,\n securityContext_asNumber_d:double,\n securityContext_asOrg_s:string,\n securityContext_domain_s:string,\n securityContext_isp_s:string,\n securityContext_isProxy_b:bool,\n severity_s:string,\n target_s:string,\n transaction_details_s:string,\n transaction_id_s:string,\n transaction_type_s:string,\n version_s:string\n)[];\nlet Oktav2 = OktaV2_CL |\n project TimeGenerated,\n actor_alternateId_s=OriginalActorAlternateId,\n actor_detailEntry_s=tostring(ActorDetailEntry),\n actor_displayName_s=ActorDisplayName,\n actor_id_s=OriginalUserId,\n actor_type_s=OriginalUserType,\n authenticationContext_authenticationProvider_s=AuthenticationContextAuthenticationProvider,\n authenticationContext_authenticationStep_d=toreal(AuthenticationContextAuthenticationStep),\n authenticationContext_credentialProvider_s=AuthenticationContextCredentialProvider,\n authenticationContext_credentialType_s=LogonMethod,\n authenticationContext_externalSessionId_s=ActorSessionId,\n authenticationContext_interface_s=AuthenticationContextInterface,\n authenticationContext_issuerId_s=AuthenticationContextIssuerId,\n authenticationContext_issuerType_s=AuthenticationContextIssuerType,\n client_device_s=OriginalClientDevice,\n client_geographicalContext_city_s=SrcGeoCity,\n client_geographicalContext_country_s=SrcGeoCountry,\n client_geographicalContext_geolocation_lat_d=SrcGeoLatitude,\n client_geographicalContext_geolocation_lon_d=SrcGeoLongtitude,\n client_geographicalContext_postalCode_s=SrcGeoPostalCode,\n client_geographicalContext_state_s=SrcGeoRegion,\n client_id_s=SrcDvcId,\n client_ipAddress_s=SrcIpAddr,\n client_userAgent_browser_s=ActingAppName,\n client_userAgent_os_s=SrcDvcOs,\n client_userAgent_rawUserAgent_s=HttpUserAgent,\n client_zone_s=SrcZone,\n debugContext_debugData_s=tostring(DebugData),\n displayMessage_s=EventMessage,\n eventType_s=EventOriginalType,\n legacyEventType_s=LegacyEventType,\n uuid_g=EventOriginalUid,\n outcome_reason_s=EventOriginalResultDetails,\n outcome_result_s=OriginalOutcomeResult,\n request_ipChain_s=tostring(Request),\n securityContext_asNumber_d=toreal(SecurityContextAsNumber),\n securityContext_asOrg_s=SecurityContextAsOrg,\n securityContext_domain_s=SecurityContextDomain,\n securityContext_isp_s=SrcIsp,\n securityContext_isProxy_b=SecurityContextIsProxy,\n severity_s=OriginalSeverity,\n target_s=tostring(OriginalTarget),\n transaction_details_s=tostring(TransactionDetail),\n transaction_id_s=TransactionId,\n transaction_type_s=TransactionType,\n version_s = Version;\n union isfuzzy=true Oktav1_empty, Oktav2, Okta_CL\n};\nOkta_SSO()\n", "functionParameters": "", "version": 2, "tags": [ { "name": "description", "value": "" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ "[variables('parserObject1')._parserId1]" ], "properties": { "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Backward Compatibility Parser for Okta SSO')]", "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", "version": "[variables('parserObject1').parserVersion1]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Okta Single Sign-On", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Okta Single Sign-On (SSO) solution for Microsoft Sentinel provides the capability to ingest audit and event logs into Microsoft Sentinel using the Okta API.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions

    \n
    3. \n
\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 9, Hunting Queries: 10, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { "kind": "Solution", "name": "Okta Single Sign-On", "sourceId": "[variables('_solutionId')]" }, "author": { "name": "Microsoft", "email": "[variables('_email')]" }, "support": { "name": "Microsoft Corporation", "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" }, "dependencies": { "operator": "AND", "criteria": [ { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" }, { "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentIdConnections2')]", "version": "[variables('dataConnectorCCPVersion')]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "version": "[variables('huntingQueryObject4').huntingQueryVersion4]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "version": "[variables('huntingQueryObject5').huntingQueryVersion5]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", "version": "[variables('huntingQueryObject6').huntingQueryVersion6]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", "version": "[variables('huntingQueryObject7').huntingQueryVersion7]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", "version": "[variables('huntingQueryObject8').huntingQueryVersion8]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "version": "[variables('huntingQueryObject9').huntingQueryVersion9]" }, { "kind": "HuntingQuery", "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "version": "[variables('huntingQueryObject10').huntingQueryVersion10]" }, { "kind": "LogicAppsCustomConnector", "contentId": "[variables('_OktaCustomConnector')]", "version": "[variables('playbookVersion1')]" }, { "kind": "Playbook", "contentId": "[variables('_Okta-EnrichIncidentWithUserDetails')]", "version": "[variables('playbookVersion2')]" }, { "kind": "Playbook", "contentId": "[variables('_Okta-PromptUser')]", "version": "[variables('playbookVersion3')]" }, { "kind": "Playbook", "contentId": "[variables('_Okta-ResponseFromTeams')]", "version": "[variables('playbookVersion4')]" }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", "version": "[variables('workbookVersion1')]" }, { "kind": "Parser", "contentId": "[variables('parserObject1').parserContentId1]", "version": "[variables('parserObject1').parserVersion1]" } ] }, "firstPublishDate": "2022-03-24", "providers": [ "Okta" ], "categories": { "domains": [ "Identity", "Security - Automation (SOAR)" ] } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" } ], "outputs": {} }