--- title: Okta fields description: Module for handling system logs from Okta. Fields from Okta. Fields that let you store information of the actor for the LogEvent. Fields that let you... url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/filebeat/exported-fields-okta products: - Beats - Filebeat applies_to: - Elastic Cloud Serverless: Generally available - Elastic Stack: Generally available --- # Okta fields Module for handling system logs from Okta. ## okta Fields from Okta. The unique identifier of the Okta LogEvent. type: keyword The type of the LogEvent. type: keyword The version of the LogEvent. type: keyword The severity of the LogEvent. Must be one of DEBUG, INFO, WARN, or ERROR. type: keyword The display message of the LogEvent. type: keyword ## actor Fields that let you store information of the actor for the LogEvent. Identifier of the actor. type: keyword Type of the actor. type: keyword Alternate identifier of the actor. type: keyword Display name of the actor. type: keyword ## client Fields that let you store information about the client of the actor. The IP address of the client. type: ip ## user_agent Fields about the user agent information of the client. The raw information of the user agent. type: keyword The OS information. type: keyword The browser information of the client. type: keyword The zone information of the client. type: keyword The information of the client device. type: keyword The identifier of the client. type: keyword ## outcome Fields that let you store information about the outcome. The reason of the outcome. type: keyword The result of the outcome. Must be one of: SUCCESS, FAILURE, SKIPPED, ALLOW, DENY, CHALLENGE, UNKNOWN. type: keyword The list of targets. type: flattened ## transaction Fields that let you store information about related transaction. Identifier of the transaction. type: keyword The type of transaction. Must be one of "WEB", "JOB". type: keyword ## debug_context Fields that let you store information about the debug context. ## debug_data The debug data. The fingerprint of the device. type: keyword The factor used for authentication. type: keyword The identifier of the request. type: keyword The request URI. type: keyword Threat suspected. type: keyword The set of behaviors that contribute to a risk assessment. type: keyword The risk level assigned to the sign in attempt. type: keyword The reasons for the risk. type: keyword The URL. type: keyword The complete debug_data object. type: flattened ## suspicious_activity The suspicious activity fields from the debug data. The browser used. type: keyword The city where the suspicious activity took place. type: keyword The country where the suspicious activity took place. type: keyword The event ID. type: keyword The IP of the suspicious event. type: ip The latitude where the suspicious activity took place. type: float The longitude where the suspicious activity took place. type: float The state where the suspicious activity took place. type: keyword The event transaction ID. type: keyword The event type. type: keyword The OS of the system from where the suspicious activity occurred. type: keyword The timestamp of when the activity occurred. type: date ## authentication_context Fields that let you store information about authentication context. The information about the authentication provider. Must be one of OKTA_AUTHENTICATION_PROVIDER, ACTIVE_DIRECTORY, LDAP, FEDERATION, SOCIAL, FACTOR_PROVIDER. type: keyword The authentication step. type: integer The information about credential provider. Must be one of OKTA_CREDENTIAL_PROVIDER, RSA, SYMANTEC, GOOGLE, DUO, YUBIKEY. type: keyword The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID. type: keyword The information about the issuer. type: array The session identifier of the external session if any. type: keyword The interface used. e.g., Outlook, Office365, wsTrust type: keyword ## security_context Fields that let you store information about security context. ## as The autonomous system. The AS number. type: integer ## organization The organization that owns the AS number. The organization name. type: keyword The Internet Service Provider. type: keyword The domain name. type: keyword Whether it is a proxy or not. type: boolean ## request Fields that let you store information about the request, in the form of list of ip_chain. List of ip_chain objects. type: flattened