Okta PKI
| eventType | Description | Sample | Rule |
|---|---|---|---|
| pki. | Triggered when an admin creates an Okta CA (ROOT or Intermediate certs) or uploads a 3rd party certificate chain. | N | N |
| pki. | Triggered when an admin deletes a 3rd party certificate chain. | N | N |
| pki. | Warn about approaching third-party CA certificate expiration. | N | N |
| pki. | Triggered when one or more certificates that belong to a certificate authority are renewed. | N | N |
| pki. | Update Certificate Authority to scope mapping. | N | N |
| pki. | Triggered when a certificate is bound to a device. | Y | N |
| pki. | A failure outcome indicates that there was an issue downloading the Certificate Revocation List (CRL) from the URL specified in the certificate and may require action to address it. | N | N |
| pki. | Device Trust certificate issuance. | N | N |
| pki. | Triggered when a certificate marked as hold is removed from the CRL or when renewed Okta CA certificates marked as inactive are activated. | N | N |
| pki. | Triggered when a certificate is deleted as a result of an admin deleting the binding device. | N | N |
| pki. | Triggered when a certificate is temporarily on hold and appears on CRL. | N | N |
| pki. | Triggered when a certificate is revoked and appears on CRL. | N | N |
| pki. | Triggered when a certificate is suspended as a result of an admin deactivating the binding device. | N | N |
| pki. | Triggered when a Device Trust certificate is renewed. | N | N |
| pki. | Device Trust certificate revocation. | N | N |
pki.ca.add
#Description
Triggered when an admin creates an Okta CA (ROOT or Intermediate certs) or uploads a 3rd party certificate chain. You can use the event to audit the Okta CA or 3rd party certificate authority status change. When triggered, the Okta CA or 3rd party certificate authority will appear in the Admin Console.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.ca.delete
#Description
Triggered when an admin deletes a 3rd party certificate chain. You can use the event to audit the 3rd party certificate authority status change. When triggered, the 3rd party certificate authority is no longer available to the org.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.ca.expiration.warn
#Description
Warn about approaching third-party CA certificate expiration. Monitor certificate expiration timelines to proactively rotate third-party CA certificates and avoid FastPass authentication failures when strict enforcement begins. Fires at 6-month, 3-month, and 1-month intervals before the enforcement deadline. The target resource identifies the specific certificate. Use outcome.reason to filter by urgency interval (EXPIRING_6_MONTHS, EXPIRING_3_MONTHS, EXPIRING_1_MONTH).
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.ca.renew
#Description
Triggered when one or more certificates that belong to a certificate authority are renewed. Use to audit certificate renewals that belong to a certificate authority. You can also use it as a notification to download the renewed certificates. When triggered, this event includes the old certificates and the new certificate replacements.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.ca.scope.mapping.update
#Description
Update Certificate Authority to scope mapping. Use this event to monitor when the Certificate Authority to scope mappings are updated for a given scope, including which CAs were added or removed. The details of what changed in the mapping are included in the event, capturing the scope and the CA IDs that were previously saved and the CA IDs that will now be saved.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.bind
#Description
Triggered when a certificate is bound to a device. You can use the event to audit certificate device binding relationship. When triggered, the device appears in the Admin Console as managed device.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.Example System Log Event #
{
"published": 1782502480574,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000072",
"actor": {
"id": "spr00000000000000167",
"type": "SystemPrincipal",
"alternateId": "user41@dw-harness.example",
"displayName": "Okta System",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
"os": "Mac OS 15.6.1 (Sequoia)",
"browser": "CHROME"
},
"zone": "null",
"device": "Computer",
"id": null,
"ipAddress": "192.0.2.19",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": {
"id": null,
"name": null,
"os_platform": null,
"os_version": null,
"managed": null,
"registered": null,
"device_integrator": {
"DEVICE_IDP": {}
},
"disk_encryption_type": null,
"screen_lock_type": null,
"jailbreak": null,
"secure_hardware_present": null
},
"events": null,
"target": [
{
"id": "guo00000000000000262",
"type": "UDDevice",
"alternateId": "user06@dw-harness.example",
