FranciscoN.75394 (Customer) asked a question.
Hello there,
We want to forward Okta security logs to our SIEM solution (https://wazuh.com/).
This SIEM accepts syslog connections for log forwarding on port 514. Another available option for data collection is to upload the logs to AWS S3 and make the SIEM read from there or to setup some background job to collect the logs from an API/endpoint.
We've found there is an integration with AWS that allows us to forward Okta logs to Eventbridge, and we were considering using Kineses/Firehose to write the logs to the S3 bucket to be treated by the SIEM.
Before proceeding with this option, I wanted to double-check with the community in case someone has come up with a better solution. I don't want to make it too complex, so writing a job to retrieve data from Okta API looks a bit overkill to me, but maybe I am wrong, and it is a better solution.
What do you think? Have you done something similar in the past, how?
Hi, @FranciscoN.75394 (Customer)
Thank you for posting on our Community page!
Here is a helpful article on that: https://support.okta.com/help/s/article/Exporting-Okta-Log-Data
We will leave the question open for other users to share their experience as well.
Thank you for reaching out to our Community and have a great day!
_____________________________________________________________________________
Community members help others by clicking Like or Select as Best on responses. Try it today.
_____________________________________________________________________________