Integration
Okta
The Okta System Log: sign-ins, MFA, password and lifecycle events, and admin changes, read every 5 minutes with a read-only token.
- Category: Identity and SaaS
- How data is sent: Logthread reads the API with a token you create (nothing to install)
- Status: Beta
How it works#
- Answer a few questions. A read-only API token for Okta and where to read from. The token is stored encrypted and never shown again; Logthread reads with it and changes nothing in your account.
- Logthread reads Okta every 5 minutes. There is nothing to install or paste: the poll starts as soon as the connector is created and carries on from where it left off, with every event sent once.
- Data arrives. Events from Okta appear under the service okta within minutes. The connection page shows the last poll, what arrived and any error from the API, and turns Active with the first record.
What you answer#
| Question | Answer | Notes |
|---|---|---|
| Okta domain | Text | For example acme.okta.com, acme.oktapreview.com or acme.okta-emea.com. |
| API token | Secret (stored encrypted, never shown) | An Okta API token (SSWS) from Security, API, Tokens; stored encrypted. |
Setup#
These are the steps for the default answers. In the app, they follow your answers, and the connector's ingest key replaces YOUR_INGEST_KEY.
Step 1. Create a read-only API token in Okta. Admin console: Security, API, Tokens, Create token. Create it as a user whose admin role can read the System Log (Read-only Administrator is enough). Paste it in the form above; it is stored encrypted and never shown again.
Step 2. Logthread reads the System Log. Every 5 minutes, from where it left off: sign-ins, MFA, password and lifecycle events, admin changes, with the actor, client address, outcome and target on every record. Nothing is changed in Okta.
Check that it works#
The connection page under Integrations counts what has arrived and turns Active with the first record. In Explore, search service:okta.
Then add#
Each is one click on the connection page and opens with your data, so you can check it before saving.
- Dashboard: Okta: Sign-ins by outcome, failure reasons, MFA events, users and addresses with the most failures, and admin changes from the Okta System Log.
- Alert: Okta sign-in failures:
service:okta okta.event_type:user.session.start okta.outcome:FAILURE, at least 20 in 10 minutes - Alert: Okta admin changes:
service:okta okta.event_type:(system.* OR application.* OR policy.*) okta.outcome:SUCCESS, at least 1 in 10 minutes
Set it up under Integrations in the app, or from an AI agent with MCP (add_integration). All integrations: Integrations guide. Next: find what it sends in Explore and live tail.