Smart SOAR Integration

Sophisticated attackers often use compromised credentials to gain access to sensitive systems, which can completely elude signature-based defenses. D3 Smart SOAR integrates with Okta’s identity cloud to handle credential-based attacks. Users can escalate suspicious events to Smart SOAR, such as failed login attempts, which in turn trigger investigations in Smart SOAR. During which, Smart SOAR can retrieve event logs from Okta and orchestrate response actions, such as temporarily blocking access for a compromised user.

Okta Integration

Integration features

Retrieve event logs from Okta into Smart SOAR
Manage user accounts in Okta from Smart SOAR
Enrich Okta events with threat intelligence, MITRE ATT&CK techniques, and more
Single sign-on for Okta and Smart SOAR

Key Use Cases


Event Enrichment

When a suspicious behavior is detected in Okta and escalated, Smart SOAR can automatically provide rich context that helps the analyst determine the risk level of the event. This includes searching across related Okta logs, extracting IOCs to correlate against integrated threat intelligence platforms, and confirming any potential MITRE ATT&CK TTPs.

Response Orchestration

During a possible identity-based security incident, Smart SOAR is able to orchestrate immediate actions to limit the spread of the attack via integrations with other security tools. If the incident is confirmed as a true positive, the analyst can orchestrate policy changes in Okta from the Smart SOAR workflow. These might include suspending user access, requiring a password reset, or adjusting the policies associated with a user group. Watch it mitigate credential compromise attacks here.

Meet Our Friends

Our Connected SOAR Security Alliance brings hundreds of vendors together, allowing customers to benefit from our deep industry relationships and fully vendor-agnostic, independent SOAR platform.

X Okta Integration

Get Started with D3 Security

One platform to stop alert overwhelm. Transform how your security team works, by focusing its resources on real threats.