Okta PAM
| eventType | Description | Sample | Rule |
|---|---|---|---|
| pam. | The periodic Active Directory account discovery process has completed in Okta Privileged Access. | N | N |
| pam. | Account rule applied to AD account import. | N | N |
| pam. | Update the Active Directory account assignment rule in Okta Privileged Access. | N | N |
| pam. | Update an Active Directory connection status in Okta Privileged Access. | N | N |
| pam. | This event is triggered after an Active Directory Connection is created for discovering servers in Advanced Server Access. | N | N |
| pam. | This event is triggered after an Active Directory Connection is deleted in Advanced Server Access. | N | N |
| pam. | This event is triggered after an Active Directory Connection is updated in Advanced Server Access. | N | N |
| pam. | This event is triggered after settings that are related to discovering servers in an Active Directory connection are created in Advanced Server Access. | N | N |
| pam. | This event is triggered after settings that are related to discovering servers in an Active Directory connection are deleted in Advanced Server Access. | N | N |
| pam. | This event is triggered after settings that are related to discovering servers in an Active Directory connection are updated in Advanced Server Access. | N | N |
| pam. | This event is triggered after the schedule for discovering Active Directory servers is updated in Advanced Server Access. | N | N |
| pam. | This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is activated. | N | N |
| pam. | This event is triggered after settings that are related to discovering users in an Active Directory connection are created. | N | N |
| pam. | This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is deactivated. | N | N |
| pam. | This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is deleted. | N | N |
| pam. | This event is triggered after settings that are related to discovering users in an Active Directory connection are updated. | N | N |
| pam. | This event is triggered after the schedule for discovering Active Directory users in an Active Directory connection is updated. | N | N |
| pam. | This event is triggered after a service user's API key is deleted. | N | N |
| pam. | This event is triggered after a service user's API key is rotated. | N | N |
| pam. | Update the settings for an app connected to Okta Privileged Access. | N | N |
| pam. | This event is triggered when an ASA client has been authenticated and is issued an authentication token with elevated capabilities. | N | N |
| pam. | This event is triggered after a billing contact is created for an ASA team. | N | N |
| pam. | This event is triggered after an ASA client is assigned to an ASA user. | N | N |
| pam. | This event is triggered after an ASA client is enrolled with ASA. | N | N |
| pam. | This event is triggered after an ASA client is removed from a team. | N | N |
| pam. | This event is triggered after the state of an ASA client is updated. | N | N |
| pam. | This event is triggered after an ASA client enrollment policy is created. | N | N |
| pam. | This event is triggered after an ASA client enrollment policy is deleted. | N | N |
| pam. | This event is triggered after an ASA client enrollment policy is updated. | N | N |
| pam. | This event is triggered after an ASA client enrollment token is deleted. | N | N |
| pam. | This event is triggered after an ASA client enrollment token is rotated. | N | N |
| pam. | This event is triggered after a project cloud account is created for importing servers into ASA. | N | N |
| pam. | This event is triggered after a cloud account has been removed from a project. | N | N |
| pam. | This event is triggered after a cloud account, which is used for importing servers into ASA, is updated. | N | N |
| pam. | This event is triggered after a sudo entitlement object is added to a project. | N | N |
| pam. | This event is triggered after a sudo entitlement object is created. | N | N |
| pam. | This event is triggered after a sudo entitlement object is removed. | N | N |
| pam. | This event is triggered after a sudo entitlement object is removed from a project. | N | N |
| pam. | This event is triggered after a sudo entitlement object is updated. | N | N |
| pam. | This event is triggered after an ASA gateway is created. | N | N |
| pam. | This event is triggered after an ASA gateway is deleted. | N | N |
| pam. | This event is triggered after a gateway setup token is created. | N | N |
| pam. | This event is triggered after a gateway setup token is deleted. | N | N |
| pam. | This event is triggered after a gateway setup token is updated. | N | N |
| pam. | This event is triggered after settings are updated on an ASA gateway. | N | N |
| pam. | This event is triggered after the gateway issues credentials for a server. | N | N |
| pam. | This event is triggered after the members belonging to an ASA group were updated in bulk by a SCIM driver. | N | N |
| pam. | This event is triggered after an ASA group is created. | N | N |
| pam. | This event is triggered after an ASA group is deleted. | N | N |
| pam. | This event is triggered when an ASA team admin from another team has approved a request to federate identities identities from their team to this team. | N | N |
| pam. | This event is triggered after an ASA team admin submits a request to federate identities from a different team to their team. | N | N |
| pam. | Create an integration in Okta Privileged Access. | N | N |
| pam. | Delete an integration from Okta Privileged Access. | N | N |
| pam. | This event is triggered after a user is added to an ASA group. | N | N |
| pam. | This event is triggered after a user is removed from an ASA group. | N | N |
