Send Okta events to Bronto

Overview

Okta’s Log Streaming feature pushes every System Log event to AWS EventBridge in near real time. From there, an EventBridge API Destination forwards them directly to Bronto — no Lambda function, no verification handshake, and no middleware required. This is the recommended approach for sending Okta events to Bronto. Okta Event Hooks are not a good fit for this direct integration because they require a verification payload exchange that Bronto ingestion endpoints do not support. To use Event Hooks, you would need to place a proxy service in front of Bronto to handle the verification step and then forward the events.

Prerequisites

A Bronto account and API key (how to create one)
An AWS account with permissions to configure EventBridge
Super admin access to your Okta org
Okta Log Streaming is available on Okta’s Enterprise plan. Contact Okta support to confirm it is enabled for your org.

How it works

Okta System Log → AWS EventBridge (partner event bus) → EventBridge Rule → API Destination → Bronto

Okta sends all System Log events to a dedicated EventBridge partner event bus. An EventBridge rule matches those events and routes them to a Bronto API Destination, which POSTs them to Bronto’s ingestion endpoint with your API key and routing headers attached.

Step 1 — Add the AWS EventBridge log stream in Okta

In the Okta Admin Console, go to Reports → Log Streaming.
Click Add Log Stream and select AWS EventBridge.
Fill in the configuration:

Field	Value
Name	`Bronto`
AWS Event Source Name	`okta-bronto` (no spaces or special characters)
AWS Account ID	Your 12-digit AWS account ID
AWS Region	Select the region closest to your Bronto region

Click Save. The stream appears as Active on the Log Streaming page.

Okta streams all System Log events — there is no event filtering available on the Okta side. Filtering can be applied at the EventBridge rule level if needed.

For full details, see the Okta Log Streaming documentation.

Step 2 — Activate the partner event bus in AWS

In the AWS Console, go to Amazon EventBridge → Partner event sources.
Find the pending event source — it will be named in the format:

aws.partner/okta.com/<your-okta-subdomain>/okta-bronto

Select it and click Associate with an event bus.
Set the required permissions and click Associate. The status changes to Active.

Step 3 — Create a Bronto connection in EventBridge

The connection stores your Bronto API key and routing headers. In EventBridge → API Destinations → Connections → Create connection:

Field	Value
Connection name	`bronto-connection`
Authorization type	`API Key`
API key name	`x-bronto-api-key`
API key value	`<YOUR_BRONTO_API_KEY>`

The x-bronto-dataset and x-bronto-collection headers are added at the API destination level, not the connection level. You will set these in Step 4 via the Invocation Http Parameters section in the console. Alternatively, you can set them on the connection via the AWS CLI:

aws events update-connection \
  --name bronto-connection \
  --auth-parameters '{
    "ApiKeyAuthParameters": {
      "ApiKeyName": "x-bronto-api-key",
      "ApiKeyValue": "<YOUR_BRONTO_API_KEY>"
    },
    "InvocationHttpParameters": {
      "HeaderParameters": [
        { "Key": "x-bronto-dataset", "Value": "Okta", "IsValueSecret": false },
        { "Key": "x-bronto-collection", "Value": "<YOUR_COLLECTION_NAME>", "IsValueSecret": false }
      ]
    }
  }'

Step 4 — Create a Bronto API destination

In EventBridge → API Destinations → Create API destination:

Field	Value
Name	`bronto-destination`
API destination endpoint	`https://ingestion.eu.bronto.io` (or `us`)
HTTP method	`POST`
Connection	`bronto-connection`

Expand Invocation Http Parameters and add two header parameters:

Parameter name	Key	Value
Header	`x-bronto-dataset`	`Okta`
Header	`x-bronto-collection`	`<YOUR_COLLECTION_NAME>`

Use the base endpoint https://ingestion.eu.bronto.io with no path. Do not append /v1/logs — that path accepts only OTLP protobuf. EventBridge sends JSON and must target the base endpoint.

Step 5 — Create an EventBridge rule

The rule must be created on the Okta partner event bus, not the default event bus. Rules on the default bus will not receive Okta events.

In EventBridge → Rules, change the event bus dropdown from default to aws.partner/okta.com/<your-subdomain>/okta-bronto.
Click Create rule.
Give the rule a name, e.g. okta-to-bronto.
Select Advanced builder (top left) for step-by-step configuration.
On the Build event pattern step, select Custom pattern (JSON editor) and paste:

{
  "source": [{
    "prefix": "aws.partner/okta.com"
  }],
  "detail-type": ["SystemLog"]
}

On the Select target(s) step, set:
- Target type: EventBridge API destination
- Select Use an existing API destination → bronto-destination
- Execution role: Create a new role for this specific resource (default)
Click through to Review and create.

A common mistake is creating the rule on the default event bus. Always confirm the event bus shown at the top of the Rules page matches your Okta partner event bus name before creating the rule.

Verify in Bronto

Open Bronto and go to Search. Trigger a test event, for example by signing in or out of the Okta Admin Console, and confirm the event appears in the UI. Each event arrives as a full Okta System Log record nested inside an EventBridge envelope. The Okta event payload is in the detail object.

What you will see in Bronto

Okta events arrive wrapped in the EventBridge event structure. The Okta System Log payload is in the detail field. Useful fields in Bronto include:

detail.eventType, for example user.session.start
detail.actor.alternateId, identifying who triggered the event
detail.outcome.result, showing success or failure
detail.published, the event timestamp
detail.severity

Common filters include:

detail.eventType
detail.actor.alternateId
detail.severity

Troubleshooting

No events appearing in Bronto? Confirm the Okta log stream shows as Active under Reports → Log Streaming and that the EventBridge partner event source is Associated in the AWS console.
Rule shows no invocations? Check that the rule is on the Okta partner event bus, not the default event bus. Go to EventBridge → Rules, switch the bus dropdown to aws.partner/okta.com/<your-subdomain>/okta-bronto, and confirm your rule appears there. Rules on the default bus will never receive Okta events.
Getting 401 errors? Verify the x-bronto-api-key value in the EventBridge connection matches a valid Bronto API key with the Ingestion role.
Events arriving without a dataset or collection? Confirm the x-bronto-dataset and x-bronto-collection header parameters are set in the Invocation Http Parameters section of the bronto-destination API destination.
Partner event source stuck in Pending? The source only becomes active after you associate it with an event bus in the AWS console — see Step 2.
Log Streaming not available in Okta? This feature requires the Okta Enterprise plan. Contact Okta support to enable it for your org.

​Overview

​Prerequisites

​How it works

​Step 1 — Add the AWS EventBridge log stream in Okta

​Step 2 — Activate the partner event bus in AWS

​Step 3 — Create a Bronto connection in EventBridge

​Step 4 — Create a Bronto API destination

​Step 5 — Create an EventBridge rule

​Verify in Bronto

​What you will see in Bronto

​Troubleshooting

Overview

Prerequisites

How it works

Step 1 — Add the AWS EventBridge log stream in Okta

Step 2 — Activate the partner event bus in AWS

Step 3 — Create a Bronto connection in EventBridge

Step 4 — Create a Bronto API destination

Step 5 — Create an EventBridge rule

Verify in Bronto

What you will see in Bronto

Troubleshooting