OKTA Reporting, Troubleshooting and Administration Flashcards

Where in the Okta Admin Console can administrators find a searchable log of all events that occur in the Okta tenant?

Answer: Reports > System Log

The System Log under Reports records every event in the Okta tenant — authentications, policy changes, provisioning events — and is searchable by event type, actor, and time.

What query language does Okta's System Log support for advanced filtering?

Answer: Okta Expression Language (OEL) filters

Okta's System Log supports Okta Expression Language (OEL)-based filter expressions in the search bar, allowing complex queries by event type, actor, target, and more.

An Okta admin needs to receive an email alert when a specific event type (e.g., admin privilege granted) occurs. Which feature should they configure?

Answer: Event Hooks

Event Hooks allow Okta to send real-time HTTP POST notifications to an external endpoint when specified event types occur, enabling alerting integrations.

What is the default retention period for events in the Okta System Log?

Answer: 90 days

Okta retains System Log events for 90 days by default; organizations needing longer retention should export logs to a SIEM or log management system.

Which Okta feature helps detect and respond to suspicious user sign-in behavior based on contextual signals like IP reputation and device?

Answer: Okta ThreatInsight

Okta ThreatInsight analyzes sign-in context (IP, device, behavior) to identify and block threats such as credential stuffing and brute-force attacks.

An administrator wants to export Okta System Log data to a third-party SIEM. What is the recommended approach?

Answer: Use Okta's Log Streaming feature (e.g., AWS EventBridge or Splunk Cloud)

Okta Log Streaming pushes System Log events in near-real-time to supported SIEM integrations like AWS EventBridge or Splunk Cloud, eliminating manual exports.