Integrate Okta IAM with Dune Security

To integrate Dune Security with Okta through the API, specific permissions are required to ensure proper functionality and security monitoring. Below are the API endpoints, the required scopes, and the use cases for each permission:

1. Group Management: /api/v1/groups*

• Scope Required: okta.groups.read
• Purpose: Allows the application to read group details and membership information.
• Use Case for Dune Security:
  • Monitoring Unauthorized Group Changes: Detect suspicious group membership changes, such as users being added to privileged groups without the expected workflows.
  • Tracking Group Creation/Deletion: Identify unexpected creation or deletion of groups, which could indicate a potential breach or misconfiguration.
  • Audit Privileged Groups: Monitor privileged groups (like admin groups) for unusual access patterns or membership changes.

2. Device Management: /api/v1/devices*

• Scope Required: okta.devices.read
• Purpose: Allows the application to read device details registered with Okta.
• Use Case for Dune Security:
  • Identify Unusual Device Registrations: Detect when new devices are registered unexpectedly or outside typical usage patterns.
  • Track Device Activity: Monitor device activity to identify suspicious behaviors, such as access from unusual locations or devices not typically associated with a user.
  • Flag Unauthorized Device Removals: Detect when devices are deregistered unexpectedly, which could signal an attempt to evade security controls.

3. Log Events: /api/v1/logs

• Scope Required: okta.logs.read
• Purpose: Allows the application to read Okta log events.
• Use Case for Dune Security:
  • Track Unusual Login Patterns: Monitor login attempts, especially focusing on anomalies like failed logins, logins from unusual locations, or logins outside typical working hours.
  • Audit Admin Activity: Analyze log data for any unusual admin actions, such as privilege escalations or unexpected configuration changes.

4. User Management: /api/v1/users

• Scope Required: okta.users.read
• Purpose: Allows the application to read user details and manage user accounts.
• Use Case for Dune Security:
  • Monitor User Creation/Deletion: Detect unauthorized user creation or deletion, which could indicate malicious activity.
  • Identify Inactive Accounts: Track accounts that haven't been used for a long time, which could be targets for compromise.
  • Detect Role or Profile Changes: Identify any unauthorized changes in user roles or attributes, which could indicate potential privilege escalation or user impersonation.

5. Device Scope Early Access (Optional): /api/v1/devices*

• Scope Required: okta.devices.read
• Purpose: The device scope is currently available in early access, allowing the application to read detailed device information registered with Okta.
• Use Case for Dune Security:
  • Enhanced Device Monitoring: Utilize advanced integrations and analysis engines developed by Dune Security to provide deeper insights into device-related activities.
  • Identify Unusual Device Registrations: Detect when new devices are registered unexpectedly or outside typical usage patterns.
  • Track Device Activity: Monitor device activity to identify suspicious behaviors, such as access from unusual locations or devices not typically associated with a user.
  • Flag Unauthorized Device Removals: Detect when devices are deregistered unexpectedly, which could signal an attempt to evade security controls.
  • Action Required:
    • Enable the Device Scope: Enable the device scope by following the instructions provided here.
    • Assign Scopes: Ensure the necessary scopes are granted to the "Dune Integration" user that was previously created.
  • Learn More: For detailed information about device scopes, refer to the Okta Device Permissions page.

Summary of Required Permissions:

To enable these functionalities, the following Okta API scopes are necessary:

• okta.groups.read
• okta.devices.read
• okta.logs.read
• okta.users.read

These permissions allow Dune Security to effectively monitor and enhance your organization's security posture by integrating with Okta and leveraging its data for risk management​​​​​.