Skip to main content
All Okta integration capabilities

​
About

Stream your Okta System Log into Sazabi: sign-ins, MFA enrollments and challenges, admin and policy changes, app access, and session activity. Okta Log Streaming sends every event in near real time to an Amazon EventBridge partner event source in your AWS account, and an EventBridge rule forwards each event to your Sazabi intake URL. Sazabi never receives an Okta API token or AWS credentials. Each event keeps its full System Log payload, including the actor, client IP address and location, outcome, event type, targets, authentication context, and security context. Sazabi also stores the most-used fields as okta.* attributes, such as okta.event_type, okta.outcome.result, okta.actor.alternate_id, and okta.client.ip_address.

​
Prerequisites

  • An Okta super admin account.
  • An AWS account where you can create EventBridge event buses, connections, API destinations, rules, and an IAM role with CloudFormation.
  • Your Sazabi intake URL (shown above).
Okta streams every System Log event to the target. It does not filter by event type and cannot replay past events, so Sazabi receives events from the moment the stream is active.

​
Set up in the dashboard

1

​
Add an AWS EventBridge log stream in Okta

In the Okta Admin Console, go to Reports > Log Streaming and click Add Log Stream. Choose AWS EventBridge and click Next, then fill in:
  • Name: Sazabi
  • AWS Event Source Name: sazabi (letters and digits only)
  • AWS account ID: the 12-digit ID of the AWS account that should receive events
  • AWS region: the region you will deploy the stack in
Click Save. See Okta’s Add an AWS EventBridge log stream guide for details.
2

​
Copy the partner event source name

In the AWS console, open Amazon EventBridge > Partner event sources in the same region. Copy the name of the Pending source that starts with aws.partner/okta.com/. Don’t associate it with an event bus yourself; the stack in the next step does that.
3

​
Deploy the CloudFormation stack

Copy the CloudFormation template from the Okta setup page in Sazabi. It already contains your intake URL. In the same AWS region, create a stack from the template and set OktaEventSourceName to the name you copied.The stack creates:
  • The Okta partner event bus, associated with your partner event source.
  • An EventBridge rule that matches every Okta event.
  • An API destination that posts each event to your Sazabi intake URL, and an IAM role that lets EventBridge invoke it.
EventBridge retries a failed delivery for up to 24 hours.

​
Set up with the CLI

You can also register the Okta log source with the Sazabi CLI (installed and authenticated — see CLI reference):
The command prints the new log source ID and its intake URL. Run sazabi log-sources setup-instructions <log-source-id> to print the setup with that source’s intake URL filled in, save the CloudFormation template from it as okta-sazabi.yaml, then deploy it with the AWS CLI:

​
Verify

Sign out of and back in to the Okta Admin Console. Open the Intake page in the Sazabi dashboard and confirm events from the Okta source appear, including a user.session.start event. Events typically arrive within a few minutes.

​
Troubleshooting

No events after deploying the stack — In Okta, check that the log stream is Active under Reports > Log Streaming. In EventBridge, check that the partner event source shows Active. The Okta stream, the partner event source, and the stack must use the same AWS account and region. The log stream was deactivated — Okta deactivates a log stream after two failed deliveries. Fix the cause, then reactivate the stream from Reports > Log Streaming. The stack fails to create the event bus — The partner event source is already associated with an event bus. Delete that event bus and redeploy the stack. Duplicate events — Okta delivers each event at least once and may send an event more than once or out of order. Use okta.uuid to identify an event and published for its time.

​
Further reading

Intake

See per-source ingestion volume and health in the Intake page.

Log sources

Browse the full log source catalog.