Okta Application Management SpotApp
SpotApps are ThoughtSpot’s out-of-the-box solution templates built for specific use cases and data sources. They are built on ThoughtSpot Modeling Language (TML) Blocks, which are pre-built pieces of code that are easy to download and implement directly from the product.
The Okta Application Management SpotApp mimics the Okta data model. When you deploy it, ThoughtSpot creates several Worksheets, Answers, and Liveboards, based on your Okta data in your cloud data warehouse.
This is a sample Liveboard, created after you deploy the Okta Application Management SpotApp:
Use the Okta Application Management SpotApp to understand login problems and application adoption. Diagnose login problems by tracking login events and platform activity. You can also measure which applications people in your organization use the most.
Prerequisites
Before you can deploy the Okta Application Management SpotApp, you must complete the following prerequisites:
-
Obtain credentials and SYSADMIN privileges to connect to your cloud data warehouse. The cloud data warehouse must contain the data you would like ThoughtSpot to use to create Answers, Liveboards, and Worksheets. Refer to the connection reference for your cloud data warehouse for information about required credentials:
-
The connection name for each new SpotApp must be unique.
-
Administrator access to Okta
-
Access to the following Okta table in your cloud data warehouse. Refer to Okta Application Management SpotApp schema for more details.
-
SYSLOG
-
-
Run the required SQL commands in your cloud data warehouse. Refer to Run SQL commands.
Run SQL commands
The following SQL commands help standardize data types and column names. They create 4 views in your cloud data warehouse schema. Replace the database name, schema name, and file path with your specific information.
| The following SQL example is for the Snowflake cloud data warehouse. You may need to modify the code for the SQL requirements of your specific cloud data warehouse. |
SQL commands:
Open the dropdown menu to view the SQL commands.
PUT file:///<File path>/syslog_query.csv @%SYSLOG;
;
list @%SYSLOG;
remove @%SYSLOG;
copy into "<DATABASE NAME>"."<SCHEMA NAME>"."SYSLOG" file_format = (
TYPE = 'CSV'
COMPRESSION = 'AUTO'
FIELD_DELIMITER = ','
RECORD_DELIMITER = '\n'
SKIP_HEADER = 1
FIELD_OPTIONALLY_ENCLOSED_BY = '\042'
TRIM_SPACE = TRUE
ERROR_ON_COLUMN_COUNT_MISMATCH = TRUE
ESCAPE = 'NONE'
ESCAPE_UNENCLOSED_FIELD = '\134'
DATE_FORMAT = 'AUTO'
TIMESTAMP_FORMAT = 'AUTO'
NULL_IF = ('\\N')
);
create database <DATABASE NAME>;
create or replace table "<DATABASE NAME>"."<SCHEMA NAME>"."SYSLOG" (
"severity" STRING,
"event_type" STRING,
"display_message" STRING,
"uuid" STRING,
"version" STRING,
"timestamp" DATETIME,
"outcome.result" STRING,
"outcome.reason" STRING,
"actor.id" STRING,
"actor.type" STRING,
"actor.display_name" STRING,
"actor.alternate_id" STRING,
"authentication_context.authentication_step" STRING,
"authentication_context.authentication_provider" STRING,
"authentication_context.credential_provider" STRING,
"authentication_context.credential_type" STRING,
"authentication_context.issuer" STRING,
"authentication_context.external_session_id" STRING,
"client.zone" STRING,
"client.ip_address" STRING,
"client.device" STRING,
"client.user_agent.raw_user_agent" STRING,
"client.user_agent.os" STRING,
"client.user_agent.browser" STRING,
"client.geographical_context.country" STRING,
"client.geographical_context.city" STRING,
"client.geographical_context.postal_code" STRING,
"client.geographical_context.geolocation.lon" STRING,
"client.geographical_context.geolocation.lat" STRING,
"transaction.id" STRING,
"transaction.type" STRING,
"debug_context.debug_data.request_uri" STRING,
"legacy_event_type" STRING,
"target0.id" STRING,
"target0.type" STRING,
"target0.alternate_id" STRING,
"target0.display_name" STRING,
"target1.id" STRING,
"target1.type" STRING,
"target1.alternate_id" STRING,
"target1.display_name" STRING,
"target2.id" STRING,
"target2.type" STRING,
"target2.alternate_id" STRING,
"target2.display_name" STRING,
"target3.id" STRING,
"target3.type" STRING,
"target3.alternate_id" STRING,
"target3.display_name" STRING,
"request.ip_chain.geographical_context.postal_code" STRING,
"request.ip_chain.geographical_context.geolocation.lon" STRING,
"request.ip_chain.geographical_context.geolocation.lat" STRING,
"request.ip_chain.geographical_context.geolocation.state" STRING,
"request.ip_chain.ip" STRING,
"request.ip_chain.source" STRING,
"request.ip_chain.version" STRING
);Deploy the Okta Application Management SpotApp
After you complete the prerequisites, you are ready to deploy the Okta Application Management SpotApp and begin leveraging its pre-built content.
To deploy the Okta Application Management SpotApp, refer to Deploying SpotApps.
Okta Application Management SpotApp schema
The following table describes the schema for the Okta Application Management SpotApp.
| Table/View | Column | Column type | Required |
|---|---|---|---|
SYSLOG |
actor.id |
varchar |
N |
SYSLOG |
event_type |
varchar |
Y |
SYSLOG |
uuid |
varchar |
N |
SYSLOG |
timestamp |
date_time |
Y |
SYSLOG |
severity |
varchar |
Y |
SYSLOG |
display_message |
varchar |
N |
SYSLOG |
outcome.result |
varchar |
Y |
SYSLOG |
outcome.reason |
varchar |
Y |
SYSLOG |
actor.type |
varchar |
N |
SYSLOG |
actor.display_name |
varchar |
Y |
SYSLOG |
actor.alternate_id |
varchar |
N |
SYSLOG |
authentication_context.authentication_provider |
varchar |
N |
SYSLOG |
authentication_context.credential_type |
varchar |
N |
SYSLOG |
authentication_context.external_session_id |
varchar |
N |
SYSLOG |
client.ip_address |
varchar |
Y |
SYSLOG |
client.device |
varchar |
Y |
SYSLOG |
client.user_agent.raw_user_agent |
varchar |
Y |
SYSLOG |
client.user_agent.os |
varchar |
Y |
SYSLOG |
client.user_agent.browser |
varchar |
N |
SYSLOG |
client.geographical_context.country |
varchar |
Y |
SYSLOG |
client.geographical_context.city |
varchar |
N |
SYSLOG |
client.geographical_context.postal_code |
varchar |
N |
SYSLOG |
client.geographical_context.geolocation.lon |
varchar |
Y |
SYSLOG |
client.geographical_context.geolocation.lat |
varchar |
Y |
SYSLOG |
transaction.id |
varchar |
N |
SYSLOG |
transaction.type |
varchar |
N |
SYSLOG |
target0.id |
varchar |
N |
SYSLOG |
target0.type |
varchar |
Y |
SYSLOG |
target0.alternate_id |
varchar |
N |
SYSLOG |
target0.display_name |
varchar |
Y |
