> ## Documentation Index > Fetch the complete documentation index at: https://specterops-fetch-json-component.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Cypher Queries > Default Cypher queries for the OktaHound extension Applies to BloodHound Enterprise and CE The following custom Cypher queries can be imported into BloodHound to enhance visibility. Each query is defined in a JSON file located in the [Queries](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries) directory of the OktaHound repository. This file is automatically generated from the [JSON query files](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries) that are bundled with the `OktaHound` collector. ## Agents, Agent Pools, and Host Servers Lists Okta agents, their associated agent pools, and the AD servers hosting each agent. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_AgentPool)<-[:Okta_AgentMemberOf|Okta_HostsAgent*1..2]-(:Okta_Agent:Computer) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [ad-agents.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/ad-agents.json) file. ## Principals with Admin Console Access Identifies principals with access to the Okta Admin Console. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta)-[:Okta_AppAssignment]->(c:Okta_Application) WHERE c.appType = "saasure" RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [admin-console-access.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/admin-console-access.json) file. ## Application Assignments List all application assignments. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta)-[:Okta_AppAssignment]->(:Okta_Application) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [app-assignments.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/app-assignments.json) file. ## Application Credentials Lists all service application secrets and JWTs. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Application)<-[:Okta_SecretOf|Okta_KeyOf]->(:Okta_ClientSecret:Okta_JWK) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [app-credentials.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/app-credentials.json) file. ## Devices List all devices, their owners, and any mobile admins. ```cypher theme={null} MATCH p = (:Okta_Device)-[:Okta_DeviceOf]->(:Okta_User) OPTIONAL MATCH q = (:Okta_User:Okta_Group:Okta_Application)-[:Okta_MobileAdmin]->(:Okta_Device) RETURN p,q LIMIT 1000 ``` This query can be imported into BloodHound from the [devices.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/devices.json) file. ## Group Membership Retrieves all group membership relationships. ```cypher theme={null} MATCH p = (:Okta_User)-[:Okta_MemberOf]->(:Okta_Group) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [group-members.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/group-members.json) file. ## Hybrid Relationships Inbound Retrieves all hybrid relationships from external systems to Okta. ```cypher theme={null} MATCH p = (n)-[]->(:Okta) WHERE NOT n:Okta RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [hybrid-inbound.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/hybrid-inbound.json) file. ## Hybrid Relationships Outbound Retrieves all hybrid relationships from Okta to external systems. ```cypher theme={null} MATCH p = (:Okta)-[]->(n) WHERE NOT n:Okta RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [hybrid-outbound.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/hybrid-outbound.json) file. ## Security Principal Synchronization Retrieves all users and groups that are synchronized TO or FROM Okta. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta)-[:Okta_UserPull|Okta_UserPush|Okta_GroupPull|Okta_GroupPush]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [hybrid-sync.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/hybrid-sync.json) file. ## Identity Provider Assignments - Direct Privileged Access Identity providers associated with users or groups that hold direct privileged role assignments in Okta. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_IdentityProvider)-[:Okta_IdentityProviderFor|Okta_IdpGroupAssignment]->(:Okta_User:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [identity-providers-direct-privileged.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/identity-providers-direct-privileged.json) file. ## Identity Provider Assignments - Indirect Privileged Access Identity providers associated with users who hold privileged role assignments through group membership in Okta. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_IdentityProvider)-[:Okta_IdentityProviderFor]->(:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [identity-providers-indirect-privileged.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/identity-providers-indirect-privileged.json) file. ## Identity Provider Assignments Lists all identity providers and the users and groups they are associated with, including per-user trust relationships and automatic group assignments. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_IdentityProvider)-[:Okta_IdentityProviderFor|Okta_IdpGroupAssignment]->(:Okta_User:Okta_Group) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [identity-providers.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/identity-providers.json) file. ## Organizational Structure Retrieves all manager relationships. ```cypher theme={null} MATCH p = (:Okta_User)-[:Okta_ManagerOf]->(:Okta_User) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [org-chart.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/org-chart.json) file. ## Org Trust Relationships Lists all org-to-org trust relationships including inbound and outbound SSO federation, Secure Web Authentication (SWA), and Kerberos SSO relationships between Okta applications and supported external organizations or tenants. ```cypher theme={null} MATCH p = (:Okta_Application:Okta_IdentityProvider)-[:Okta_InboundOrgSSO|Okta_OutboundOrgSSO|Okta_OrgSWA|Okta_KerberosSSO]-() RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [org-trust-relationships.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/org-trust-relationships.json) file. ## Password and MFA Permissions Lists permissions to reset passwords and MFA factors. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_ResetPassword|Okta_ResetFactors|Okta_HelpDeskAdmin|Okta_OrgAdmin|Okta_GroupAdmin]->(:Okta_User) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [password-and-mfa-permissions.