Okta

Connect Okta to Radiant Security to forward authentication and admin activity logs for AI triage, and enable identity response actions. -

Okta is an identity and access management (IAM) platform that authenticates workforce and customer users across web, mobile, and on-premises applications, defending against credential theft, account takeover, and unauthorized access. Connecting Okta forwards System Log records to Radiant Security via the Okta API, and enables identity response actions through the same connection. Radiant uses Okta authentication and admin telemetry to surface anomalous logins, MFA failures, and privilege changes, giving analysts the identity context needed to triage account-compromise alerts.

At the end of this configuration, you provide Radiant Security with the following values:

• Okta domain, in the form https://my-org.okta.com
• API token

Prerequisites

• Super Admin access to Okta (service account recommended)

The token is used for both data ingestion and Okta response actions. Response actions require write scopes on users, sessions, and network zones, so generate the token from a Super Admin service account. A read-only admin is sufficient only if you do not plan to enable response actions.

API tokens are valid only while the user who created them remains active. Tokens issued by deactivated users are rejected. Use a service account that will not be deactivated and whose permissions will not change. See Okta's API token management guidance for details.

Generate the API token in Okta

1

Open the Okta Admin Console

Sign in to Okta with the admin account you intend to use for the token. In the upper right corner, click Admin to open the Admin Console.

2

Navigate to the API tokens page

In the left sidebar, navigate to Security > API.

3

Create the token

Click Create Token. Enter an identifiable name (e.g., Radiant Security API Token) and click Create Token again.

4

Copy the token value

Copy the Token value shown in the pop-up and store it securely.

The token value is shown only once and cannot be retrieved later. If it is lost, you must generate a new token.

Add the credential in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, select Settings > Credentials and click + Add Credential.
3. Search for and select Okta, then click Configure Credential.
4. Under Credential Name, enter a descriptive name (e.g., Okta-Credentials).
5. Under Required Credentials, enter the values from Okta:

   • Okta domain, in the form https://my-org.okta.com
   • API token
6. Click Add Credential to save the configuration.

Add the data connector in Radiant Security

1. From the navigation menu, select Settings > Data Connectors and click + Add Connector.
2. Search for and select Okta, then click Data Feeds.
3. Under Select your data feeds, select Okta Alerts & Activity Logs and click Credentials.
4. From the drop-down, select the Okta credential you created.
5. Click Add Connector to save the configuration.

Add the action connector in Radiant Security

The Okta action connector lets Radiant execute identity response actions against the same Okta tenant, including user account lockdown, session termination, and IP blocking through Okta Network Zones. For the full list of supported actions and the Okta scopes each one requires, see Okta actions.

1. From the navigation menu, select Settings > Action Connectors and click + Add Connector.
2. Search for and select Okta.
3. Confirm that the Okta credential is selected.
4. Click Add Connector.

Verify ingestion

After Okta begins forwarding, confirm alerts and events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"okta_system_logs".
3. Confirm recent alerts and events appear.

Allow several minutes for alerts and events to be parsed, indexed, and available for search.