| pam. | This event is triggered after disconnected mode is disabled for a group. | N | N |
| pam. | This event is triggered after disconnected mode is enabled for a group. | N | N |
| pam. | This event is triggered after disconnected mode credentials are rotated for a group. | N | N |
| pam. | This event is triggered when an ASA team admin from this team has approved a request to federate identities from this team to another team. | N | N |
| pam. | This event is triggered after a user password changed. | N | N |
| pam. | This event is triggered after a user password reset request is submitted. | N | N |
| pam. | This event is triggered after group permissions are updated. | N | N |
| pam. | This event is triggered after a preauthorization is created. | N | N |
| pam. | This event is triggered after a preauthorization is updated. | N | N |
| pam. | This event is triggered after a group is added to a project. | N | N |
| pam. | This event is triggered after a Project is created. | N | N |
| pam. | This event is triggered after a Project is deleted. | N | N |
| pam. | This event is triggered after a group is removed from a project. | N | N |
| pam. | This event is triggered after a Project is updated. | N | N |
| pam. | This event is triggered after server selectors for a group assigned to a project are updated. | N | N |
| pam. | This event is triggered when a resource's checkin process completes or fails to complete. | N | N |
| pam. | This event is triggered when a previously checked out resource has its checkin process started. | N | N |
| pam. | This event is triggered when a resource is checked out. | N | N |
| pam. | This event is triggered after a Resource Group is created. | N | N |
| pam. | This event is triggered after a Resource Group is deleted. | N | N |
| pam. | This event is triggered after a Resource Group is updated. | N | N |
| pam. | This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is created. | N | N |
| pam. | This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is deleted. | N | N |
| pam. | Move a secret to a different folder. | N | N |
| pam. | This event is triggered when the contents of a Secret, such as a password, is revealed to a user. | N | N |
| pam. | This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is updated. | N | N |
| pam. | This event is triggered after a Secret Folder is created. | N | N |
| pam. | This event is triggered after a Secret Folder is deleted. | N | N |
| pam. | This event is triggered after a Secret Folder is updated. | N | N |
| pam. | This event is triggered after a Security Policy is created. | N | N |
| pam. | This event is triggered after a Security Policy is deleted. | N | N |
| pam. | This event is triggered when an operation requires a Security Policy evaluation. | N | N |
| pam. | This event is triggered after a Security Policy is updated. | N | N |
| pam. | This event is triggered after a server running the Okta ASA agent has enrolled with ASA. | N | N |
| pam. | This event is triggered after a server is reassigned from one project to another. | N | N |
| pam. | This event is triggered after a server is removed from the ASA inventory. | N | N |
| pam. | This event is triggered after a user performs an SSH login to a server. | N | N |
| pam. | This event is triggered after a server account is first discovered by the Server Agent. | N | N |
| pam. | Reveal password for a vaulted server account in Okta Privileged Access. | N | N |
| pam. | This event is triggered after a password rotation is requested for a local server account. | N | N |
| pam. | This event is triggered after a server account password is altered via a method other than scheduled rotation. | N | N |
| pam. | This event is triggered after a server reports an attempt to perform a password rotation. | N | N |
| pam. | This event is triggered after a discovered server account is updated. | N | N |
| pam. | This event is triggered after server labels are updated. | N | N |
| pam. | This event is triggered after a service bound to a service user is created on a server. | N | N |
| pam. | This event is triggered after a service is removed from a server. | N | N |
| pam. | Assign a service account to a resource group project. | N | N |
| pam. | Create a service account in Okta Privileged Access. | N | N |
| pam. | Delete a service account in Okta Privileged Access. | N | N |
| pam. | Reveal password for a service account in Okta Privileged Access. | N | N |
| pam. | Update password for a service account in Okta Privileged Access. | N | N |
| pam. | Indicates password rotation completion event. | N | N |
| pam. | Initiate password rotation for a service account. | N | N |
| pam. | Update a service account's details in Okta Privileged Access. | N | N |
| pam. | This event is triggered after a sudo command bundle is created. | N | N |
| pam. | This event is triggered after a sudo command bundle is deleted. | N | N |
| pam. | This event is triggered after a sudo command bundle is updated. | N | N |
| pam. | This event is triggered after a team is created in ASA. | N | N |
| pam. | Delete a team from Okta Privileged Access. | N | N |
| pam. | This event is triggered after team-level group attributes are created. | N | N |
| pam. | This event is triggered after team-level group attributes are deleted. | N | N |
| pam. | This event is triggered after team-level group attributes are updated. | N | N |
| pam. | This event is triggered after an invitation to join a team is sent. | N | N |
| pam. | This event is triggered after project-level group attribute overrides are created. | N | N |
| pam. | This event is triggered after project-level group attribute overrides are deleted. | N | N |
