Share Cortex XDR user risk intelligence with Okta for coordinated and rapid responses
to security events.
| Where Can I Use This? | What Do I Need? |
|---|
You can send user risk signals from Cortex XDR to Okta through the Shared
Signals Framework (SSF) Transmitter in Cloud Identity Engine (CIE). The SSF
Transmitter enables the exchange of the risks signals. The CIE functions as the
signal "transmitter" while Okta is the "receiver." All Cortex XDR risk signals sync
with the CIE and flow through the SSF stream to Okta. These signals indicate whether
a user's risk is low, medium, or high. Okta uses these signals along with its own
insights to enforce
risk entity policy rules that you define.
For example, you can create a rule that logs users out of all active sessions and
supported applications when Okta detects high-risk user activity during an active
Okta session. By sharing risk intelligence between platforms, your security
infrastructure can respond to threats in a coordinated, rapid manner.
How The SSF Transmitter Works
Cortex XDR detects high-risk user activity during an active Okta
session. For example, a user risk level is now high.
Cortex XDR syncs user risk and device risk data with the Cloud
Identity Engine.
The CIE receives this data and sends it to Okta as security events
through the SSF Transmitter.
Okta processes the signals as risk detection events and enforces
risk-based policy rules.
