Graylog2 / Graylog2/illuminate-documentation

Update Illuminate Okta documentation

Open
#5 0 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
HTML
Stars
2
Forks
0
PR merge metrics
No merged PRs in 30d

Description

- Processing updates
- Okta now processes the full JSON message. This is provided with the updated Okta input, or by enalbing the full_message option on earlier versions of the Okta input.
- Field mapping updates
- With the updated processing the following fields will be mapped:
- actor)*:
- user_* for all events except for categorized IAM events; IAM events will map to source_user_*
- target_*: The following target object types will be mapped:
- AppInstance: application_*
- AppUser:
- For categorized IAM events the AppUser will be the target_user_*
- PolicyRule: vendor_data_target_policyrule_*
- PolicyEntity: vendor_data_target_policyentity_*
- User:
- UserGroup:
- ConsentGrant:
- id_token:
- access_token:
- Debug data: vendor_debugdata_*
- Transaction metadata:
- transaction.type: transaction_type
- transaction.id: transaction_id
- uuid:
- event_uid
- eventType:
- event_type (will be provided by updated Okta input)
- displayMessage: event_description
- severity: vendor_event_severity
- authenticationContext.externalSessionId: auth_context_session_id
- outcome.result: vendor_event_outcome
- outcome.reason: vendor_event_outcome_reason
- Provide table of the following mappings:
```
app.access_request.approver.approve,111001
app.access_request.approver.deny,111002
app.access_request.delete,111002
app.access_request.deny,111002
app.access_request.expire,111002
app.access_request.grant,111001
app.ad.api.user_import.account_locked,111500
app.ad.api.user_import.warn.skipped_contact.attribute_invalid_value,110001
app.ad.api.user_import.warn.skipped_user.attribute_invalid_value,110001
app.ad.api.user_import.warn.skipped_user.missing_required_attribute,110001
app.generic.unauth_app_access_attempt,101500
app.inbound_del_auth.login_success,100000
app.kerberos_rich_client.account_not_found,102003
app.kerberos_rich_client.instance_not_found,102003
app.kerberos_rich_client.multiple_accounts_found,102003
app.kerberos_rich_client.user_authentication_successful,100500
app.ldap.password.change.failed,111004
application.configuration.update_api_credentials_for_pass_change,111000
application.policy.sign_on.deny_access,101500
application.provision.group.add,112500
application.provision.group.import,112500
application.provision.group_membership.add,113502
application.provision.group_membership.import,113502
application.provision.group_membership.remove,113502
application.provision.group_membership.update,113502
application.provision.group_push.activate_mapping,113502
application.provision.group_push.delete_appgroup,113502
application.provision.group_push.mapping.and.groups.deleted.rule.deleted,113502
application.provision.group_push.mapping.app.group.renamed,113502
application.provision.group_push.mapping.app.group.renamed.failed,113502
application.provision.group_push.mapping.created,113502
application.provision.group_push.mapping.created.from.rule.warning.duplicate.name,113502
application.provision.group_push.mapping.created.from.rule.warning.duplicate.name.tobecreated,113502
application.provision.group_push.mapping.created.from.rule.warning.upsertGroup.duplicate.name,113502
application.provision.group_push.mapping.deactivated.source.group.renamed,113502
application.provision.group_push.mapping.deactivated.source.group.renamed.failed,113502
application.provision.group_push.mapping.update.or.delete.failed,113502
application.provision.group_push.pushed,113502
application.provision.group_push.push_memberships,113502
application.provision.group_push.removed,113502
application.provision.group_push.updated,113502
application.provision.group.remove,113000
application.provision.group.update,113502
application.provision.group.verify_exists,113502
application.provision.user.activate,111001
application.provision.user.deactivate,111000
application.provision.user.deprovision,111000
application.provision.user.import,111000
application.provision.user.push,111000
application.provision.user.push_okta_password,111005
application.provision.user.push_password,111005
application.provision.user.push_profile,111000
application.provision.user.reactivate,111001
application.provision.user.sync,111000
application.user_membership.add,111001
application.user_membership.approve,111001
application.user_membership.change_password,111000
application.user_membership.change_username,111000
application.user_membership.deprovision,111002
application.user_membership.provision,111001
application.user_membership.remove,111002
application.user_membership.restore,111001
application.user_membership.restore_password,111000
application.user_membership.revoke,111002
application.user_membership.update,111000
app.office365.api.error.check.user.exists,100501
app.office365.api.error.create.user,110001
app.office365.api.error.deactivate.user,111006
app.office365.api.error.get.company.dirsync.status.pending,110001
app.office365.api.error.group.create.failure,110001
app.office365.api.error.group.create.failure.name.in.use,110001
app.office365.api.error.group.membership.update.assignment.failure,111006
app.office365.api.error.group.membership.update.failure,111006
app.office365.api.error.group.membership.update.group.not.found.failure,111006
app.office365.api.error.group.membership.update.removal.failure,111006
app.office365.api.error.group.update.failure,111006
app.office365.api.error.group.update.failure.not.found,111006
app.office365.api.error.import.profile,111006
app.office365.api.error.no.endpoints.found,111006
app.office365.api.error.push.password,111006
app.office365.api.error.push.profile,111006
app.office365.api.error.reactivate.user,111006
app.office365.api.error.sync.contact,111006
app.office365.api.error.sync.finalize,111006
app.office365.api.error.sync.group,111006
app.office365.api.error.sync.user,111006
