Connect Okta | ShellOrbit

These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.

You need to be a super administrator in Okta. Okta sends the events through an event hook; nothing is installed in your org.

1. Create the source

In ShellOrbit, Settings, Integrations, Add source, choose Okta, and name it after the org. Copy the URL, and the header name and secret shown on the source page.

2. Create the event hook

In the Okta Admin Console, Workflow, Event Hooks, Create Event Hook:

Connect Okta: Field, Value
Field	Value
Endpoint URL	The source URL, `https://hooks.shellorbit.com/e/...`
Authentication field	The header name from the source page
Authentication secret	The secret from the source page
Subscribe to events	`user.session.start`, `user.mfa.factor.deactivate`, `user.mfa.factor.reset_all`, `user.account.privilege.grant`, `group.privilege.grant`, `system.api_token.create`

Save, then choose Verify. Okta asks the URL to prove it is the endpoint you meant; ShellOrbit answers for the source, and the hook turns active.

What the ready-made rules detect

Okta events are read as sign in events, then share the same rules as your app:

Connect Okta: Finding, Severity, Okta event
Finding	Severity	Okta event
Possible credential stuffing: 10 failed sign ins on the source in 5 minutes	High	`user.session.start` with outcome `FAILURE`
Repeated failed sign ins for one account: 5 in 10 minutes	Medium	`user.session.start` with outcome `FAILURE`
Administrator role granted	High	`user.account.privilege.grant`, `group.privilege.grant`
MFA turned off	Medium	`user.mfa.factor.deactivate`, `user.mfa.factor.reset_all`
API token created	Low	`system.api_token.create`
Sign in from a new country for an account	Low	`user.session.start` succeeded, with a country in the client’s location

Okta batches several events in one request; each is read on its own.