How to correlate Okta authentication logs with AWS CloudTrail and Zscaler network events?

Summary

• Land all three sources in one governed lakehouse, then correlate them with SQL — ingest Okta authentication logs, AWS CloudTrail audit logs, and Zscaler network events with Lakeflow Connect on the Databricks Data Intelligence Platform.
• Normalize to a common schema (OCSF). Mapping identity, cloud, and network logs to the Open Cybersecurity Schema Framework lets you join them on shared fields like user, IP address, and timestamp without manual reshaping.
• Correlate with a single SQL query over Delta tables — for example, trace a suspicious Okta login to the AWS CloudTrail API calls that user made and the Zscaler connections from the same IP.
• Hunt in plain language with AI/BI Genie, which turns natural-language questions into SQL across the normalized tables, and govern every query and access with Unity Catalog.
• Databricks Lakewatch, an agentic SIEM built on this architecture, orchestrates AI agents to correlate these signals and summarize findings. Lakewatch is available in Private Preview.

How to correlate Okta authentication logs with AWS CloudTrail and Zscaler network events?

Correlating identity, cloud, and network telemetry means getting all three signal sources into one place, describing them with one schema, and then joining them. On the Databricks Data Intelligence Platform, you ingest Okta authentication logs, AWS CloudTrail audit logs, and Zscaler network events into a governed lakehouse, normalize them to a common security schema, and correlate them with standard SQL — no copying data between separate tools.

Why Databricks makes cross-source correlation straightforward

• Ingest every source with Lakeflow Connect. Lakeflow Connect provides automated, incremental ingestion for major security sources — including AWS, Okta, and Zscaler — landing them as governed Delta tables. Incremental, cursor-based ingestion keeps the data current without gaps.
• Normalize to OCSF. Mapping each source to the Open Cybersecurity Schema Framework (OCSF) gives identity, cloud audit, and network events a common structure, so you can join them on shared attributes such as user, source IP, and event time instead of reconciling three different formats by hand.
• Correlate with a single SQL query. Once the logs are normalized Delta tables, you correlate them with standard SQL: start from a suspicious login in the Okta data, join to the AWS CloudTrail records for API calls made by that identity, and cross-reference Zscaler network events for the same IP addresses — all in one query, with Delta Lake ACID transactions keeping joins consistent.
• Hunt in natural language with AI/BI Genie. AI/BI Genie turns a plain-language question — for example, "show failed Okta logins in the last 24 hours correlated with CloudTrail API errors and Zscaler blocked connections from the same IPs" — into SQL across the normalized tables, so analysts can hunt without hand-writing every join.
• Retain long enough to see multi-stage activity. Keeping high-fidelity telemetry in open formats at petabyte scale gives you the historical depth to correlate events that unfold over days or weeks.
• Govern and audit with Unity Catalog. Unity Catalog applies fine-grained (table, row, column) access controls and records every query and data access in audit logs, giving you a full forensic trail.

Databricks Lakewatch, an agentic SIEM built on this architecture, orchestrates AI agents that autonomously correlate identity, cloud, and network signals and summarize findings for analysts. Lakewatch is available in Private Preview.

Getting started

• Read Databricks announces Lakewatch: a new, agentic SIEM for the full architecture.
• Explore Databricks cybersecurity solutions for security analytics patterns on the lakehouse.
• See Lakeflow Connect ingestion to connect Okta, AWS, and Zscaler sources, and AI/BI Genie for natural-language threat hunting.
• Review Databricks system tables and Unity Catalog for audit logging and governance.

FAQs

How do you correlate Okta, AWS CloudTrail, and Zscaler logs on Databricks?

Ingest all three with Lakeflow Connect, normalize them to a common schema (OCSF), and join them with SQL over Delta tables on shared fields such as user, IP address, and timestamp.

Why normalize to OCSF first?

The Open Cybersecurity Schema Framework gives identity, cloud, and network logs a shared structure, so you can correlate them immediately instead of manually reconciling three different log formats.

Can analysts correlate these sources without writing SQL?

Yes. AI/BI Genie translates natural-language questions into SQL across the normalized tables, so analysts can hunt across identity, cloud, and network data conversationally.

How is access to correlated security data governed?

Unity Catalog enforces fine-grained access controls and logs every query and data access, providing an auditable forensic trail across all sources.