| pam. | This event is triggered after project-level group attribute overrides are updated. | N | N |
| pam. | This event is triggered after project-level user attribute overrides are created. | N | N |
| pam. | This event is triggered after project-level user attribute overrides are deleted. | N | N |
| pam. | This event is triggered after project-level user attribute overrides are updated. | N | N |
| pam. | This event is triggered after team settings are updated. | N | N |
| pam. | This event is triggered after team-level user attributes are created. | N | N |
| pam. | This event is triggered after team-level user attributes are deleted. | N | N |
| pam. | This event is triggered after team-level user attributes are updated. | N | N |
| pam. | This event is triggered after an ASA client is enrolled by using the 'sft fleet enroll' command. | N | N |
| pam. | This event is triggered after a server is created in ASA directly through the API and not by an ASA agent installation. | N | N |
| pam. | This event is triggered after a user is created in ASA. | N | N |
| pam. | This event is triggered after a user is removed from ASA. | N | N |
| pam. | This event is triggered after a user is updated in ASA. | N | N |
| pam. | This event is triggered when an Okta user is authorized and initiates a connection to a server protected by Okta. | N | N |
| pam. | Create a workload connection in Okta Privileged Access. | N | N |
| pam. | Delete a workload connection from Okta Privileged Access. | N | N |
| pam. | Update a workload connection in Okta Privileged Access. | N | N |
| pam. | Create a workload role in Okta Privileged Access. | N | N |
| pam. | Delete a workload role from Okta Privileged Access. | N | N |
| pam. | Update a workload role in Okta Privileged Access. | N | N |
| pam. | Complete verification of a vaulted credential in Okta Privileged Access. | N | N |
| pam. | Start verification of a vaulted credential in Okta Privileged Access. | N | N |
| pam. | Create an integration account rule in Okta Privileged Access. | N | N |
| pam. | Delete an integration account rule from Okta Privileged Access. | N | N |
| pam. | Update an integration account rule in Okta Privileged Access. | N | N |
| pam. | Change the health status of an integration in Okta Privileged Access. | N | N |
| pam. | Update an integration in Okta Privileged Access. | N | N |
| pam. | Create an API key credential on a workload connection in Okta Privileged Access. | N | N |
| pam. | Revoke an API key credential on a workload connection in Okta Privileged Access. | N | N |
| pam. | Complete the rotation of an API key credential on a workload connection in Okta Privileged Access. | N | N |
| pam. | Start the rotation of an API key credential on a workload connection in Okta Privileged Access. | N | N |
| pam. | Cancel an in-progress rotation of an API key credential on a workload connection in Okta Privileged Access. | N | N |
| pam. | Update an API key credential on a workload connection in Okta Privileged Access. | N | N |
pam.active_directory.account_discovery.complete
#Description
The periodic Active Directory account discovery process has completed in Okta Privileged Access. Use this event to determine when the periodic account discovery job of for an Active Directory connection has completed. This event will be fired on success or failure.
References #
pam.active_directory.account_rule.applied
#Description
Account rule applied to AD account import. Use this event to identify and troubleshoot issues with account rules in Active Directory connections. This event is triggered when an Active Directory account rule is applied during account import in Okta Privileged Access. It contains details about the rule, the associated account and any notable outcome from applying the rule to the account.
References #
pam.active_directory.account_rule.update
#Description
Update the Active Directory account assignment rule in Okta Privileged Access. Use this event to determine when an Active Directory account assignment rule has been updated in Okta Privileged Access. This event will be sent when individual rules for an account are created, deleted, or their priority ororder is changed.
References #
pam.active_directory.connection.update
#Description
Update an Active Directory connection status in Okta Privileged Access. Use this event to determine when an Active Directory connection has been updated in Okta Privileged Access. Status values are CONNECTED, DISCONNECTED, or INACTIVE.
References #
pam.ad_connection.create
#Description
This event is triggered after an Active Directory Connection is created for discovering servers in Advanced Server Access.
References #
pam.ad_connection.delete
#Description
This event is triggered after an Active Directory Connection is deleted in Advanced Server Access.
References #
pam.ad_connection.update
#Description
This event is triggered after an Active Directory Connection is updated in Advanced Server Access.
References #
pam.ad_task_settings.create
#Description
This event is triggered after settings that are related to discovering servers in an Active Directory connection are created in Advanced Server Access.
References #
pam.ad_task_settings.delete
#Description
This event is triggered after settings that are related to discovering servers in an Active Directory connection are deleted in Advanced Server Access.
References #
pam.ad_task_settings.update
#Description
This event is triggered after settings that are related to discovering servers in an Active Directory connection are updated in Advanced Server Access.
References #
pam.ad_task_settings.update_schedule
#Description
This event is triggered after the schedule for discovering Active Directory servers is updated in Advanced Server Access.
