Okta Support
| eventType | Description | Sample | Rule |
|---|---|---|---|
| support. | Okta has updated the configuration or data within the Org. | N | N |
| support. | Okta has viewed a page which contains customer data. | Y | N |
support.org.update
#Description
Okta has updated the configuration or data within the Org. This can be used to identify modifications to an Org which are the result of an action by an Okta staff member. Such actions are typically taken in response to a customer request, such as request to enable an Early Access feature. In some cases, these actions may be the result of a review initiated by Okta, such as a review in response to a production service alert. See the supportAction object within the debugContext.debugData objection for more information about the type of update.
References #
support.org.view
#Description
Okta has viewed a page which contains customer data. This can be used to identify an action taken by an Okta staff member in the support tool which resulted in a view of customer data. Such actions are typically taken in response to a customer request, such as in the process of investigating an issue raised through a support case. In some cases, these actions may be the result of a review initiated by Okta, such as a review in response to a production service alert. See the supportAction object within the debugContext.debugData objection for more information about the type of update.
Example System Log Event #
{
"published": 1784663669951,
"id": null,
"etag": null,
"kind": null,
"uuid": "00000000-0000-0000-0000-000000000083",
"actor": {
"id": "00u00000000000000285",
"type": "User",
"alternateId": "user64@dw-harness.example",
"displayName": "DW Harness 97",
"detailEntry": null
},
"client": {
"userAgent": null,
"zone": null,
"device": null,
"id": null,
"ipAddress": null,
"geographicalContext": null
},
"device": null,
"events": null,
"target": [
{
"id": "00o00000000000000286",
"type": "Org",
"alternateId": "user06@dw-harness.example",
"displayName": "DW Harness 98",
"detailEntry": null
}
],
"outcome": null,
"request": {
"ipChain": []
},
"version": "0",
"severity": "DEBUG",
"eventType": "support.org.view",
"ipAddress": null,
"networkInfo": null,
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000044",
"detail": {}
},
"debugContext": {
"debugData": {
"supportaction": {
"id": "00000000-0000-0000-0000-000000000084",
"type": "VIEW_GROUPS",
"description": "View all Groups",
"supportActionReason": {
"detail": "View all Groups",
"type": "OKTA_INITIATED_REVIEW"
}
}
}
},
"displayMessage": "Okta initiated org view",
"gatewayContext": null,
"legacyEventType": null,
"resourceDetails": null,
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": null,
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp"
}
},
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "idx00000000000000287",
"externalSessionId": "idx00000000000000287"
}
}