Testing your Okta visibility and detection with Dorothy and Elastic Security

This report presents Dorothy, a free tool that simulates attacker actions in Okta SSO (Discovery, Persistence, Defense Evasion) to help teams validate visibility and detections, and shows how Elastic Security ingests Okta system logs via Fleet/Filebeat and applies open detection rules to alert on suspicious behavior; it functions as a practical guide to measure and improve monitoring of cloud identity systems rather than documenting a specific incident.