References #
pam.ad_user_sync_task_settings.activate
#Description
This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is activated. Use this event to monitor activation of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.ad_user_sync_task_settings.create
#Description
This event is triggered after settings that are related to discovering users in an Active Directory connection are created. Use this event to monitor creation of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.ad_user_sync_task_settings.deactivate
#Description
This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is deactivated. Use this event to monitor deactivation of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.ad_user_sync_task_settings.delete
#Description
This event is triggered after the settings for discovering Active Directory users in an Active Directory connection is deleted. Use this event to monitor deletion of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.ad_user_sync_task_settings.update
#Description
This event is triggered after settings that are related to discovering users in an Active Directory connection are updated. Use this event to monitor update of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.ad_user_sync_task_settings.update_schedule
#Description
This event is triggered after the schedule for discovering Active Directory users in an Active Directory connection is updated. Use this event to monitor schedule update of AD User Sync Task Settings objects. This event contains reference to an AD User Sync Task Settings object.
References #
pam.apikey.delete
#Description
This event is triggered after a service user's API key is deleted.
References #
pam.apikey.rotate
#Description
This event is triggered after a service user's API key is rotated.
References #
pam.app.update
#Description
Update the settings for an app connected to Okta Privileged Access. Use this event to track changes to the settings for an app connected to Okta Privileged Access. Changes to the app settings in Okta Privileged Access impact the management of credentials for connected app accounts. This event references the name of the related app and the actor user who performed the update.
References #
pam.auth_token.issue
#Description
This event is triggered when an ASA client has been authenticated and is issued an authentication token with elevated capabilities.
References #
pam.billing_contact.create
#Description
This event is triggered after a billing contact is created for an ASA team. This event is only applicable to legacy ASA customers.
References #
pam.client.assign
#Description
This event is triggered after an ASA client is assigned to an ASA user.
References #
pam.client.enroll
#Description
This event is triggered after an ASA client is enrolled with ASA.
References #
pam.client.remove
#Description
This event is triggered after an ASA client is removed from a team.
References #
pam.client.state.update
#Description
This event is triggered after the state of an ASA client is updated.
References #
pam.client_enrollment_policies.create
#Description
This event is triggered after an ASA client enrollment policy is created.
References #
pam.client_enrollment_policies.delete
#Description
This event is triggered after an ASA client enrollment policy is deleted.
References #
pam.client_enrollment_policies.update
#Description
This event is triggered after an ASA client enrollment policy is updated.
References #
pam.client_enrollment_policy_token.delete
#Description
This event is triggered after an ASA client enrollment token is deleted.
References #
pam.client_enrollment_policy_token.rotate
#Description
This event is triggered after an ASA client enrollment token is rotated.
References #
pam.cloud_account.create
#Description
This event is triggered after a project cloud account is created for importing servers into ASA.
References #
pam.cloud_account.delete
#Description
This event is triggered after a cloud account has been removed from a project.
References #
pam.cloud_account.update
#Description
This event is triggered after a cloud account, which is used for importing servers into ASA, is updated.
References #
pam.entitlement_sudo.add_to_project
#Description
This event is triggered after a sudo entitlement object is added to a project.
References #
pam.entitlement_sudo.create
#Description
This event is triggered after a sudo entitlement object is created.
References #
pam.entitlement_sudo.remove
#Description
This event is triggered after a sudo entitlement object is removed.
References #
pam.entitlement_sudo.remove_from_project
#Description
This event is triggered after a sudo entitlement object is removed from a project.
References #
pam.entitlement_sudo.update
#Description
This event is triggered after a sudo entitlement object is updated.
References #
pam.gateway.setup_token.create
#Description
This event is triggered after a gateway setup token is created.
References #
pam.gateway.setup_token.delete
#Description
This event is triggered after a gateway setup token is deleted.
References #
pam.gateway.setup_token.update
#Description
This event is triggered after a gateway setup token is updated.
References #
pam.gateway.update
#Description
This event is triggered after settings are updated on an ASA gateway.
References #
pam.gateway_creds.issue
#Description
This event is triggered after the gateway issues credentials for a server.
References #
pam.group.bulk_membership_change
#Description
This event is triggered after the members belonging to an ASA group were updated in bulk by a SCIM driver.
References #
pam.incoming_federation.request
#Description
This event is triggered after an ASA team admin submits a request to federate identities from a different team to their team. This event is only applicable to legacy ASA customers.
References #
pam.integration.create
#Description
Create an integration in Okta Privileged Access. Use this event to verify that an integration has been created in Okta Privileged Access. For example, when a MySQL database integration is created.
References #
pam.integration.delete
#Description
Delete an integration from Okta Privileged Access. Use this event to verify that an integration has been removed from Okta Privileged Access. For example, when a MySQL database integration is deleted.
References #
pam.member.add
#Description
This event is triggered after a user is added to an ASA group.
References #
pam.member.remove
#Description
This event is triggered after a user is removed from an ASA group.
References #
pam.offline_disabled_event
#Description
This event is triggered after disconnected mode is disabled for a group.
References #
pam.offline_enabled_event
#Description
This event is triggered after disconnected mode is enabled for a group.
References #
pam.offline_group.secrets.rotate
#Description
This event is triggered after disconnected mode credentials are rotated for a group.
References #
pam.outgoing_federation.approve
#Description
This event is triggered when an ASA team admin from this team has approved a request to federate identities from this team to another team. Only applicable to legacy ASA customers.
