Okta Integration Discovered Resources

Ingested Resources & Properties

Users (user)

Property	Description
name	The Okta profile email, or the profile login when the user has no email (primary identifier)
email_address	Same value as name. For a login-only profile this holds the login, which is not necessarily an email address
label	Display name from the Okta profile (displayName, or first + last name, falling back to the name value)

Okta profiles without an email fall back to the login for both name and email_address. Okta logins are usually email-shaped, but they do not have to be, so email_address may hold a non-email value. Users whose profile has neither an email nor a login are not observed.

User Groups (user_group)

Property	Description
name	Group name from the Okta profile
subtype	Always okta for groups observed from this integration
native_id	Okta group ID
created_at	When the group was created in Okta

Relationships

Source type(s)	Relationship	Target type(s)	Notes
user_group	has member	user	Direct Okta group members. Nested groups are not included.
user	has group	user_group	Inverse of has member.

EQL examples:

# Groups that include a user
type = "user_group" and has member(uri="user_account.jane.doe_at_example.com")

# Users in a group
type = "user" and has group(uri="user_group.00gz751533qdcfa7h697")

Nested groups are not currently supported as membership edges. Every Okta group is still observed as its own user_group.

Resource URIs

User URIs are built from the same email-or-login value as name, with @ replaced by _at_ and the result lowercased. Group members use the same rule.

user_account.<EMAIL_OR_LOGIN_WITH_AT_REPLACED>

Examples:

• user_account.jane.doe_at_example.com

• user_account.admin_at_company.com

• user_account.svc_reporting (a login-only profile with no @)

Group URIs use the Okta group ID:

user_group.<OKTA_GROUP_ID>

Examples:

• user_group.00gz751533qdcfa7h697

• user_group.00gz751534gldauee697