> For the complete documentation index, see [llms.txt](https://docs.scanner.dev/scanner/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/cisco-duo.md).

# Cisco Duo

This guide explains how to collect Cisco Duo logs directly from the [Duo Admin API](https://duo.com/docs/adminapi), store the raw logs in S3, and index them for search and detection.

Scanner supports two Cisco Duo log types, shown by their raw source types in the UI:

* **`cisco_duo:admin`** collects Activity Logs v2, including administrator actions and configuration changes.
* **`cisco_duo:auth`** collects Authentication Logs v2, including user authentication attempts and outcomes.

## Prerequisites

Before you begin, make sure you have:

* A paid Duo plan that includes Admin API access.
* A Duo administrator with the **Owner** role. An Owner must create or modify the Admin API application used by Scanner.
* Permission in Scanner to create integrations and Collect Rules.

## Create a Collect Rule

{% stepper %}
{% step %}

### Create a New Source

In the Scanner UI, go to the **Collect** tab.

* From the Overview page, click the **+** icon in the upper-right corner.
* Select **Collect Rule**.
* On **Create a New Collect Rule**, choose **Cisco Duo**.
* On **Select a Log Type**, select:
  * **`cisco_duo:admin`** for Duo Activity Logs v2.
  * **`cisco_duo:auth`** for Duo Authentication Logs v2.
    {% endstep %}

{% step %}

### Configure the Collect Rule Source

* Set a **Display Name**, such as `my-org-duo-admin` or `my-org-duo-auth`.
  {% endstep %}

{% step %}

### Connect a Cisco Duo Account

* If you have already created a Cisco Duo connection, select it from the list and continue to the next step.
* Otherwise, select **New Cisco Duo Connection** and enter:
  * **Connection Name**: A recognizable name for this connection.
  * **API Hostname**: The hostname assigned to the Duo Admin API application, such as `api-xxxxxxxx.duosecurity.com`.
  * **Integration Key**: The integration key assigned to the application.
  * **Secret Key**: The secret key assigned to the application. Scanner masks this value and does not display it after the connection is created.

To create the credentials in Duo:

1. Sign in to the Duo Admin Panel as an Owner.
2. Go to **Applications** > **Application Catalog** and add an **Admin API** application.
3. Copy the application's API hostname, integration key, and secret key into Scanner.
4. Enable **Grant read log** for the application and save the changes.

Treat the secret key like a password. Scanner validates the hostname, credentials, and log-read permission before saving the connection. See the [Duo Admin API setup instructions](https://duo.com/docs/adminapi) for additional detail.
{% endstep %}

{% step %}

### Logs Destination

* Choose the **S3 Bucket** where the raw Cisco Duo logs should be stored.
* Optionally, enter a **Bucket Prefix** to organize the data path in your bucket.
  {% endstep %}

{% step %}

### Review and Create

Review the Collect Rule settings on the **Final Review** screen. Resolve any connection or permission errors before creating the rule.
{% endstep %}
{% endstepper %}

## Create an Index Rule

Scanner polls the selected Duo Admin API endpoint every **5 minutes**. The first pull has a **7-day lookback**, and each pull uses a **5-minute safety delay** so Scanner does not request logs that may still be arriving in Duo.

Create an Index Rule to index the logs for fast search and detections.

{% content-ref url="/pages/Gem9jwD4aqayN3OiChpN" %}
[Create an Index Rule](/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule.md)
{% endcontent-ref %}

### Cisco Duo Defaults

When you create an Index Rule from the Collect Rule, Scanner pre-populates:

* **Transformations**: Add Metadata, Parse JSON Fields, ECS normalization: Cisco Duo.
* **Timestamp Fields**:
  * **`cisco_duo:admin`**: `.ts`.
  * **`cisco_duo:auth`**: `.isotimestamp`, then `.timestamp` as a fallback.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/cisco-duo.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.