References #
pam.password.change
#Description
This event is triggered after a user password changed. This event is only applicable to legacy ASA customers.
References #
pam.password.reset
#Description
This event is triggered after a user password reset request is submitted. This event is only applicable to legacy ASA customers.
References #
pam.permission.change
#Description
This event is triggered after group permissions are updated.
References #
pam.project.add_group
#Description
This event is triggered after a group is added to a project.
References #
pam.project.create
#Description
This event is triggered after a Project is created. For ASA, this event only contains the Project name. For Okta Privileged Access, this event contains the Project name and the associated Resource Group.
References #
pam.project.delete
#Description
This event is triggered after a Project is deleted. For ASA, this event only contains the Project name. For Okta Privileged Access, this event contains the Project name and the associated Resource Group.
References #
pam.project.remove_group
#Description
This event is triggered after a group is removed from a project.
References #
pam.project.update
#Description
This event is triggered after a Project is updated. Only applicable for Okta Privileged Access. This event contains the Project name and the associated Resource Group.
References #
pam.project_group_selector.update
#Description
This event is triggered after server selectors for a group assigned to a project are updated.
References #
pam.resource.checkin.end
#Description
This event is triggered when a resource's checkin process completes or fails to complete. Monitor 'FAILED' outcomes of this event to identify resources that may be unavailable for checkout due to an incomplete checkin. This event contains details of the original checkout and, if a failure occurred, the reason why the checkin failed.
References #
pam.resource.checkin.start
#Description
This event is triggered when a previously checked out resource has its checkin process started. Use this event to identify when a user's exclusive access to a resource has ended. This event contains details of the original checkout and the user who checked it in.
References #
pam.resource.checkout
#Description
This event is triggered when a resource is checked out. Use this event to identify the exclusive access to resources. This event contains details of the resource and the user who checked it out.
References #
pam.resource_group.create
#Description
This event is triggered after a Resource Group is created. Monitor this event to be notified when new teams in your Okta org begin using Okta Privileged Access. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator has created a new Resource Group to manage resources.
References #
pam.resource_group.delete
#Description
This event is triggered after a Resource Group is deleted. Monitor this event to be notified when a team in your Okta org stops managing access to a resource. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator deleted a Resource Group.
References #
pam.resource_group.update
#Description
This event is triggered after a Resource Group is updated. Monitor this event to be notified when Resource Group settings change. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator has modified the settings for a Resource Group.
References #
pam.secret.create
#Description
This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is created. Use this event to identify the creation of a Secret. For example, creating a Secret at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret and an Actor. The Actor is the User that created the Secret.
References #
pam.secret.delete
#Description
This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is deleted. Use this event to identify the deletion of an existing Secret. For example, deleting a Secret at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret and an Actor. The Actor is the User that deleted the Secret.
References #
pam.secret.move
#Description
Move a secret to a different folder. Use this event to identify the relocation of a secret. Moving a secret at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the source and destination paths and the actor. The actor is the user that moved the secret.
References #
pam.secret.reveal
#Description
This event is triggered when the contents of a Secret, such as a password, is revealed to a user. Use this event to identify the access of a Secret. For example, accessing a Secret at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret and an Actor. The Actor is the User that revealed the Secret.
References #
pam.secret.update
#Description
This event is triggered when a Secret, such as a password, stored in the Okta Privileged Access Vault is updated. Use this event to identify an update to an existing Secret. For example, updating a Secret at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret and an Actor. The Actor is the User that updated the Secret.
References #
pam.secret_folder.create
#Description
This event is triggered after a Secret Folder is created. Secret Folders are containers used to organize and store Secrets. Use this event to identify the creation of a Secret Folder. For example, creating a Secret Folder at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret Folder and an Actor. The Actor is the User that created the Secret Folder.
References #
pam.secret_folder.delete
#Description
This event is triggered after a Secret Folder is deleted. Secret Folders are containers used to organize and store Secrets. Use this event to identify the deletion of an existing Secret Folder. For example, deleting a Secret Folder at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret Folder and an Actor. The Actor is the User that deleted the Secret Folder.
References #
pam.secret_folder.update
#Description
This event is triggered after a Secret Folder is updated. Secret Folders are containers used to organize and store Secrets. Use this event to identify an update to an existing Secret Folder. For example, updating a Secret Folder at an unusual time or outside of a standard process may be of interest to security analysts. Each event of this type references the name of the related Secret Folder and an Actor. The Actor is the User that updated the Secret Folder.
References #
pam.security_policy.create
#Description
This event is triggered after a Security Policy is created. Use this event to determine when Security Administrators create new Security Policies. Only applicable for Okta Privileged Access. This event contains the Principals associated with the Security Policy and the number of rules in the policy.
References #
pam.security_policy.delete
#Description
This event is triggered after a Security Policy is deleted. Use this event to indicate that a policy that was previously in place is no longer active and end user access to resources may be changed. Only applicable for Okta Privileged Access. This event contains the Principals associated with the Security Policy and the number of rules in the policy.
