ast okta

Identity incidents in Okta demand fast investigation and precise containment. Manual searching through the Okta System Log or checking MFA coverage across thousands of users slows down your response time. This skill provides a command-line and MCP-based toolkit to audit configurations, hunt through logs, and execute targeted containment actions like session revocation.

What it does

• Identity Investigation performs user lookups, group membership checks, and factor enrollment audits.
• System Log Hunting executes deep searches against Okta System Logs for specific IPs, actors, or events.
• Security Auditing reviews org configurations including policies, zones, app integrations, and IdPs.
• MFA Census identifies users with weak or missing multi-factor authentication coverage.
• Threat Containment suspends compromised accounts and revokes active web sessions or OAuth tokens.

How it works

1. Environment Setup run the install.sh script to build the Python virtual environment and local AST packages.
2. Credential Management use sectools secrets to securely map Okta API tokens to the system keychain or a local .env file.
3. Diagnostic Check run sectools doctor --live to verify connectivity and permission scopes for the Okta domain.
4. Active Investigation call okta-search via CLI or MCP to retrieve JSON-formatted telemetry and configuration data.
5. Authorized Response propose a suspend or revoke action, then execute only after receiving explicit user approval.

Frameworks & tools

Built for Python 3.12+, this skill utilizes the AST okta-search CLI and sectools-mcp server. It interfaces directly with Okta org domains via HTTPS.

Why this beats prompting it yourself

Generic LLMs lack direct access to your live Okta environment and often hallucinate API capabilities. This skill provides a structured safety model that requires explicit approval for writes, handles credential storage outside of the chat history, and ensures zero-row results are not misinterpreted as proof of absence.

Use cases

• Identify all users who signed in from a specific malicious IP address today.
• Audit which administrators have not enrolled in phishing-resistant MFA factors.
• Revoke all active sessions and OAuth tokens for a specific user after a laptop theft.
• Compare Classic vs Identity Engine configurations across multiple Okta zones.

Known limitations

Does not support Microsoft Entra ID, Azure AD, on-prem Active Directory, or Auth0. Write actions are strictly limited to account suspension and session revocation; it cannot reset passwords.