I am trying to retrieve logs to send to a SIEM platform.
I was reading the documents and realized that the next Link relation header will exist regardless of wether there are new logs when using polling requests.
In this case, how should one determine if the url is the last one containing logs?
Is using bounding requests the only option?
Hi @yuki.nakai
You can use https://developer.okta.com/docs/reference/api/system-log/#transferring-data-to-a-separate-system to retrieve all the logs in the past 3 from your Okta org as JSON and pass it to your SIEM platform.
@Govner @dragos
Thank you both for your replies.
I have been misunderstanding the situation all along and currently have no issues forwarding.
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.