"displayName": "DW Harness 85",
"detailEntry": {
"oktaDeviceId": "guo00000000000000262",
"serialNumber": "0000000002",
"osVersion": "15.6.1",
"managed": "false",
"osPlatform": "MACOS",
"udid": "00000000-0000-0000-0000-000000000073",
"tpmPresent": "false",
"deviceStatus": "ACTIVE"
}
},
{
"id": "cci00000000000000263",
"type": "ThirdPartyCertificate",
"alternateId": "user06@dw-harness.example",
"displayName": "DW Harness 86",
"detailEntry": {
"certStatus": "ACTIVE",
"certName": "user60@dw-harness.example",
"issuerName": "Example Issuer 1"
}
}
],
"outcome": {
"result": "SUCCESS",
"reason": null
},
"request": {
"ipChain": [
{
"ip": "192.0.2.19",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"version": "0",
"severity": "INFO",
"eventType": "pki.cert.bind",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000037",
"detail": {}
},
"debugContext": {
"debugData": {
"authnRequestId": "00000000000000000000000000000038",
"behaviors": "{New Geo-Location=UNKNOWN, New Device=UNKNOWN, New ASN=UNKNOWN, New IP=UNKNOWN, New State=UNKNOWN, New Country=UNKNOWN, Velocity=UNKNOWN, New City=UNKNOWN}",
"requestId": "00000000000000000000000000000037",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000021",
"origin": "https://app.example.com",
"risk": "{reasons=Anomalous Location, Anomalous Device, level=HIGH}",
"requestUri": "/idp/idx/authenticators/poll",
"threatSuspected": "false",
"url": "/idp/idx/authenticators/poll?"
}
},
"displayMessage": "Bind client certificate to device",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
},
"risk": {
"level": "HIGH",
"reasons": [
"Anomalous Location",
"Anomalous Device"
]
},
"userBehaviors": [
{
"name": "New ASN",
"id": "bhv00000000000000155",
"result": "UNKNOWN"
},
{
"name": "New IP",
"id": "bhv00000000000000156",
"result": "UNKNOWN"
},
{
"name": "New State",
"id": "bhv00000000000000157",
"result": "UNKNOWN"
},
{
"name": "New Country",
"id": "bhv00000000000000158",
"result": "UNKNOWN"
},
{
"name": "New Geo-Location",
"id": "bhv00000000000000159",
"result": "UNKNOWN"
},
{
"name": "New Device",
"id": "bhv00000000000000160",
"result": "UNKNOWN"
},
{
"name": "Velocity",
"id": "bhv00000000000000161",
"result": "UNKNOWN"
},
{
"name": "New City",
"id": "bhv00000000000000162",
"result": "UNKNOWN"
}
]
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "idx00000000000000264",
"externalSessionId": "idx00000000000000264"
}
}
References #
pki.cert.crl_download_failure
#Description
A failure outcome indicates that there was an issue downloading the Certificate Revocation List (CRL) from the URL specified in the certificate and may require action to address it. When an administrator observes a pki.cert.lifecycle.crl_download_failure event with a failure outcome they should ensure that the CRL endpoint is up and running properly and has not been changed by the issuing Certificate Authority (CA). When fired, this event will include the URL of the CRL that is having an issue along with a corresponding HTTP error code.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.lifecycle.activate
#Description
Triggered when a certificate marked as hold is removed from the CRL or when renewed Okta CA certificates marked as inactive are activated. You can use the event to audit certificate lifecycle change. When an admin activates/unsuspends a device, the certificate associated with the device is activated when used in the next Okta Verify flow. Additionally when an admin or activation job activates an inactive certificate it can then be used to issue client certificates in SCEP.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.lifecycle.delete
#Description
Triggered when a certificate is deleted as a result of an admin deleting the binding device. You can use the event to audit certificate lifecycle change. When triggered, the certificate no longer appears in the Admin Console.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.lifecycle.hold
#Description
Triggered when a certificate is temporarily on hold and appears on CRL. You can use the event to audit certificate lifecycle change. A certificate on hold can be activated after it is removed from CRL.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.lifecycle.revoke
#Description
Triggered when a certificate is revoked and appears on CRL. You can use the event to audit certificate lifecycle change. Once revoked, a certificates can not be activated.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #
pki.cert.lifecycle.suspend
#Description
Triggered when a certificate is suspended as a result of an admin deactivating the binding device. You can use the event to audit certificate lifecycle change. When triggered, the certificate can not be used to send the management hint.
Only generated on Okta Identity Engine (OIE) orgs, not Classic Engine (Okta Classic) orgs.References #