app.office365.api.error.validate.creds,100501
app.office365.api.error.validate.creds.unknown.exception,100501
app.office365.error.importing.user,110001
app.office365.user.delete.success,110500
app.office365.user.remove.licenses.success,111000
app.realtimesync.import.details.add_user,110000
app.realtimesync.import.details.delete_user,110500
app.realtimesync.import.details.update_user,111000
app.saml.sensitive.attribute.update,111000
app.user_management,111000
app.user_management.push_new_user_success,110000
credential.register,111000
credential.revoke,111000
directory.app_user_profile.bootstrap,111000
directory.app_user_profile.update,111000
group.application_assignment.add,111007
group.application_assignment.remove,111008
group.application_assignment.skip_assignment_reconcile,113502
group.application_assignment.update,113502
group.lifecycle.create,110002
group.lifecycle.delete,110501
group.privilege.grant,113502
group.privilege.revoke,113502
group.user_membership.add,111007
group.user_membership.remove,111008
group.user_membership.rule.deactivated,113502
group.user_membership.rule.evaluation,113502
group.user_membership.rule.invalidate,113502
group.user_membership.rule.trigger,113502
master_application.user_membership.add,111001
org.not_configured_origin.redirection.usage,101500
policy.evaluate_sign_on,100000
policy.execute.user.start,100000
scheduled_action.user_suspension.canceled,111000
scheduled_action.user_suspension.completed,111000
scheduled_action.user_suspension.scheduled,111501
scheduled_action.user_suspension.updated,111501
security.threat.detected,172000
system.agent.ad.import_user,110000
system.agent.ad.reset_user_password,111004
system.agent.ad.unlock_user_account,112000
system.agent.ad.update_user,111000
system.agent.ldap.change_user_password,111004
system.agent.ldap.create_user_JIT,110000
system.agent.ldap.reset_user_password,111004
system.agent.ldap.unlock_user_account,112000
system.agent.ldap.update_user_password,111004
system.csv.import_user,110000
system.email.account_unlock.sent_message,100502
system.email.challenge_factor_redeemed,100502
system.email.mfa_enroll_notification.sent_message,100502
system.email.mfa_reset_notification.sent_message,100502
system.email.new_device_notification.sent_message,100502
system.email.password_reset.sent_message,100502
system.email.send_factor_verify_message,100502
system.import.group.complete,112500
system.import.group.create,112500
system.import.group.delete,113000
system.import.group_membership.complete,113502
system.import.group.start,112500
system.import.group.update,113502
system.import.user.complete,110000
system.import.user.create,110000
system.import.user.delete,110500
system.import.user.suspend,111501
system.import.user.unsuspend,112001
system.import.user.unsuspend_after_confirm,112001
system.import.user.update,111000
system.import.user.update_user_lifecycle_from_master,111000
system.iwa_agentless.user.not_found,100502
system.iwa.go_offline,210100
system.iwa.go_online,210000
system.sms.send_account_unlock_message,100502
system.sms.send_factor_verify_message,100502
system.sms.send_okta_push_verify_message,100502
system.sms.send_password_reset_message,100502
system.sms.send_phone_verification_message,100502
system.voice.send_account_unlock_call,100502
system.voice.send_call,100502
system.voice.send_mfa_challenge_call,100502
system.voice.send_password_reset_call,100502
system.voice.send_phone_verification_call,100502
user.account.access_super_user_app,101000
user.account.lock,111500
user.account.lock.limit,111500
user.account.privilege.grant,111001
user.account.privilege.revoke,111002
user.account.reset_password,111004
user.account.unlock,112000
user.account.unlock_by_admin,112000
user.account.unlock_failure,112002
user.account.unlock_token,112000
user.account.update_password,111000
user.account.update_primary_email,111000
user.account.update_profile,111000
user.account.update_secondary_email,111000
user.account.update_user_type,111000
user.authentication.auth,100500
user.authentication.authenticate,100500
user.authentication.auth_via_AD_agent,100500
user.authentication.auth_via_IDP,100500
user.authentication.auth_via_inbound_delauth,100500
user.authentication.auth_via_inbound_SAML,100500
user.authentication.auth_via_iwa,100500
user.authentication.auth_via_LDAP_agent,100500
user.authentication.auth_via_mfa,100502
user.authentication.auth_via_radius,100500
user.authentication.auth_via_richclient,100500
user.authentication.auth_via_social,100500
user.authentication.slo,101000
user.authentication.sso,101000
user.authentication.verify,100500
user.import.password,111004
user.lifecycle.activate,112001
user.lifecycle.create,110000
user.lifecycle.deactivate,111501
user.lifecycle.delete.completed,110500
user.lifecycle.delete.initiated,110500
user.lifecycle.jit.error.read_only,110001
user.lifecycle.password_mass_expiry,111005
user.lifecycle.reactivate,112001
user.lifecycle.suspend,111501
user.lifecycle.unsuspend,112001
user.mfa.attempt_bypass,100502
user.mfa.factor.activate,100502
user.mfa.factor.deactivate,100502
user.mfa.factor.reset_all,100502
user.mfa.factor.update,100502
user.mfa.okta_verify,100502
user.mfa.okta_verify.deny_push,100502
user.mfa.okta_verify.deny_push_upgrade_needed,100502
user.session.access_admin_app,101000
user.session.clear,100000
user.session.end,100000
user.session.expire,100000
user.session.impersonation.end,101000
user.session.impersonation.extend,101000
user.session.impersonation.grant,101000
user.session.impersonation.initiate,101000
user.session.impersonation.revoke,101000
user.session.start,100000
```

Contributor guide

Open the contributing guide

Research direction

No documentation file or test path is named in the issue. Start by locating the Illuminate Okta documentation, then use the listed processing and field-mapping updates as the specification. Done means the updated mappings and the complete event-to-code table are documented accurately.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.