Posts tagged: #system-log

A fictional Okta intrusion read event by event: helpdesk reset, attacker factor, Super Admin grant, rogue IdP and AWS access, with the analyzer's findings.

The Okta System Log eventTypes that matter in an incident, grouped by attack stage, with the fields to read and the Classic vs Identity Engine differences.

Analyze an Okta System Log export in your browser: load the files, read the verdict and findings, pivot on users, IPs and sessions, and export the timeline.

Export the Okta System Log for an investigation: Admin Console CSV, /api/v1/logs with correct pagination, Log Streaming, SIEM exports and the traps to avoid.

How to investigate a suspected Okta compromise from the System Log: scope, the eventTypes that matter, the attack chain step by step, and what to contain first.