Integration: Kaseya SIEM and Okta

Kaseya SIEM

NAVIGATION  Organizations > Edit Organization > Applications > New Application

PERMISSIONS  Kaseya SIEM administrator permissions

Okta

NAVIGATION  Applications > Applications

PERMISSIONS  Okta administrator privileges

To prepare Okta for use with Kaseya SIEM:

1. Sign in to the Okta Admin Console.

2. Navigate to Applications > Applications.

3. Select Create App Integration.

4. Select OIDC - OpenID Connect.

5. Select Web Application.

6. Enter Kaseya SIEM as the application name.

7. Enable the following grant types:

   • Authorization Code

   • Refresh Token

8. In Sign-in Redirect URIs, enter: https://manage.kaseyasiem.com/products/oauth2/redirect

9. Select Skip group assignment for now.

10. Create the application.

11. Grant the following API scope: okta.logs.read

12. Record the Client ID and Client Secret: The Client ID and Client Secret will be required when configuring the integration in Kaseya SIEM.

To complete the integration:

1. Navigate to Organizations.

2. Select the organization to configure.

3. Select the Edit icon.

4. Open the Applications tab.

5. Select + New Application.

6. Select Okta.

7. Enter the following information:

   • Domain

   • Client ID

   • Client Secret

8. Select Finish.

9. Complete the authorization process when prompted.

The Okta connection is activated after authorization is successfully completed, and Okta events can begin flowing into Kaseya SIEM.

To verify the integration:

1. Open the organization's Applications list.

2. Confirm that the Okta application displays an Active status.

3. Verify that events begin appearing within Kaseya SIEM.

Examples of Okta events that may appear in Kaseya SIEM include:

• Authentication Success

• Authentication Failure

• OAuth Access Used for Foreign Application

• User Logged Out

• New User Added

• Password Reset

To disable the integration:

1. Navigate to Organizations.

2. Select the organization.

3. Open the Applications tab.

4. Locate the Okta integration.

5. Disconnect or remove the integration.

No additional configuration changes are required in Okta unless you also want to delete the associated Okta application.

After the integration is configured, Kaseya SIEM can collect supported Okta audit and authentication events. Examples include Authentication Success, Authentication Failure, OAuth Access Used for Foreign Application, User Logged Out, New User Added, and Password Reset.

After the integration is successfully authorized, event ingestion should begin automatically. The time required for events to appear depends on Okta activity and processing delays between the platforms.

If the Client Secret is regenerated, the existing integration may no longer be able to authenticate with Okta. Update the integration configuration in Kaseya SIEM using the new Client Secret.

Yes. Configure a separate integration for each Okta tenant you want Kaseya SIEM to monitor. Each tenant requires its own application registration, credentials, and authorization process.