References #
pam.security_policy.evaluate
#Description
This event is triggered when an operation requires a Security Policy evaluation. Use this event to understand how Security Policies are utilized to control access to resources. Currently, this event is only triggered when a user isn't authorized to perform an operation due to existing Security Policies.
References #
pam.security_policy.update
#Description
This event is triggered after a Security Policy is updated. Use this event to determine when Security Administrators update Security Policies and to identify important changes made to policies. Only applicable for Okta Privileged Access. This event contains the Principals associated with the Security Policy and the number of rules in the policy.
References #
pam.server.enroll
#Description
This event is triggered after a server running the Okta ASA agent has enrolled with ASA.
References #
pam.server.reassign
#Description
This event is triggered after a server is reassigned from one project to another.
References #
pam.server.remove
#Description
This event is triggered after a server is removed from the ASA inventory.
References #
pam.server.ssh_login
#Description
This event is triggered after a user performs an SSH login to a server.
References #
pam.server_account.discovered
#Description
This event is triggered after a server account is first discovered by the Server Agent. Only applicable for Okta Privileged Access. This event contains the name of the discovered account and the associated server.
References #
pam.server_account.password.reveal
#Description
Reveal password for a vaulted server account in Okta Privileged Access. Use this event to identify for which vaulted server account the Okta Privileged Access user revealed the password. Contains the details on the user access method the user used to reveal the password for the vaulted server account.
References #
pam.server_account.password_change.initiated
#Description
This event is triggered after a password rotation is requested for a local server account. Use this event to verify that the password settings are being correctly applied to your servers. This event contains the name of the local server account being modified and the associated server.
References #
pam.server_account.password_change.out_of_band
#Description
This event is triggered after a server account password is altered via a method other than scheduled rotation. You MUST monitor this event to ensure that unauthorized users are not attempting to reset local server account passwords in an attempt to gain access to servers. Only applicable for Okta Privileged Access. This event contains the modified server account and the associated server.
References #
pam.server_account.password_change.update
#Description
This event is triggered after a server reports an attempt to perform a password rotation. The outcome.result field contains either 'SUCCESS' or 'FAILURE' and should be monitored to detect any password rotation errors. Only applicable for Okta Privileged Access. This event contains the name of the local server account, the associated server, and indicates if the rotation was successful.
References #
pam.server_account.update
#Description
This event is triggered after a discovered server account is updated. Use this event to observe how often the system updates server accounts. Only applicable for Okta Privileged Access. This event contains the name of the updated account and the associated server.
References #
pam.server_labels.update
#Description
This event is triggered after server labels are updated.
References #
pam.service.remove
#Description
This event is triggered after a service is removed from a server.
References #
pam.service_account.assign
#Description
Assign a service account to a resource group project. Use this event to determine when a service account has been brought under active management in Okta Privileged Access. This event contains the resource group and project IDs to which the service account was assigned.
References #
pam.service_account.create
#Description
Create a service account in Okta Privileged Access. Use this event to verify when a service account has successfully created in Okta Privileged Access. This event is emitted for service accounts across resource types, including Universal Directory accounts and database accounts onboarded to Okta Privileged Access management. For Universal Directory accounts, the outcome result can be SUCCESS or FAILURE. For third-party app service accounts, the outcome result can be SUCCESS, FAILURE, or DEFERRED.
References #
pam.service_account.delete
#Description
Delete a service account in Okta Privileged Access. Use this event to verify when a service account has successfully deleted in Okta Privileged Access. This event is emitted for service accounts across resource types, including Universal Directory accounts and database accounts off-boarded from Okta Privileged Access management. The outcome result can be SUCCESS or FAILURE.
References #
pam.service_account.password.reveal
#Description
Reveal password for a service account in Okta Privileged Access. Use this event to identify for which account the Okta Privileged Access user revealed the password. Contains the details on the user access method the user used to reveal the password.
References #
pam.service_account.password.update
#Description
Update password for a service account in Okta Privileged Access. Use this event to identify for which account the Okta Privileged Access user updated the password. Contains the details on the user access method the user used to update the password.
References #
pam.service_account.password_rotation.end
#Description
Indicates password rotation completion event. Use this event to determine the final status of a password rotation for a given service account. The outcome result can be SUCCESS, FAILURE or DEFERRED, based on settings and retry mechanisms in Okta Privileged Access.
References #
pam.service_account.password_rotation.start
#Description
Initiate password rotation for a service account. Use this event to determine when password rotation for a given service account has begun. The outcome result can be SUCCESS or FAILURE. The outcome reason can be ASSIGNMENT, FORCED, CHECKIN or SCHEDULED, based on the password rotation trigger.
References #
pam.service_account.update
#Description
Update a service account's details in Okta Privileged Access. Use this event to verify when a service account has successfully updated in Okta Privileged Access. This event is emitted for Universal Directory service accounts.
