Add page for Okta event source

Like Cloudwatch, mostly pointers to other pages, but this allows for
the event sources to be enumerated in one place.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

content/en/docs/event-sources/_index.md

@@ -13,5 +13,6 @@ Currently, Falco supports the following built-in event sources:
 Falco also supports the following event sources via officially supported [plugins](../plugins):
 
 * [AWS Cloudtrail](./cloudtrail)
+* [Okta](./okta)
 
 In addition to these event sources, others have written third-party [plugins](https://github.com/falcosecurity/plugins#readme) that support additional event sources.

content/en/docs/event-sources/okta.md

@@ -0,0 +1,40 @@
+---
+title: Okta Events
+weight: 2
+---
+
+The Falco [Okta](https://github.com/falcosecurity/plugins/blob/master/plugins/okta/README.md) plugin can read [Okta](https://www.okta.com/) logs and emit events for each Okta log entry.
+
+Falco also distributes out-of-the-box [rules](https://github.com/falcosecurity/falco/blob/master/rules/okta_rules.yaml) that can be used to identify interesting/suspicious/notable events in Okta logs, including:
+
+* Creating a new OKTA user account
+* Detecting a locked-out user
+* Assigning admin permissions to an okta user
+
+# Configuration
+
+See the [README](https://github.com/falcosecurity/plugins/blob/master/plugins/okta/README.md#settings) for information on configuring the plugin. This simply involves providing the `organization/api` token as part of init params. These can be added to `falco.yaml` under the `plugins` [configuration key](https://falco.org/docs/configuration/) key.
+
+The plugin does not use any open params configuration.
+
+# Sample Output
+
+For example, when using a dummy rule as follows:
+
+```
+- rule: Dummy
+  desc: Dummy
+  condition: okta.app!=""
+  output: "evt=%okta.evt.type user=%okta.actor.name ip=%okta.client.ip app=%okta.app"
+  priority: DEBUG
+  source: okta
+  tags: [okta]
+```
+
+The dummy rule will emit an alert for each Okta log entry, like the following:
+
+```
+19:12:25.439350000: Debug evt=user.authentication.sso user=User1 ip=x.x.x.x app=google
+19:12:30.675628000: Debug evt=user.authentication.sso user=User2 ip=x.x.x.x app=github
+19:12:35.918456000: Debug evt=user.authentication.sso user=User3 ip=x.x.x.x app=office365
+```