ThreatInsight

Okta ThreatInsight maintains a constantly evolving list of IP addresses that consistently exhibit malicious activity. Authentication requests that are associated with an IP in this list can be logged to the System Log and blocked. ThreatInsight also covers non-authentication requests in limited capacity depending on the attack patterns of these malicious IPs.

The ThreatInsight API provides operations to manage your org ThreatInsight configuration.

Note: To prevent abuse, Okta ThreatInsight works in a limited capacity for free trial edition orgs. Please contact Okta support if fully functional Okta ThreatInsight is required.

Retrieve the ThreatInsight configuration
OAuth 2.0: okta.threatInsights.read

Retrieves the ThreatInsight configuration for the org

Responses
200

Success

403

Forbidden

429

Too Many Requests

get/api/v1/threats/configuration
Request samples 
Response samples 
application/json
{}
Update the ThreatInsight configuration
OAuth 2.0: okta.threatInsights.manage
Updates the ThreatInsight configuration for the org


Request 
Request Body schema: application/json
required
action
required
string
Specifies how Okta responds to authentication requests from suspicious IP addresses


 Enum: Description
none
Indicates that ThreatInsight is disabled


audit
Indicates that Okta logs suspicious requests to the System Log


block
Indicates that Okta logs suspicious requests to the System Log and blocks the requests


 
excludeZones
Array of strings
Accepts a list of Network Zone IDs.
IPs in the excluded network zones aren't logged or blocked.
This ensures that traffic from known, trusted IPs isn't accidentally logged or blocked.


 
Responses 
200
Success


400
Bad Request


403
Forbidden


429
Too Many Requests


post/api/v1/threats/configuration
Request samples 
application/json
{
  • "action": "audit",
  • "excludeZones": [
    • "nzo1q7jEOsoCnoKcj0g4",
    • "nzouagptWUz5DlLfM0g3"
    ]
}
Response samples 
application/json
{
  • "action": "audit",
  • "excludeZones": [
    • "nzo1q7jEOsoCnoKcj0g4",
    • "nzouagptWUz5DlLfM0g3"
    ],
  • "created": "2020-08-05T22:18:30.629Z",
  • "lastUpdated": "2020-10-13T21:23:10.178Z",
  • "_links": {}
}