Skip to content

feat: Add LogUserBehavior model and comprehensive System Log userBehaviors support#509

Open
BinoyOza-okta wants to merge 1 commit intomasterfrom
OKTA-1124816
Open

feat: Add LogUserBehavior model and comprehensive System Log userBehaviors support#509
BinoyOza-okta wants to merge 1 commit intomasterfrom
OKTA-1124816

Conversation

@BinoyOza-okta
Copy link
Contributor

feat: Add LogUserBehavior model and System Log userBehaviors documentation

This commit adds comprehensive support for the userBehaviors field in Okta System Log events, including the new LogUserBehavior model, updated OpenAPI specification, and complete documentation.

Core Changes

OpenAPI Specification (openapi/api.yaml)

  • Add new LogUserBehavior schema component with properties:
    • id: Unique identifier of the user behavior detection model
    • name: Name of the user behavior detection model
    • result: Result of user behavior analysis (UNKNOWN, POSITIVE, NEGATIVE, BAD_REQUEST)
  • Update LogSecurityContext.userBehaviors to reference LogUserBehavior schema
  • Add lifecycle feature flag: SECURITY_CONTEXT_AND_IP_CHAIN_SYSLOG_IMPROVEMENT

Model Implementation (okta/models/)

  • Add new log_user_behavior.py model class
  • Update log_security_context.py to use List[LogUserBehavior] instead of List[str]
  • Implement proper serialization/deserialization for userBehaviors array
  • Add type-safe handling in to_dict() and from_dict() methods

Documentation (docs/)

  • Add LogUserBehavior.md model documentation
  • Update LogSecurityContext.md to reflect new userBehaviors type

Module Exports

  • Add LogUserBehavior to okta/__init__.py exports
  • Add LogUserBehavior to okta/models/__init__.py exports

What are userBehaviors?

userBehaviors are part of Okta's risk-based authentication system that detect behavioral patterns during authentication events:

  • New Device: Login from unrecognized browser/device
  • New Geo-Location: Login from different city/state/country
  • New IP: Login from new IP address
  • Velocity: Multiple rapid login attempts

Breaking Changes

None. This is a backward-compatible enhancement that changes the type of userBehaviors from List[str] to List[LogUserBehavior], providing structured data instead of plain strings.

API Reference

Files Changed

Modified:

  • openapi/api.yaml
  • okta/models/log_security_context.py
  • okta/init.py
  • okta/models/init.py
  • docs/LogSecurityContext.md

Added:

  • okta/models/log_user_behavior.py
  • docs/LogUserBehavior.md

…viors support

Add structured LogUserBehavior model to replace string-based userBehaviors in System Log events. Includes OpenAPI spec updates, Python SDK implementation, and complete documentation.

Key changes:
- New LogUserBehavior model with id, name, and result fields
- Updated LogSecurityContext to use List[LogUserBehavior]
- Comprehensive documentation

Backward-compatible enhancement providing structured data for risk-based authentication analysis.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant