一键在 Manus 中运行任何 Skill

ingest-okta-system-log-ocsf

星标3

分支0

更新时间2026年7月11日 02:43

Convert verified Okta System Log events into OCSF 1.8 or native Identity & Access Management records. The first slice maps session and SSO events to Authentication (3002), user lifecycle and account-control changes to Account Change (3001), app/group membership updates to User Access Management (3005), and a narrow verified set of Okta Verify MFA challenge and denial events to Authentication (3002). It preserves Okta natural IDs such as uuid, published, transaction.id, and authenticationContext.externalSessionId for SIEM-friendly dedupe and correlation. Use when the user mentions Okta System Log ingestion, Okta audit log normalization, cross-vendor identity telemetry, or feeding Okta identity events into an OCSF pipeline or native canonical-first flow. Do NOT use for raw Azure Entra, Google Workspace, or AWS IAM logs. Do NOT use as a detector or policy engine — this skill only normalizes verified Okta event payloads into OCSF or native output.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

msaad00

msaad00/cloud-ai-security-skills

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

相关职业SOC

基于 SOC 职业分类

网络与计算机系统管理员计算机与数学类职业·SOC 15-1244

文件资源管理器

7 个文件

SKILL.md

readonly

同仓库更多 Skills

同仓库

cspm-azure-cis-benchmark

msaad00/cloud-ai-security-skills

Assess Azure subscriptions against a curated subset of CIS Azure Foundations Benchmark v2.1. Automates 32 high-impact read-only checks across Identity, Defender for Cloud, Storage, Database, Logging, Networking, Compute, Key Vault, and App Service (~53% of the v2.1 benchmark). Use when the user mentions Azure CIS benchmark, Azure storage security, or unrestricted SSH/RDP detection in NSGs. Do NOT use for AWS or GCP; do NOT use to remediate findings (assessment-only, Reader role only); do NOT claim full CIS Azure coverage — only 32 of 60 controls are implemented, see the Roadmap section in this file for the gap.

2026-07-113

ingest-entra-directory-audit-ocsf

msaad00/cloud-ai-security-skills

Convert verified Microsoft Entra directoryAudit events into OCSF 1.8 API Activity (6003). The first slice maps Microsoft Graph directory audit events for service-principal credential changes, app-role grants, and federated identity credential creation into deterministic OCSF records while preserving Entra natural IDs such as id, correlationId, and activityDateTime for SIEM dedupe and downstream correlation. Use when the user mentions Entra audit log ingestion, Microsoft Graph directoryAudit normalization, or feeding Entra identity telemetry into an OCSF pipeline. Do NOT use for Okta System Log, Azure Activity Logs, or as a detector or policy engine — this skill only normalizes verified Microsoft Graph directoryAudit payloads.

2026-07-113

ingest-k8s-audit-ocsf

msaad00/cloud-ai-security-skills

Convert raw Kubernetes audit logs (`audit.k8s.io/v1`) into normalized API activity records, with OCSF as the default wire format and native output as an option. Maps user, source IP, verb, objectRef, and response status with enough fidelity for K8s privilege-escalation and secret-access detectors. Use when the user mentions Kubernetes audit logs, kube-apiserver audit sinks, K8s detection engineering, or feeding K8s audit into a SIEM. Do NOT use for container runtime logs, kubelet logs, or CloudTrail / GCP audit / Azure Activity. Do NOT use as a detection skill; this only normalizes events.

2026-07-113

detect-aws-access-key-creation

msaad00/cloud-ai-security-skills

Detect successful AWS IAM `CreateAccessKey` API calls against IAM users from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) when a principal creates an access key for an IAM user. Use when the user mentions "AWS access key created", "IAM user key issuance", "additional cloud credentials in AWS", or "T1098.001 via CloudTrail". Do NOT use as a posture-at-rest access-key inventory check, to infer console-password or login-profile creation, or to claim every AWS identity-pivot path. This first slice only covers successful `CreateAccessKey` operations.

2026-07-103

detect-mcp-tool-drift

msaad00/cloud-ai-security-skills

Detect MCP tool schema drift mid-session — the MCP tool-poisoning / rug-pull attack pattern. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection produced by ingest-mcp-proxy-ocsf, groups them by session, and flags any tool whose fingerprint (sha256 over name + description + inputSchema + annotations) changes between tools/list responses in the same session. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATT&CK T1195.001 (Compromise Software Supply Chain) inside finding_info.attacks. Use when the user mentions MCP security, tool drift, tool poisoning, prompt injection via tool schema, or supply chain compromise of an MCP server. Do NOT use on raw MCP proxy logs — feed them through ingest-mcp-proxy-ocsf first. Do NOT use for cross-session drift (same tool, different sessions) — that is a legitimate MCP server update, not an attack; a separate detector will cover it. Do NOT use for divergence against an out-of-band server-registered baseline — that is detect-m

2026-07-103

detect-prompt-injection-mcp-proxy

msaad00/cloud-ai-security-skills

Detect suspicious prompt-injection and instruction-smuggling language in MCP tool descriptions from ingest-mcp-proxy-ocsf. Reads OCSF 1.8 Application Activity (class 6002) or the native application-activity projection, keeps a narrow high-signal scope, and flags `tools/list` responses whose tool descriptions explicitly tell an agent to ignore prior instructions, reveal a system or developer prompt, bypass guardrails, or exfiltrate secrets or conversation history. Emits OCSF 1.8 Detection Finding (class 2004) with MITRE ATLAS AML.T0051 Prompt Injection. Use when the user mentions MCP prompt injection, instruction smuggling in tool metadata, malicious tool descriptions, or AI-agent tool poisoning beyond simple schema drift. Do NOT use on raw MCP proxy logs — normalize them through ingest-mcp-proxy-ocsf first. Do NOT use as a general content-moderation classifier or on tool-call results; this slice only covers suspicious tool declarations in `tools/list` responses.

2026-07-103

name	ingest-okta-system-log-ocsf
description	Convert verified Okta System Log events into OCSF 1.8 or native Identity & Access Management records. The first slice maps session and SSO events to Authentication (3002), user lifecycle and account-control changes to Account Change (3001), app/group membership updates to User Access Management (3005), and a narrow verified set of Okta Verify MFA challenge and denial events to Authentication (3002). It preserves Okta natural IDs such as uuid, published, transaction.id, and authenticationContext.externalSessionId for SIEM-friendly dedupe and correlation. Use when the user mentions Okta System Log ingestion, Okta audit log normalization, cross-vendor identity telemetry, or feeding Okta identity events into an OCSF pipeline or native canonical-first flow. Do NOT use for raw Azure Entra, Google Workspace, or AWS IAM logs. Do NOT use as a detector or policy engine — this skill only normalizes verified Okta event payloads into OCSF or native output.
purpose	Convert verified Okta System Log events into OCSF 1.8 or native Identity & Access Management records. The first slice maps session and SSO events to Authentication (3002), user lifecycle and account-control changes to...
capability	ingest
persistence	none
telemetry	stderr_jsonl
privilege_escalation	none
license	Apache-2.0
approval_model	none
execution_modes	jit, ci, mcp, persistent
side_effects	none
input_formats	raw
output_formats	native, ocsf
concurrency_safety	stateless
compatibility	Requires Python 3.11+. No Okta SDK required when System Log payloads are already exported. Read-only — validates raw Okta event shape and emits OCSF or native JSONL. Never calls write APIs.
metadata	{"author":"msaad00","homepage":"https://github.com/msaad00/cloud-ai-security-skills","source":"https://github.com/msaad00/cloud-ai-security-skills/tree/main/skills/ingestion/ingest-okta-system-log-ocsf","version":"0.2.0","frameworks":["OCSF 1.8"],"cloud":"okta","capability":"read-only"}

ingest-okta-system-log-ocsf

Convert raw Okta System Log payloads into OCSF 1.8 or native IAM events with deterministic IDs and verified field mappings.

Use when

You have Okta System Log exports from the /api/v1/logs API, event hooks, or archived JSON and need OCSF output
You want to normalize Okta identity telemetry for SIEM, lake, MCP, or downstream detection use
You need a portable identity event stream that preserves Okta uuid, published, session, and transaction identifiers
You want app and group membership updates represented as OCSF user access events instead of vendor-only audit records

Do NOT use

On Entra, Workspace, CloudTrail, or Kubernetes audit logs
To collect live Okta logs by itself — upstream collection and auth stay outside this skill
To infer ATT&CK techniques or create findings directly
To rewrite or mutate Okta objects, users, groups, apps, or sessions

Input contract

Accepts one of three raw Okta System Log shapes:

System Log API array

[
  {
    "uuid": "b9ab9263-a4ae-4780-9981-377ec8f2da86",
    "published": "2026-04-13T02:15:00.000Z",
    "eventType": "user.session.start"
  }
]

