Skip to content

Update Solutions/Okta Single Sign-On/Analytic Rules/UserSessionImpersonation.yaml#14137

Merged
v-atulyadav merged 4 commits intoAzure:masterfrom
stephanwaelde:patch-1
Apr 28, 2026
Merged

Update Solutions/Okta Single Sign-On/Analytic Rules/UserSessionImpersonation.yaml#14137
v-atulyadav merged 4 commits intoAzure:masterfrom
stephanwaelde:patch-1

Conversation

@stephanwaelde
Copy link
Copy Markdown
Contributor

Update query with OktaSSO parser so that the OktaV2_CL table is considered

Required items, please complete

Change(s):

  • Updated the KQL query to accommodate the OktaV2_CL table by using the OktaSSO parser

Reason for Change(s):

  • Without the change the query does not take effect for the latest version of the data connector, which writes its log and event data into the OktaV2_CL table

Version Updated:

  • Yes

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • See guidance below

Update query with OktaSSO parser so that the OktaV2_CL table is considered
@stephanwaelde stephanwaelde requested review from a team as code owners April 26, 2026 07:25
@v-shukore v-shukore added the Solution Solution specialty review needed label Apr 27, 2026
@v-maheshbh v-maheshbh requested a review from Copilot April 27, 2026 06:30
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Okta Single Sign-On analytic rule to use the OktaSSO parser so the detection continues to work with the newer Okta data connector that writes to OktaV2_CL.

Changes:

  • Updated the KQL query source from Okta_CL to the OktaSSO parser.
  • Bumped the rule version from 1.0.0 to 1.1.0.

Release v3.1.7: add packaged artifact and bump solution/template versions across mainTemplate.json and parser metadata. Update analytic/hunting/hunting playbook/workbook/parser descriptions and template version fields from 3.1.6 to 3.1.7, bump one analytic rule version to 1.1.0, and update data connector CCP version. Change the User Session Impersonation analytic query to use the OktaSSO table (to work with the OktaV2 parser) and adjust several entityMappings/customDetails formatting. Update playbook metadata lastUpdateTime and add an entry to ReleaseNotes.md documenting the parser/query change.
Introduce a SessionId variable in mainTemplate.json and a corresponding _SessionId mapping, replacing hard-coded "authenticationContext_externalSessionId_s" occurrences with the new variable. Also updates the packaged ZIP to include the template changes. This centralizes the session ID key for easier reuse and maintenance.
Remove the trailing comma after customDetails.SessionId to fix invalid JSON parsing in mainTemplate.json. Update the packaged 3.1.7.zip to include the corrected template.
@v-atulyadav v-atulyadav merged commit 310e2c1 into Azure:master Apr 28, 2026
36 checks passed
@v-maheshbh
Copy link
Copy Markdown
Contributor

Hi @stephanwaelde
Please let me know, and I will proceed with publishing it on Partner Center.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants