Duo Security

Source Connector

Overview

Duo Security

This source connector fetches logs from the Duo Admin API.

Streams

Data SourceStream Name
Authentication Logsauthentication_logs
Authentication Logs (Legacy v1)administrator_logs
Activity Logsactivity_logs
Offline Enrollment Logsoffline_enrollment_logs
Telephony Logs (Legacy v1)telephony_logs

Prerequisites

Duo Security HTTP requests to the REST API are protected with HTTP Basic authentication. You will use your Duo Security Integration Key as the username and your Secret Key as the password for HTTP Basic authentication along with the API hostname.

Under Protect an Application, locate the entry for Admin API in applications list. Click Protect to the far-right to configure the application and get your integration key, secret key, and API hostname. You'll need this information to complete your setup.

Find more details about setting up Admin API here.

Configuration

FieldRequiredDescription
Start DatenoDate and time in UTC.
Authentication logs before this datetime will not be replicated.
2020-10-01T00:00:00Z

Authentication

FieldRequiredDescriptionExample
API HostnameyesAPI Hostnameapi-12345678.duosecurity.com
Integration KeyyesAPI Integration KeyABC123...GH789JK
Secret KeyyesAPI Secret Keyabc123...kx9ZFPH

Connector Limitations

  1. The API is limited by a rate limit of 1 call/minute. Meaning running 2 tests in the same minute may fail, or running a test while a connector is running may cause either the test or the connector's API request to fail.
  2. Data ingestion may be affected by the Log Retention settings in the Duo Admin Panel.