move okta default event structure to details for consistency with other event structures