# OKTA System Log API

This data pipeline extracts the System logs from Okta technology using the Log API.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2F8OSgqKGrrId7c83NLwyF%2F2025-05-16_15-42-59.png?alt=media&#x26;token=456b9029-8cb8-4346-9de4-2fb39dec879b" alt=""><figcaption></figcaption></figure>

This Pipeline integrates with API Logs from the OKTA Platform using the[ **HTTP Pull**](https://docs.onum.com/marketplace/falcon-onum-marketplace/pulling-pipelines/broken-reference) Listener, transforming it from JSON to CSV format.

## Listen

The Listener pulls events using the **Configure as YAML** option, using the following YAML:

<pre><code><strong>withTemporalWindow: true
</strong>temporalWindow:
  duration: 1m
  offset: 1m
  tz: UTC
  format: "2006-01-02T15:04:05"
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "webLinking"
  limit: 1000
  request:
    responseType: json
    method: "GET"
    url: "****************"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "**********"
    queryParams:
      - name: since
        value: "${temporalWindow.from}"
      - name: until
        value: "${temporalWindow.to}"
  output:
    select: "."
    map: "."
    outputMode: "element"
</code></pre>

{% hint style="info" %}
See the article dedicated to setting up OKTA system log APIs [here](https://docs.onum.com/marketplace/falcon-onum-marketplace/pulling-pipelines/okta-system-log-api).
{% endhint %}

## Transform OKTA data

### Flat JSON

We need to flatten the incoming JSON with key-value pairs that we can then parse into more specific fields.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FnYrWS58IltXK0nMhJwQH%2Fdark-large%20(23).png?alt=media&#x26;token=6e5891b1-f685-4ae8-85c6-d090b87c54fe" alt=""><figcaption></figcaption></figure>

### Parser

The parser extracts the individual fields coming from the OKTA JSON into more detailed fields, including severity, actor information, user agent data and other transaction data.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FidgVl5WT7keA4G9ZBm7o%2Fdark-large%20(24).png?alt=media&#x26;token=2462fa05-e3f4-40f7-b086-91fc1923a478" alt=""><figcaption></figcaption></figure>

### Message Builder

We use the [**Message Builder** ](https://docs.onum.com/the-workspace/pipelines/actions/formatting/message-builder)action to transform the fields to CSV format, using a comma as the delimiter.&#x20;

You can now send on your CSV containing OKTA logs to your preferred destination using a sink.