Cisco Duo

This guide explains how to collect Cisco Duo logs directly from the Duo Admin API, store the raw logs in S3, and index them for search and detection.

Scanner supports two Cisco Duo log types, shown by their raw source types in the UI:

• cisco_duo:admin collects Activity Logs v2, including administrator actions and configuration changes.
• cisco_duo:auth collects Authentication Logs v2, including user authentication attempts and outcomes.

Prerequisites

Before you begin, make sure you have:

• A paid Duo plan that includes Admin API access.
• A Duo administrator with the Owner role. An Owner must create or modify the Admin API application used by Scanner.
• Permission in Scanner to create integrations and Collect Rules.

Create a Collect Rule

1

Create a New Source

In the Scanner UI, go to the Collect tab.

• From the Overview page, click the + icon in the upper-right corner.
• Select Collect Rule.
• On Create a New Collect Rule, choose Cisco Duo.
• On Select a Log Type, select:

  • cisco_duo:admin for Duo Activity Logs v2.
  • cisco_duo:auth for Duo Authentication Logs v2.

2

Configure the Collect Rule Source

• Set a Display Name, such as my-org-duo-admin or my-org-duo-auth.

3

Connect a Cisco Duo Account

• If you have already created a Cisco Duo connection, select it from the list and continue to the next step.
• Otherwise, select New Cisco Duo Connection and enter:

  • Connection Name: A recognizable name for this connection.
  • API Hostname: The hostname assigned to the Duo Admin API application, such as api-xxxxxxxx.duosecurity.com.
  • Integration Key: The integration key assigned to the application.
  • Secret Key: The secret key assigned to the application. Scanner masks this value and does not display it after the connection is created.

To create the credentials in Duo:

1. Sign in to the Duo Admin Panel as an Owner.
2. Go to Applications > Application Catalog and add an Admin API application.
3. Copy the application's API hostname, integration key, and secret key into Scanner.
4. Enable Grant read log for the application and save the changes.

Treat the secret key like a password. Scanner validates the hostname, credentials, and log-read permission before saving the connection. See the Duo Admin API setup instructions for additional detail.

4

Logs Destination

• Choose the S3 Bucket where the raw Cisco Duo logs should be stored.
• Optionally, enter a Bucket Prefix to organize the data path in your bucket.

5

Review and Create

Review the Collect Rule settings on the Final Review screen. Resolve any connection or permission errors before creating the rule.

Create an Index Rule

Scanner polls the selected Duo Admin API endpoint every 5 minutes. The first pull has a 7-day lookback, and each pull uses a 5-minute safety delay so Scanner does not request logs that may still be arriving in Duo.

Create an Index Rule to index the logs for fast search and detections.

Create an Index Rule

Cisco Duo Defaults

When you create an Index Rule from the Collect Rule, Scanner pre-populates:

• Transformations: Add Metadata, Parse JSON Fields, ECS normalization: Cisco Duo.
• Timestamp Fields:

  • cisco_duo:admin: .ts.
  • cisco_duo:auth: .isotimestamp, then .timestamp as a fallback.