Okta

We use Okta’s Integration Network (OIN) to integrate with your directory.

Log into your Okta account as an administrator
Select “Admin” in the top right
Select Applications > API Service Integrations > Add Integration
Search for Wirespeed
Click Add
Copy the Client ID, Client Secret, and Okta Domain
Login to Wirespeed and navigate to Integrations > Add Integration > Okta and provide the Client ID, Client Secret, and Okta Domain

On first sync, Wirespeed fetches detection-eligible security events from the last 7 days.

Remediation and release actions

When write access is enabled (read-only mode is off), Wirespeed can take the following user remediation and release actions in Okta:

Action	Okta API	Effect
Suspend User	`POST /api/v1/users/{id}/lifecycle/suspend`	Prevents the user from signing in
Unsuspend User	`POST /api/v1/users/{id}/lifecycle/unsuspend`	Restores sign-in access
Revoke Sessions	`DELETE /api/v1/users/{id}/sessions?oauthTokens=true`	Terminates active sign-in sessions and revokes OAuth tokens
Revoke Sessions (Identity Threat Prevention)	`POST /oauth2/v1/global-token-revocation`	Same Revoke Sessions remediation action; terminates Okta sessions and revokes tokens in connected apps when the Identity Threat Prevention SKU is detected
Reset Password	`POST /api/v1/users/{id}/lifecycle/expire_password`	Expires the current password, forcing a password change on next sign-in

All remediation and release actions require the okta.users.manage OAuth scope. Revoke Sessions with Identity Threat Prevention additionally requires the okta.universalLogout.manage and okta.policies.read scopes.

Get Started

Chat Ops

Remediation

Verdicts

Groups

Exclusions

Events

Assets

Settings

Integrations

Remediation and release actions

​Remediation and release actions

Remediation and release actions