References #
pam.sudo_command_bundle.create
#Description
This event is triggered after a sudo command bundle is created. Use this event to determine when Resource Administrators create a new Sudo Command Bundle. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator has created a new sudo command bundle.
References #
pam.sudo_command_bundle.delete
#Description
This event is triggered after a sudo command bundle is deleted. Use this event to determine when Resource Administrators delete an existing Sudo Command Bundle. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator has deleted a sudo command bundle.
References #
pam.sudo_command_bundle.update
#Description
This event is triggered after a sudo command bundle is updated. Use this event to determine when Resource Administrators update an existing Sudo Command Bundle. Only applicable for Okta Privileged Access. This event defines when a Resource Administrator has updated a new sudo command bundle.
References #
pam.team.delete
#Description
Delete a team from Okta Privileged Access. Audit the permanent removal of a team from Okta Privileged Access. This event is emitted by the automated expired-tenant cleanup job after a team transitions through INACTIVE and DELETING. Includes the team_id and team_name fields, mirroring pam.team.create.
References #
pam.team_group_attribute.create
#Description
This event is triggered after team-level group attributes are created.
References #
pam.team_group_attribute.delete
#Description
This event is triggered after team-level group attributes are deleted.
References #
pam.team_group_attribute.update
#Description
This event is triggered after team-level group attributes are updated.
References #
pam.team_invitation.create
#Description
This event is triggered after an invitation to join a team is sent. This event is only applicable to legacy ASA customers.
References #
pam.team_project_group_attribute.create
#Description
This event is triggered after project-level group attribute overrides are created.
References #
pam.team_project_group_attribute.delete
#Description
This event is triggered after project-level group attribute overrides are deleted.
References #
pam.team_project_group_attribute.update
#Description
This event is triggered after project-level group attribute overrides are updated.
References #
pam.team_project_user_attribute.create
#Description
This event is triggered after project-level user attribute overrides are created.
References #
pam.team_project_user_attribute.delete
#Description
This event is triggered after project-level user attribute overrides are deleted.
References #
pam.team_project_user_attribute.update
#Description
This event is triggered after project-level user attribute overrides are updated.
References #
pam.team_settings.update
#Description
This event is triggered after team settings are updated.
References #
pam.team_user_attribute.create
#Description
This event is triggered after team-level user attributes are created.
References #
pam.team_user_attribute.delete
#Description
This event is triggered after team-level user attributes are deleted.
References #
pam.team_user_attribute.update
#Description
This event is triggered after team-level user attributes are updated.
References #
pam.unbound_client.enroll
#Description
This event is triggered after an ASA client is enrolled by using the 'sft fleet enroll' command.
References #
pam.unmanaged_server.create
#Description
This event is triggered after a server is created in ASA directly through the API and not by an ASA agent installation.
References #
pam.user_creds.issue
#Description
This event is triggered when an Okta user is authorized and initiates a connection to a server protected by Okta.
References #
pam.workload_connection.create
#Description
Create a workload connection in Okta Privileged Access. Use this event to identify when a new Root of Trust is configured to validate requests from an external workload provider, such as a cloud service. A workload connection defines the external issuer and the method for validating its signature or claims, enabling the authentication of non-human identities.
References #
pam.workload_connection.delete
#Description
Delete a workload connection from Okta Privileged Access. Use this event to identify when Okta can't validate requests from a specific external source anymore, revoking trust in that connection. Okta recommends monitoring workload connection deletions, as they can disrupt access for all workloads that were previously authenticated using that specific root of trust. This event references the name of the connection and the actor user who performed the deletion.
References #
pam.workload_connection.update
#Description
Update a workload connection in Okta Privileged Access. Use this event to identify changes to the validation configuration, such as updates to a validation URL, a certificate, or an issuer claim. Changes to this entity are considered high-risk, as they directly impact which external non-human identities your platform trusts and validates. This event references the name of the related connection and the actor user who updated it.
References #
pam.workload_role.create
#Description
Create a workload role in Okta Privileged Access. Use this event to identify the creation of an authorization group for non-human identities. This group maps specific claims to a workload role. A workload role specifies the required claim and its associated workload connection. Admins add a workload role to a policy to grant access for non-human entities.
References #
pam.workload_role.delete
#Description
Delete a workload role from Okta Privileged Access. Use this event to identify the removal of an authorization pathway for non-human identities. Workload identities with a deleted role immediately lose access to protected secrets or accounts. This event references the name of the related role and the actor user who deleted it.
References #
pam.workload_role.update
#Description
Update a workload role in Okta Privileged Access. Use this event to track changes to the authorization criteria of a role, such as edits to the required claim value or the associated workload connection. Changes to the workload role definition affect which non-human identities are eligible for access within the referencing policies. This event references the name of the related role and the actor user who performed the role update.
