# es_loader ã«ã‚ˆã‚‹ Okta ã®ãƒã‚°å–ã‚Šè¾¼ã¿ ä»¥ä¸‹ã®æµã‚Œã§ Okta ã®ç›£æŸ»ãƒã‚°ã‚’å–り込ã¿ã¾ã™ã€‚ 1. Okta コンソールã§ãƒã‚°å–得用ã®ãƒˆãƒ¼ã‚¯ãƒ³ã‚’発行 2. 発行ã—ãŸãƒˆãƒ¼ã‚¯ãƒ³ã‚’使ㄠFetch スクリプトã§ãƒã‚°å–å¾—ã® API ã‚’å©ã 3. API ã§å–å¾—ã—ãŸãƒã‚°ã‚’ S3 ã¸å‡ºåŠ› 4. S3 ã¸ã®ã‚ªãƒ–ジェクトé…置㧠es-loader ãŒã‚ックã•れ OpenSearch ã¸ãƒãƒ¼ãƒ‰ ## Okta ã®ãƒã‚°ã‚’ S3 ã¸ä¿å˜ [ã“ã¡ã‚‰](https://github.com/yopiyama/fetch-okta-logs-lambda) ã® Fetch スクリプトを使用ã—ã€Okta ã®ãƒã‚°å–得を行ã„ã¾ã™ã€‚ ### Installation [Fetch スクリプトå´ã® README](https://github.com/yopiyama/fetch-okta-logs-lambda/blob/master/README.md) ã«è¨˜è¼‰ã—ã¦ã‚りã¾ã™ã€‚ ## Template `log-intra-audit-okta` 㨠`log-audit-saas` ã® Index Pattern をコンソールãªã©ã§åˆ¥é€”生æˆã™ã‚‹å¿…è¦ãŒã‚りã¾ã™ã€‚ ### Component Template ```json PUT _component_template/component_template_log-intra-audit-okta { "template": { "mappings": { "properties": { "okta.client.ip": { "type": "ip" }, "okta.security_context.as.number": { "type": "long" }, "okta.security_context.as.organization.name": { "fields": { "text": { "type": "text" } }, "type": "keyword" } } }, "aliases":{ "log-intra-audit-okta":{}, "log-audit-saas": {} } } } ``` ### Index Template ```json PUT _index_template/log-intra-okta-audit { "index_patterns": [ "log-intra-audit-okta-*" ], "composed_of": [ "component_template_log", "component_template_log-intra-audit-okta" ] } ```