| 1 | --- |
| 2 | title: Duo |
| 3 | description: Ingest Duo authentication logs into the SOCFortress SIEM stack using the Duo Admin API. |
| 4 | --- |
| 5 | |
| 6 | ## What this integration is |
| 7 | |
| 8 | This integration ingests **Duo authentication and admin logs** into your SOCFortress SIEM stack via the **Duo Admin API**. |
| 9 | |
| 10 | Vendor reference: |
| 11 | - Duo Admin API overview: https://duo.com/docs/adminapi#overview |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## What data you get (high level) |
| 16 | |
| 17 | - Authentication logs |
| 18 | - Telephony logs |
| 19 | - Administrator action logs |
| 20 | |
| 21 | --- |
| 22 | |
| 23 | ## Prerequisites |
| 24 | |
| 25 | - Duo Admin Panel access |
| 26 | - **Owner** role (required to create/modify Admin API applications) |
| 27 | |
| 28 | --- |
| 29 | |
| 30 | ## Credentials you’ll need |
| 31 | |
| 32 | From the Duo Admin Panel “Admin API” application: |
| 33 | - Integration key |
| 34 | - Secret key |
| 35 | - API hostname |
| 36 | |
| 37 | Permissions note: |
| 38 | - Grant the Admin API application **read log** permissions at minimum. |
| 39 | |
| 40 | --- |
| 41 | |
| 42 | ## CoPilot setup (recommended workflow) |
| 43 | |
| 44 | 1) Provision the customer. |
| 45 | 2) Add the **Duo** integration under the customer. |
| 46 | 3) Paste the integration key/secret key/API hostname. |
| 47 | 4) Validate logs appear in the SIEM. |
| 48 | |
| 49 | --- |
| 50 | |
| 51 | ## Security notes |
| 52 | |
| 53 | Treat the Duo secret key like a password: |
| 54 | - store it in a secure secrets manager |
| 55 | - rotate if exposure is suspected |
| 56 | |
| 57 | --- |
| 58 | |
| 59 | ## Troubleshooting |
| 60 | |
| 61 | - Confirm the Admin API application has the required permissions. |
| 62 | - Confirm the API hostname is correct for your Duo tenant. |
| 63 | - Check for clock drift on the collector (Duo auth is time-sensitive). |