@SarahS.89561 (Customer)​  -- I don't have much to give you here as this question is probably better posted into the "Devices" subcategory and not Workflows.

Looking at the event catalog documentation found here:

https://developer.okta.com/docs/reference/api/event-types/#catalog

We see there is a new event with OIE (devices in general are OIE only) named:

pki.cert.bind

Triggered when a certificate is bound to a device. You can use the event to audit certificate device binding relationship. When triggered, the device appears in the Admin Console as managed device.

This is not an event-hook-eligible event which means you would first need to confirm this event contains the data you are looking for by doing some testing. Once you have confirmed you could then setup a scheduled flow that does a "look-back" for new records of that event in the system log.

So something like this: (note: I have no way to setup/test this for this specific use case. This is just a general how-to leverage scheduled flow to pull non-event-hook-eligible event data in a consistent way)

• table) -- Table has one column and just has a single date/time value
• flow 1) -- Parent flow, Starts on a schedule and runs repeatedly. The flow contains a "now" card to get the current "until" date. It contains a search table to pull the previously stored date "the since". An update table is then ran to update the table with the new value. A query is then made against the System log for the event in question. All results will be passed to a Helper flow for processing.
• flow 2) Performs processing on the event data to do the action you want accomplished.