> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

> Stream the Okta System Log to Sazabi with Okta Log Streaming and Amazon EventBridge to monitor sign-ins, MFA changes, admin actions, and suspicious sessions.

[All Okta integration capabilities](https://docs.sazabi.com/catalogs/integrations/okta)

## About

Stream your Okta System Log into Sazabi: sign-ins, MFA enrollments and challenges, admin and policy changes, app access, and session activity. Okta Log Streaming sends every event in near real time to an Amazon EventBridge partner event source in your AWS account, and an EventBridge rule forwards each event to your Sazabi intake URL. Sazabi never receives an Okta API token or AWS credentials.

Each event keeps its full System Log payload, including the actor, client IP address and location, outcome, event type, targets, authentication context, and security context. Sazabi also stores the most-used fields as `okta.*` attributes, such as `okta.event_type`, `okta.outcome.result`, `okta.actor.alternate_id`, and `okta.client.ip_address`.

## Prerequisites

* An Okta **super admin** account.
* An AWS account where you can create EventBridge event buses, connections, API destinations, rules, and an IAM role with CloudFormation.
* Your Sazabi intake URL (shown above).

> [!WARNING]
>
> Okta streams every System Log event to the target. It does not filter by event
> type and cannot replay past events, so Sazabi receives events from the moment
> the stream is active.

## Set up in the dashboard

**Step 1**

### Add an AWS EventBridge log stream in Okta

In the Okta Admin Console, go to **Reports > Log Streaming** and click **Add Log Stream**. Choose **AWS EventBridge** and click **Next**, then fill in:

* **Name**: `Sazabi`
* **AWS Event Source Name**: `sazabi` (letters and digits only)
* **AWS account ID**: the 12-digit ID of the AWS account that should receive events
* **AWS region**: the region you will deploy the stack in

Click **Save**. See Okta's [Add an AWS EventBridge log stream](https://help.okta.com/en-us/content/topics/reports/log-streaming/add-aws-eb-log-stream.htm) guide for details.

**Step 2**

### Copy the partner event source name

In the AWS console, open [Amazon EventBridge > Partner event sources](https://console.aws.amazon.com/events/home#/partners) in the same region. Copy the name of the **Pending** source that starts with `aws.partner/okta.com/`. Don't associate it with an event bus yourself; the stack in the next step does that.

**Step 3**

### Deploy the CloudFormation stack

Copy the CloudFormation template from the Okta setup page in Sazabi. It already contains your intake URL. In the same AWS region, create a stack from the template and set **OktaEventSourceName** to the name you copied.

The stack creates:

* The Okta partner event bus, associated with your partner event source.
* An EventBridge rule that matches every Okta event.
* An API destination that posts each event to your Sazabi intake URL, and an IAM role that lets EventBridge invoke it.

EventBridge retries a failed delivery for up to 24 hours.

## Set up with the CLI

You can also register the Okta log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)):

```bash theme={"system"}
sazabi log-sources create okta --mode manual
```

The command prints the new log source ID and its intake URL. Run `sazabi log-sources setup-instructions <log-source-id>` to print the setup with that source's intake URL filled in, save the CloudFormation template from it as `okta-sazabi.yaml`, then deploy it with the AWS CLI:

```bash theme={"system"}
aws cloudformation deploy \
  --stack-name sazabi-okta \
  --template-file okta-sazabi.yaml \
  --parameter-overrides OktaEventSourceName=aws.partner/okta.com/your-okta-subdomain/sazabi \
  --capabilities CAPABILITY_IAM
```

## Verify

Sign out of and back in to the Okta Admin Console. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm events from the **Okta** source appear, including a `user.session.start` event. Events typically arrive within a few minutes.

## Troubleshooting

**No events after deploying the stack** — In Okta, check that the log stream is **Active** under **Reports > Log Streaming**. In EventBridge, check that the partner event source shows **Active**. The Okta stream, the partner event source, and the stack must use the same AWS account and region.

**The log stream was deactivated** — Okta deactivates a log stream after two failed deliveries. Fix the cause, then reactivate the stream from **Reports > Log Streaming**.

**The stack fails to create the event bus** — The partner event source is already associated with an event bus. Delete that event bus and redeploy the stack.

**Duplicate events** — Okta delivers each event at least once and may send an event more than once or out of order. Use `okta.uuid` to identify an event and `published` for its time.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.