Searching the Okta System Log for Actions Created by Group Rules
Last Updated:
Overview
Specific search filters allow administrators to search the Okta System Log for actions generated by Group Rules activities. This capability enables the tracking of Group Rule creation, updates, activation, deactivation, deletion, and triggering events.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Group Rules
- System Log
Solution
Which search filters locate Group Rule actions in the System Log?
Navigate to the System Log in the Okta Admin Console and enter the applicable search filter into the search field to locate events related to Group Rule creation, updates, activation, deactivation, deletion, or triggering.
- Navigate to Reports, and then select System Log in the Okta Admin Console.
- Enter the applicable search filter into the search field based on the desired event:
- After creating a Group Rule:
eventType eq "policy.rule.add" and target.detailEntry.policyType eq "group_rule"
- After updating a Group Rule:
eventType eq "policy.rule.update" and target.detailEntry.policyType eq "group_rule"
- For Group Rule activation:
eventType eq "policy.rule.activate" and target.detailEntry.policyType eq "group_rule"
- For Group Rule deactivation:
eventType eq "policy.rule.deactivate" and target.detailEntry.policyType eq "group_rule"
- After deleting a Group Rule:
eventType eq "policy.rule.delete" and target.detailEntry.policyType eq "group_rule"
- When a Group Rule triggers after the condition is successfully met:
eventType eq "group.user_membership.rule.trigger"
The System Log displays the event type, actor, and target details when a Group Rule triggers after a condition is successfully met.
The System Log displays the event details, including the Group Rule ID in the Debug Data section, when a Group Rule adds a user to a group.
Enter the event type and the specific Group Rule ID into the System Log search field to locate events where a user was added to a group by that rule.
eventType eq "group.user_membership.add" and debugContext.debugData.triggeredByGroupRuleId eq "<group_rule_id>"
