Okta

The Okta integration provides deep visibility into user authentication and enables rapid response to identity-based threats.

Capabilities

Query Tools

Hiro can query Okta for:

Category	What You Can Query
Users	List users, get user details, profile attributes
Groups	List groups, group members, group applications
Applications	List apps, app details, app assignments
Policies	Sign-on policies, password policies, MFA policies, policy rules
System Logs	Authentication events, admin actions, security events
Investigation	Suspicious activity, failed logins, logins from suspicious countries, user login history

Action Tools

With appropriate permissions, Hiro can:

Action	Description
Suspend user	Prevent user from signing in
Unsuspend user	Restore suspended user access
Clear user sessions	Force immediate logout from all sessions
Create/update/deactivate users	Full user lifecycle management
Manage groups	Create, update, delete groups; add/remove members
Manage applications	Create, update, activate, deactivate apps
Manage policies	Create, update, activate, deactivate policies and rules

All actions require explicit approval before execution.

Setup

Prerequisites

Okta admin access (Super Admin or Organization Administrator)
Ability to create an OAuth 2.0 service app in Okta

Connection Method

Hiro connects via OAuth 2.0 with Private Key JWT authentication (not API tokens).

Create a service app in Okta

In your Okta Admin Console:

Go to Applications > Applications
Click Create App Integration
Select API Services
Name it (e.g., “Hiro Security”)

Configure the app

After creating:

Go to General > Client Credentials
Select Public key / Private key as the client authentication method
Click Add key and then Generate new key
Copy the public key in JWK format
Important: Also save the private key — you’ll need it in the final step

Grant OAuth scopes

Go to Okta API Scopes and grant:

okta.users.read
okta.users.manage
okta.groups.read
okta.apps.read
okta.logs.read
okta.policies.read

Assign admin role

Critical step — Scopes alone are not enough.Go to Admin roles and assign:

Read-Only Administrator (for queries only), or
Organization Administrator (for full mutation access)

Without an admin role, API calls succeed but return empty results.

Connect in Hiro

In Hiro, go to Settings > Integrations:

Enter your Okta domain (e.g., company.okta.com)
Enter the Client ID
Paste the private key (JWK format)
Click Connect

Investigation Examples

Find suspicious logins

Show me logins from suspicious countries in the last 24 hours

Hiro checks for logins from flagged countries including Russia, China, North Korea, Iran, Belarus, and others.

Investigate a user

Investigate john@company.com for suspicious activity

Hiro runs a comprehensive check including:

Recent login history with locations
Failed authentication attempts
MFA challenges and failures
Account lockouts
Privilege changes

Check MFA status

Which users don't have MFA enrolled?

Query system logs

Show me admin actions in the last 48 hours

Remediation Actions

When Hiro identifies a threat, it can propose actions like:

PROPOSED ACTION: Suspend Okta User
─────────────────────────────────
User: john@company.com
Reason: Login from known malicious IP after multiple failed attempts
Evidence:
  • 5 failed logins from 185.220.101.1 (Tor exit node)
  • Successful login from same IP at 14:25
  • Immediate access to 7 applications
Confidence: High (91%)

[Approve]  [Reject]

Troubleshooting

”Empty results” from queries

The service app likely doesn’t have an admin role assigned. Go to Admin roles in the Okta app settings and assign Read-Only Administrator or higher.

”Authentication failed”

Verify the Client ID is correct
Ensure the private key matches the public key configured in Okta
Check that the service app is active

Token errors

Hiro uses short-lived tokens that auto-refresh. If you see persistent token errors, try disconnecting and reconnecting the integration.

Overview

Identity

Cloud & Infrastructure

Endpoint & Code

Communication

Capabilities

Query Tools

Action Tools

Setup

Prerequisites

Connection Method

Investigation Examples

Find suspicious logins

Investigate a user

Check MFA status

Query system logs

Remediation Actions

Troubleshooting

”Empty results” from queries

”Authentication failed”

Token errors

Next Steps

AWS

CrowdStrike

​Capabilities

​Query Tools

​Action Tools

​Setup

​Prerequisites

​Connection Method

​Investigation Examples

​Find suspicious logins

​Investigate a user

​Check MFA status

​Query system logs

​Remediation Actions

​Troubleshooting

​”Empty results” from queries

​”Authentication failed”

​Token errors

​Next Steps

AWS

CrowdStrike

Capabilities

Query Tools

Action Tools

Setup

Prerequisites

Connection Method

Investigation Examples

Find suspicious logins

Investigate a user

Check MFA status

Query system logs

Remediation Actions

Troubleshooting

”Empty results” from queries

”Authentication failed”

Token errors

Next Steps