Has anyone already come up with a SPL for Okta Identity extraction for Enterprise Security

[asridhara]

I was wondering if anyone has already come up with an SPL to extract identities for Enterprise security Identity and asset lookups. Could you please post the SPL if you have.

[McLeodyDay]

This is by no means perfect, but it has worked for me.

Run this in search to generate you .csv lookup:
| append [search index=okta sourcetype="OktaIM2:user" earliest=0| rename user AS identity, profile.firstName AS first, profile.lastName AS last, profile.email AS email, user_phone AS phone, user_managedBy AS managedBy, user_bunit AS bunit, user_work_city AS work_city, user_work_country AS work_country, activated AS startDate]
| eval priority = "medium"
| sort 0 - startDate
| dedup identity
| table identity,prefix,nick,first,last,suffix,email,phone,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long
| outputlookup corporate_identities.csv

Schedule a search for the following:
| inputlookup corporate_identities.csv
| append [search index=okta sourcetype="OktaIM2:user" earliest=0| rename user AS identity, profile.firstName AS first, profile.lastName AS last, profile.email AS email, user_phone AS phone, user_managedBy AS managedBy, user_bunit AS bunit, user_work_city AS work_city, user_work_country AS work_country, activated AS startDate]
| eval priority = "medium"
| sort 0 - startDate
| dedup identity
| table identity,prefix,nick,first,last,suffix,email,phone,managedBy,priority,bunit,category,watchlist,startDate,endDate,work_city,work_country,work_lat,work_long
| outputlookup corporate_identities.csv

The improvement I'd like to see would be on timing of when identities are modified, or some attribute to know if the identity is active or not. Would need to play with dedup and earliest=0.

Any suggestions/edits are welcomed!

[dm1]

@McLeodyDay  Thanks for sharing this. Please do share if you have made any further improvements to this.