Integrating with Okta (SOAR)

Forescout Cloud integrates with Okta to support security orchestration, automation, and response (SOAR) workflows by automating your IT tasks to reduce strain on your team. It does this by calling Okta APIs to retrieve identity data and then automatically invoking actions related to users and devices.

Before integrating, create a service app integration in your Okta portal and assign scopes and roles. For more information, see Implement OAuth for Okta with a service app in the Okta Developer documentation. As you create the service app integration, note the following credentials:

  • Client ID
  • Secret Key
  • API Base URL for Okta

To integrate Forescout Cloud with Okta to support SOAR:

  1. In the left pane of the Forescout Cloud Console, select Administration > Integrations.
  2. Click the Add Application button.
  3. In the Category dropdown, select SOAR.
  4. In the Application dropdown, select Okta for Identity and Access Management.
  5. In the Application Name field, enter a unique name for the integration.
  6. In the Configurations pane, enter the base URL for Okta into the Base URL for Okta field.
  7. Enter the Okta ID into the Okta ID field.
  8. Enter the Okta private key into the Okta Private Key field.
  9. Click the Add Application button to save the configuration.

SOAR actions for Okta

After you integrate Forescout Cloud with Okta, you can configure enrichment and response actions for users and devices. For details on configuring SOAR actions, see Configuring SOAR actions.

Note: For detailed information, including descriptions, request and response details, and samples for the following actions, see Users and Devices in the Okta Developer documentation.

The following table shows enrichment actions that support SOAR for Okta.

Enrichment actions
Category Action
User List Device Users
User List User Application Links
User List User Grants
User Get User
User List Users
User List User Factors
User List User Risk
Device List User Devices
Device List Devices
Device Get Device Users By Device ID
Device Get Device Users
Device Get Device

The following table shows response actions that support SOAR for Okta.

Response actions
Category Action
User Revoke All User Factors
User Deactivate User
User Reset User Password
User Suspend User
User User
User Revoke A Single User Grant
User Expire Use Password
User Reset User Password
User Reactivate User
User Revoke A Single User Factor
User Revoke All User Grants
User Revoke All User Sessions
Device Deactivate Device
Device Reactivate Device
Device Suspend Device
Device Unsuspend Device