Okta - Webhook Configuration

Created by Thomas Donnelly, Modified on Tue, 4 Mar at 9:57 PM by Thomas Donnelly

Configure Okta Event Types as Findings in Amplifier

Okta has a hundreds of Event Types that can be used for custom findings in Amplifier via Okta Event Hooks.

Configuration

From Amplifier

Navigate to Integration & Policies
Find the tile named CUSTOM FINDINGS and click CONFIGURE
Expand the Webhook Credentials section and copy the URL. This will be needed to configure Okta.

From Okta

Click on Workflow then Event Hooks from the left navigation
Click Create Event Hook
Name the Event Hook and paste the URL from your Amplifier Custom Findings web hook.
Under the REQUESTS section add a Custom Header Field
1. Fieldname = AMP-PROVIDER
2. Value = Okta
Select events in the Subscribe to Events
1. Note: You can select more but they will show up as the same finding on Amplifier.
Select Continue
Click Verifyto endpoint ownership
1. Note: It may take up to 30 minutes for Okta events to pump over to Amplifier
You will land on a preview page. Select the Event types top preview the API calls.
Copy the eventType from each call and save this for configuration within Amplifier

From Amplifier

Navigate to Integration & Policies
Find the tile named CUSTOM FINDINGS
Expand the Findings Configuration section and click CONFIGURE
Click ADD FINDINGS on the top right
Type a Finding Name to help your team identify the finding later.
Add the Event Type from step 9 above in the Okta configuration
Select a Severity from the dropdown.
Type a Finding (Display Name). This will be used by the application and shown to end users to make sure it is more end user friendly.
Type a Description which will also be used in the application and for prompts for our Engagement Studio.

Congratulation! You have configured Okta events to create findings in Amplifier. You can now use these to trigger engagements in the Engagement Studio.

List of Event Types

Here is the full list of events available from Okta: https://developer.okta.com/docs/reference/api/event-types/

Top 10 Useful Events

Event Type	Use Case
app.ldap.password.change.failed	Triage if a user is trying to change their password
app.access_request.grant	Reach out to users to let them know that access to an application was granted.
app.access_request.deny	Reach out to users to let them know that access to an application was denied.
system.mfa.factor.deactivate	Validate that a user deactivated MFA factors
user.account.lock.limit	Validate that a user accidentally locked themselves out.
user.account.privilege.grant	Validate a user was supposed to be given privilidged access
user.account.reset_password	Validate a user asked to reset their password