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/password-and-mfa-permissions.json) file. ## Policy Mappings Retrieves all policy mappings. ```cypher theme={null} MATCH policies = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Policy) MATCH mappings = (:Okta_Policy)-[:Okta_PolicyMapping]->(:Okta) RETURN policies,mappings LIMIT 1000 ``` This query can be imported into BloodHound from the [policy-mappings.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/policy-mappings.json) file. ## Unrotated Active Access Keys on Privileged Apps Finds active JWKs or client secrets older than 365 days on applications that have role assignments. ```cypher theme={null} MATCH p = (s:Okta_JWK:Okta_ClientSecret)-[:Okta_KeyOf|Okta_SecretOf]->(:Okta_Application)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE s.status = "ACTIVE" AND datetime(s.created) <= datetime() - duration("P365D") RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-app-unrotated-access-keys.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-app-unrotated-access-keys.json) file. ## Applications with Role Assignments Applications that have roles assigned. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Application)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-apps.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-apps.json) file. ## Synced Principals with Privileged Access (Direct) - Hybrid Edges Users, groups, and applications with inbound hybrid relationships (sync, SSO, or AD agent) that hold privileged role assignments in Okta. ```cypher theme={null} MATCH p = ()-[:Okta_UserSync|Okta_MembershipSync|Okta_InboundSSO|Okta_HostsAgent]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-hybrid-inbound-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-hybrid-inbound-direct.json) file. ## Synced Principals with Privileged Access (Indirect) - Hybrid Edges Users and applications with inbound hybrid relationships (sync, SSO, or AD agent) that hold privileged role assignments through group membership in Okta. ```cypher theme={null} MATCH p = ()-[:Okta_UserSync|Okta_InboundSSO|Okta_HostsAgent]->(:Okta_User:Okta_Application)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-hybrid-inbound-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-hybrid-inbound-indirect.json) file. ## Synced Principals with Privileged Access (Direct) - Okta Edges Users and groups synchronized from external sources that have privileged role assignments. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Application:Okta_IdentityProvider)-[:Okta_UserPull|Okta_GroupPull|Okta_IdentityProviderFor|Okta_IdpGroupAssignment]->(:Okta)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-principals-hybrid-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-principals-hybrid-direct.json) file. ## Synced Principals with Privileged Access (Indirect) - Okta Edges Users synchronized from external sources that hold privileged role assignments through group membership in Okta. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Application:Okta_IdentityProvider)-[:Okta_UserPull|Okta_IdentityProviderFor]->(:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-principals-hybrid-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-principals-hybrid-indirect.json) file. ## Privileged Users without MFA (Direct) Users who do not have multi-factor authentication enabled and directly hold privileged role assignments. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.authenticationFactors = 0 RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-no-mfa-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-no-mfa-direct.json) file. ## Privileged Users without MFA (Indirect) Users who do not have multi-factor authentication enabled and hold privileged role assignments through group membership. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.authenticationFactors = 0 RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-no-mfa-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-no-mfa-indirect.json) file. ## Privileged Users with Old Passwords (Direct) Finds users whose last password change was more than a year ago and directly hold privileged role assignments. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.passwordChanged IS NOT NULL AND datetime(u.passwordChanged) <= datetime() - duration("P365D") RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-old-passwords-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-old-passwords-direct.json) file. ## Privileged Users with Old Passwords (Indirect) Finds users whose last password change was more than a year ago and hold privileged role assignments through group membership. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.passwordChanged IS NOT NULL AND datetime(u.passwordChanged) <= datetime() - duration("P365D") RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-old-passwords-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-old-passwords-indirect.json) file. ## Privileged Users with Non-Active Status (Direct) Finds users whose status is not ACTIVE and directly hold privileged role assignments, including deactivated, suspended, or provisioning-incomplete accounts. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.status <> "ACTIVE" RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-unexpected-status-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-unexpected-status-direct.json) file. ## Privileged Users with Non-Active Status (Indirect) Finds users whose status is not ACTIVE and hold privileged role assignments through group membership, including deactivated, suspended, or provisioning-incomplete accounts. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.status <> "ACTIVE" RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [privileged-users-unexpected-status-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/privileged-users-unexpected-status-indirect.json) file. ## Read Client Secrets of Privileged Applications Searches for client secrets associated with privileged applications that are readable to non-Super Admins. ```cypher theme={null} MATCH p = (:Okta)-[:Okta_ReadClientSecret|Okta_MemberOf*1..2]->(:Okta_ClientSecret)-[:Okta_SecretOf]->(:Okta_Application)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [read-client-secrets.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/read-client-secrets.json) file. ## Realm Membership Lists all Okta realms and the users assigned to them. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Realm)-[:Okta_RealmContains]->(:Okta_User) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [realm-membership.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/realm-membership.json) file. ## Resource Set Membership Lists all resource sets and their associated members. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_ResourceSet)-[:Okta_ResourceSetContains]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [resource-set-membership.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/resource-set-membership.json) file. ## Application Administrators and Managers List all Application Administrators and Managers. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_AppAdmin|Okta_ManageApp]->(:Okta_Application:Okta_ApiServiceIntegration) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [role-app-admins.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/role-app-admins.json) file. ## Role Assignments - Role Assignments and Scope Lists all role assignments and scope, including transitive group membership. ```cypher theme={null} MATCH p = (:Okta)-[:Okta_HasRoleAssignment|Okta_MemberOf*1..2]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [role-assignments.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/role-assignments.json) file. ## Role Assignments - All Custom Roles Lists all role assignments, linking principals to their assigned custom roles. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_HasRole]->(:Okta_CustomRole) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [role-custom-assignments.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/role-custom-assignments.json) file. ## Role Assignments - All Built-in Roles Lists all role assignments, linking principals to their assigned built-in roles. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_HasRole]->(:Okta_Role) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [role-direct-assignments.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/role-direct-assignments.json) file. ## Role Assignments - Group Administrators List all Group Administrators and Group Membership Administrators. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_User:Okta_Group:Okta_Application)-[:Okta_GroupAdmin|Okta_GroupMembershipAdmin|Okta_OrgAdmin]->(:Okta_Group) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [role-group-admins.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/role-group-admins.json) file. ## SCIM Apps Receiving Password Updates Lists application-to-user assignments where the app receives password updates. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta_Application)-[:Okta_ReadPasswordUpdates]->(:Okta_User) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [scim-read-passwords.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/scim-read-passwords.json) file. ## API Service Integration Creators Lists all API service integrations and their creators. ```cypher theme={null} MATCH p = (:Okta_Organization)-[:Okta_Contains]->(:Okta)-[:Okta_CreatorOf]->(:Okta_ApiServiceIntegration) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [service-integration-creators.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/service-integration-creators.json) file. ## Stale Privileged Users (Direct) Finds user accounts that have not logged in for at least 180 days and directly hold privileged role assignments. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.lastLogin IS NULL OR datetime(u.lastLogin) <= datetime() - duration("P180D") RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [stale-privileged-accounts-direct.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/stale-privileged-accounts-direct.json) file. ## Stale Privileged Users (Indirect) Finds user accounts that have not logged in for at least 180 days and hold privileged role assignments through group membership. ```cypher theme={null} MATCH p = (u:Okta_User)-[:Okta_MemberOf]->(:Okta_Group)-[:Okta_HasRoleAssignment]->(:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta) WHERE u.lastLogin IS NULL OR datetime(u.lastLogin) <= datetime() - duration("P180D") RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [stale-privileged-accounts-indirect.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/stale-privileged-accounts-indirect.json) file. ## Secure Web Authentication Applications Secure Web Authentication (SWA) relationships between Okta users and their linked accounts in external applications. ```cypher theme={null} MATCH p = (:Okta_User)-[:Okta_SWA]->(n) WHERE NOT n:Okta RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [swa-applications.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/swa-applications.json) file. ## Inbound User and Group Synchronization Lists all inbound user and group synchronization relationships to Okta, including password synchronization across Org2Org setups. ```cypher theme={null} MATCH p = (n)-[:Okta_UserSync|Okta_MembershipSync|Okta_PasswordSync]->(:Okta_User:Okta_Group) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [sync-relationships-inbound.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/sync-relationships-inbound.json) file. ## Outbound User and Group Synchronization Lists all outbound user and group synchronization relationships from Okta, including password synchronization across Org2Org setups. ```cypher theme={null} MATCH p = (:Okta_User:Okta_Group)-[:Okta_UserSync|Okta_MembershipSync|Okta_PasswordSync]->(n) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [sync-relationships-outbound.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/sync-relationships-outbound.json) file. ## Tier Zero Principals and Devices Principals with SUPER\_ADMIN or ORG\_ADMIN role assignments and their associated devices. ```cypher theme={null} MATCH p = (:Okta)-[:Okta_HasRoleAssignment|Okta_MemberOf|Okta_DeviceOf*1..3]->(r:Okta_RoleAssignment)-[:Okta_ScopedTo]->(:Okta_Organization) WHERE r.type = "SUPER_ADMIN" OR r.type = "ORG_ADMIN" RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [tier0.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/tier0.json) file. ## Users with API Tokens Retrieves all (privileged) users who have been assigned API tokens. ```cypher theme={null} MATCH p = (:Okta_ApiToken)-[:Okta_ApiTokenFor]->(:Okta_User)<-[:Okta_Contains]-(:Okta_Organization) RETURN p LIMIT 1000 ``` This query can be imported into BloodHound from the [users-api-tokens.json](https://github.com/SpecterOps/OktaHound/tree/main/Src/Queries/users-api-tokens.json) file.