Filebeat Okta module

filebeat/docs/modules/okta.asciidoc

@@ -0,0 +1,27 @@
+////
+This file is generated! See scripts/docs_collector.py
+////
+
+[[filebeat-module-okta]]
+[role="xpack"]
+
+:modulename: okta
+:has-dashboards: false
+
+== OKTA module
+
+beta[]
+
+This is a filebeat module for retrieving system logs from OKTA via API.
+
+:has-dashboards!:
+
+:modulename!:
+
+
+[float]
+=== Fields
+
+For a description of each field in the module, see the
+<<exported-fields-okta,exported fields>> section.
+

filebeat/docs/modules_list.asciidoc

@@ -29,6 +29,7 @@ This file is generated! See scripts/docs_collector.py
   * <<filebeat-module-nats>>
   * <<filebeat-module-netflow>>
   * <<filebeat-module-nginx>>
+  * <<filebeat-module-okta>>
   * <<filebeat-module-osquery>>
   * <<filebeat-module-panw>>
   * <<filebeat-module-postgresql>>
@@ -70,6 +71,7 @@ include::modules/mysql.asciidoc[]
 include::modules/nats.asciidoc[]
 include::modules/netflow.asciidoc[]
 include::modules/nginx.asciidoc[]
+include::modules/okta.asciidoc[]
 include::modules/osquery.asciidoc[]
 include::modules/panw.asciidoc[]
 include::modules/postgresql.asciidoc[]

x-pack/filebeat/filebeat.reference.yml

@@ -669,6 +669,16 @@ filebeat.modules:
   #  # Filebeat will choose the paths depending on your OS.
   #  #var.paths:
 
+#--------------------------------- OKTA Module ---------------------------------
+- module: okta
+  system:
+    enabled: true
+    # API key to access OKTA
+    #var.api_key
+
+    # URL of the OKTA REST API
+    #var.url
+
 #------------------------------- Osquery Module -------------------------------
 - module: osquery
   result:

x-pack/filebeat/module/okta/README.md

@@ -0,0 +1,24 @@
+# Okta module
+
+## Caveats
+
+* Module is to be considered _beta_.
+
+## How to try the module from distribution install
+
+
+```
+./filebeat setup --modules=okta -e
+```
+
+Enable the Okta module
+
+```
+./filebeat modules enable okta
+```
+
+Start Filebeat
+
+```
+./filebeat -e
+```

x-pack/filebeat/module/okta/_meta/config.yml

@@ -0,0 +1,8 @@
+- module: okta
+  system:
+    enabled: true
+    # API key to access OKTA
+    #var.api_key
+
+    # URL of the OKTA REST API
+    #var.url

x-pack/filebeat/module/okta/_meta/docs.asciidoc

@@ -0,0 +1,14 @@
+[role="xpack"]
+
+:modulename: okta
+:has-dashboards: false
+
+== OKTA module
+
+beta[]
+
+This is a filebeat module for retrieving system logs from Okta (www.okta.com) via API. 
+
+:has-dashboards!:
+
+:modulename!:

x-pack/filebeat/module/okta/_meta/fields.yml

@@ -0,0 +1,10 @@
+- key: okta
+  title: OKTA
+  description: >
+    Module for handling system logs from OKTA.
+  fields:
+    - name: okta
+      type: group
+      description: >
+        Fields from OKTA.
+      fields:

x-pack/filebeat/module/okta/module.yml

@@ -0,0 +1 @@
+dashboards: