Discovering Unexpected Okta Attack Paths with BloodHound

OktaHound extends the BloodHound schema with the following node kinds: Icon Node Kind Okta_Agent Okta_AgentPool Okta_ApiServiceIntegration Okta_ApiToken Okta_Application Okta_AuthorizationServer Okta_ClientSecret Okta_CustomRole Okta_Device Okta_Group Okta_IdentityProvider Okta_JWK Okta_Organization Okta_Policy Okta_Realm Okta_ResourceSet Okta_Role Okta_RoleAssignment Okta_User OktaHound creates the following edge kinds: Edge NameDescriptionTraversableOkta_AddMemberAbility to add or remove members in scoped Okta groupsOkta_AgentMemberOfMembership of an Okta agent in an agent poolOkta_AgentPoolForRelationship between an AD agent pool and its backing AD applicationOkta_ApiTokenForUser ownership of an Okta API tokenOkta_AppAdminApplication administrator role assignmentOkta_AppAssignmentAssignment of users or groups to an Okta applicationOkta_ContainsContains relationship between the Okta organization and its objectsOkta_CreatorOfCreator relationship for API service integrationsOkta_DeviceOfOwnership relationship between a device and its assigned userOkta_GroupAdminGroup administrator role assignmentOkta_GroupMembershipAdminGroup membership administrator role assignmentOkta_GroupPullImport of group memberships from an external applicationOkta_GroupPushProvisioning of group memberships to an external applicationOkta_HasRoleAssignment of a built-in or custom role to a principalOkta_HasRoleAssignmentRelationship between a principal and a role assignmentOkta_HelpDeskAdminHelp desk administrator role assignmentOkta_HostsAgentRelationship between an AD server and the Okta agent running on that hostOkta_IdentityProviderForTrust relationship between an identity provider and Okta usersOkta_IdpGroupAssignmentIdentity provider group assignment to an Okta groupOkta_InboundOrgSSOSingle sign-on (SSO) from an external organization into OktaOkta_InboundSSOSSSO from an external identity provider