System Log management

Learn about System Log management tool scopes, features, and capabilities, with sample workflows and example prompts.

Early Access release

Tool name

okta_syslog

Okta scope

okta.logs.read

What you can do

• Query System Log events by user, event type, date range
• Retrieve System Log events
• Search System Log events using free-text keyword search
• Filter System Log events by time range using ISO 8601 time stamps
• Paginate through large result sets using a cursor
• Default to the last 24 hours if no time range is specified
• Provide read-only access with no data modification
• Reduce processing costs with token-optimized responses

Sample use cases

Use case	Prompt	Result
Alice Johnson's account might be compromised. The admin wants to confirm it's her account, then review her failed sign-ins from the last seven days to check for break-in attempts.	Look up the user alice.johnson@company.com, then show me her failed authentication events from the System Log over the last seven days, with the time stamp, location, and client for each.	Alice's account is confirmed, and her failed sign-in events from the last seven days are listed with each event's time stamp, location, and client, so you can spot suspicious attempts.
Someone was recently given admin access. The admin wants to confirm it was legitimate by reviewing the grant event, who performed it, and whether it came through the UI or an API token.	Show me the admin-role grant events in the System Log from the last seven days, and for each one tell me the grantee, who granted it, and whether it was done through the browser (UI) or an API token.	The admin-grant events from the last 7 days are listed, each showing the grantee, the actor who granted it, and whether it came from a browser session or an API token, so you can confirm the grant was expected.