References #
pam.credential_verification.end
#Description
Complete verification of a vaulted credential in Okta Privileged Access. Use this event to determine the final result of a credential verification and to detect accounts whose vaulted credential has drifted out of sync with the target system. The outcome result is SUCCESS when the vaulted credential matches the target system, FAILURE when it is out of sync, or UNKNOWN when the check couldn't be completed. The outcome reason can be ON_DEMAND or SCHEDULED.
References #
pam.credential_verification.start
#Description
Start verification of a vaulted credential in Okta Privileged Access. Use this event to determine when the credential verification for a given account has begun. The credential verification tests whether the account's vaulted credential still authenticates against the target system. The outcome result is always SUCCESS. The outcome reason can be ON_DEMAND or SCHEDULED, based on what triggered the check.
References #
pam.integration.account_rule.create
#Description
Create an integration account rule in Okta Privileged Access. Use this event to track when account onboarding rules are added, to audit which database accounts are being brought under Okta Privileged Access management, detect unauthorized changes to security policy configuration, and support compliance reviews. Use this event to track when account onboarding rules are added, to audit which database accounts are being brought under Okta Privileged Access management.
References #
pam.integration.account_rule.delete
#Description
Delete an integration account rule from Okta Privileged Access. Use this event to track when account onboarding rules are removed, to audit which database accounts are no longer being brought under Okta Privileged Access management, detect unauthorized changes to security policy configuration, and support compliance reviews. Use this event to track when account onboarding rules are removed, to audit which database accounts are no longer managed by Okta Privileged Access.
References #
pam.integration.account_rule.update
#Description
Update an integration account rule in Okta Privileged Access. Use this event to track when account onboarding rules are modified, to audit changes to which database accounts are brought under Okta Privileged Access management, detect unauthorized changes to security policy configuration, and support compliance reviews. Use this event to track when account onboarding rules are modified, to audit changes to which database accounts are brought under Okta Privileged Access management.
References #
pam.integration.health_change
#Description
Change the health status of an integration in Okta Privileged Access. Use this event to monitor the availability of database integrations managed by Okta Privileged Access, diagnose access disruptions, and audit an integration's operational state over time. This event is published when the health status of a database integration transitions (for example, from Active to TemporaryOutage).
References #
pam.integration.update
#Description
Update an integration in Okta Privileged Access. Use this event to verify that an integration has been updated in Okta Privileged Access. For example, when a MySQL database integration's description is changed.
References #
pam.workload_connection.api_key.create
#Description
Create an API key credential on a workload connection in Okta Privileged Access. Use this event to detect the issuance of a new API key credential to a non-human identity, and to alert on unauthorized or unexpected credential creation. An API key is issued against an API key type workload connection and lets a non-human identity authenticate to Okta Privileged Access. This event references the credential ID, the parent workload connection, and the actor user who created the key. The secret material is never included.
References #
pam.workload_connection.api_key.revoke
#Description
Revoke an API key credential on a workload connection in Okta Privileged Access. Use this event to detect the invalidation of a workload credential, confirm containment after a suspected key compromise, and correlate sudden authentication failures for a workload. A revoked API key can't be restored or updated, so the non-human identity that uses it loses access immediately. This event references the credential ID, the parent workload connection, and the actor user who revoked the key.
References #
pam.workload_connection.api_key.rotation.activate
#Description
Complete the rotation of an API key credential on a workload connection in Okta Privileged Access. Use this event to confirm that a rotation finished and that the previous secret is no longer accepted. Correlate it with authentication failures for workloads that weren't updated with the successor secret. This event promotes the successor secret to active and expires the previous one, closing a rotation opened by pam.workload_connection.api_key.rotation.create. A FAILURE outcome can indicate that the key isn't in a rotating state.
References #
pam.workload_connection.api_key.rotation.create
#Description
Start the rotation of an API key credential on a workload connection in Okta Privileged Access. Use this event to verify that API keys are rotated on the expected cadence, and to find rotations that were started but never completed. Rotation issues a successor secret while the previous secret stays valid, so the workload can be updated without an outage. The rotation is closed by either pam.workload_connection.api_key.rotation.activate or pam.workload_connection.api_key.rotation.delete.
References #
pam.workload_connection.api_key.rotation.delete
#Description
Cancel an in-progress rotation of an API key credential on a workload connection in Okta Privileged Access. Use this event to identify rotations that were abandoned, so you can confirm that the workload still uses the original secret and reschedule the rotation. This event discards the successor secret and keeps the previous secret active, closing a rotation opened by pam.workload_connection.api_key.rotation.create. This event references the credential ID, the parent workload connection, and the actor user who canceled the rotation.
References #
pam.workload_connection.api_key.update
#Description
Update an API key credential on a workload connection in Okta Privileged Access. Use this event to track changes to an API key's name, description, or attributes, and to audit who modified a workload credential. This event covers metadata changes only and doesn't rotate or regenerate the secret. A FAILURE outcome can indicate an attempt to update a revoked key. This event references the credential ID, the parent workload connection, and the actor user who made the change.