Single event

{
  "uuid": "b9ab9263-a4ae-4780-9981-377ec8f2da86",
  "published": "2026-04-13T02:15:00.000Z",
  "eventType": "user.session.start"
}

Event hook wrapper

{
  "data": {
    "events": [
      {
        "uuid": "b9ab9263-a4ae-4780-9981-377ec8f2da86",
        "published": "2026-04-13T02:15:00.000Z",
        "eventType": "user.session.start"
      }
    ]
  }
}

The first slice intentionally supports a narrow, verified event family:

user.session.start
user.session.end
user.authentication.sso
user.authentication.auth_via_mfa
user.lifecycle.create
user.lifecycle.activate
user.lifecycle.deactivate
user.lifecycle.suspend
user.lifecycle.unsuspend
user.account.update_password
user.account.reset_password
user.account.lock
user.account.unlock_by_admin
user.mfa.factor.activate
user.mfa.factor.deactivate
user.mfa.okta_verify
user.mfa.okta_verify.deny_push
user.mfa.okta_verify.deny_push_upgrade_needed
system.push.send_factor_verify_push
application.user_membership.add
application.user_membership.remove
group.user_membership.add
group.user_membership.remove
user.account.privilege.grant
user.account.privilege.revoke

Unsupported event types are skipped, never silently dropped. Each occurrence emits an unmapped_event_type warning to stderr with the offending event_type and event uid. At end of run, an unmapped_event_type_summary info record reports total skipped, distinct event types, and the top 10 unmapped types with counts — so blind spots in the classification map surface immediately in CI logs and log-search dashboards.

Output contract

Emits OCSF 1.8 JSONL by default, with --output-format native available for the repo-owned canonical projection.

OCSF output uses these verified class mappings:

Authentication (3002) for session, SSO, and verified Okta Verify MFA verification events
Account Change (3001) for user lifecycle and account-control events
User Access Management (3005) for app/group membership and privilege grant/revoke events

Each output record includes:

deterministic metadata.uid based on Okta uuid or a stable hash fallback
UTC epoch-millisecond time from published
Okta session and transaction correlation data preserved under unmapped.okta.*
actor, user, src_endpoint, and resources where the raw event supports them
expanded v0.2 OCSF-native slots (see table below) when the Okta payload carries geographicalContext, securityContext, client.userAgent, authenticationContext, debugContext, or request.ipChain

OCSF 1.8 mapping (v0.2, #271)

The full Okta-field → OCSF-field table, the unmapped.okta.* native preservation list, and the risk-signal enrichment shape live in references/field-map.md. Keeping the detail there keeps this file under the progressive-disclosure word target (#247) while detectors and reviewers still get the exact mapping one click away.

Usage

# API export file
python src/ingest.py okta-system-log.json > okta.ocsf.jsonl

# event hook payload from stdin
cat event-hook.json | python src/ingest.py > okta.ocsf.jsonl

# pretty output file
python src/ingest.py okta.json --output okta.ocsf.jsonl

# native projection for non-OCSF consumers
python src/ingest.py okta.json --output-format native > okta.native.jsonl

Security guardrails

Read-only only. No Okta writes. No subprocesses.
Keeps vendor-native IDs for dedupe and correlation instead of inventing new random IDs.
Uses verified raw fields from official Okta docs only; unsupported event types are skipped rather than guessed.
Normalizes into OCSF only where the class fit is explicit. Unmapped vendor-specific detail stays under unmapped.

Native output format

When --output-format native is selected, the skill emits:

schema_mode: "native"
canonical_schema_version
record_type
event_uid
provider
activity_id
event_type
severity / severity_id
status / status_id
time_ms
actor, user, src_endpoint, session, resources, and privileges where present
device, http_request, auth_protocol, auth_factors, observables, enrichments where the Okta payload supports them (v0.2)
unmapped.okta.* vendor-specific detail including verbatim debug_data round-trip

ingest-okta-system-log-ocsf

ingest-okta-system-log-ocsf

Use when

Do NOT use

Input contract

Output contract

OCSF 1.8 mapping (v0.2, #271)

Usage

Security guardrails

Native output format

See also

ingest-okta-system-log-ocsf

Use when

Do NOT use

Input contract

Output contract

OCSF 1.8 mapping (v0.2, #271)

Usage

Security guardrails

Native output format

See also