How to Export Okta System Logs for Security Analysis
Summary
A practical guide to exporting Okta System Log events through the API, safely handling tokens, and reviewing authentication and administrative events for signs of password spraying, MFA fatigue, or policy changes.
Key points
- Okta retains System Log events for 90 days; older records may be available through a SIEM or log-streaming destination.
- The guide shows how to page through API results using a fixed time window and the next link, and warns that omitting “until” can cause a live-polling loop.
- It recommends keeping API tokens out of shell history and using an OAuth service app with the okta.logs.read scope for automation.
- Repeated failed sign-ins may indicate password spraying; bursts of denied MFA pushes may indicate MFA fatigue.
- Factor resets, privilege grants, policy changes, and new API tokens are highlighted as events to review.
- Useful event context includes the actor, client IP and geographical context, outcome, and debug data.
Article Details
- Defense Focus
- Export and review Okta System Log events to detect suspicious sign-ins, MFA activity, privilege changes, policy changes, and API-token creation.
- Detection Methods
- Look for failed user.session.start events across many users from one IP range as a possible password-spraying pattern.
- Identify bursts of user.mfa.okta_verify.deny_push events as possible MFA fatigue.
- Review user.mfa.factor.deactivate and user.mfa.factor.reset_all events, especially after a helpdesk interaction.
- Alert on user.account.privilege.grant, policy.rule.update, policy.lifecycle.update, and system.api_token.create events.
- Data Sources
- Okta System Log events retrieved through the System Log API or Admin Console.
- Relevant fields: actor.alternateId, client.ipAddress, client.geographicalContext, outcome, and debugContext.debugData.
- Rule Types
- Event-based detection rules using Okta event types and outcomes.
- Defensive Actions
- Use a read-only administrator token or an OAuth service app with the okta.logs.read scope.
- Protect API tokens from shell history and revoke tokens when no longer needed.
- Set an explicit until time when exporting logs and follow pagination links until exhausted.
- Respect endpoint rate limits and resume after the time specified in X-Rate-Limit-Reset.
- Forward or stream logs to a SIEM or another retention destination to preserve events beyond Okta's 90-day retention period.
MITRE ATT&CK
T1110.003 · Password SprayingThe article identifies password-spraying detections based on failed sign-ins across many users from one IP range.T1556.006 · Multi-Factor AuthenticationThe article describes detection rules for attackers tampering with MFA enrollment.T1621 · Multi-Factor Authentication Request GenerationThe article identifies bursts of denied Okta Verify push events as a detection for MFA fatigue.