DUO Admin

Details

ID	`DUO Admin`
Provider	Cisco Systems
Category	Authentication & Identity Management
From Version	5.0.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

DUO for admins.
Must have access to the admin api in order to use this.
This integration was integrated and tested with version 4.4.0 of DUO Admin

Configure DUO Admin in Cortex

Parameter	Required
API Hostname	True
Integration Key	True
Secret Key	True
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

duoadmin-get-authentication-logs-by-user

Returns authentication logs associated with a user. Limited to 30 at a time

Base Command

duoadmin-get-authentication-logs-by-user

Input

Argument Name	Description	Required
username	The user associated with the logs.	Required
from	Fetch logs from this time until now. Possible values are: 10_seconds_ago, 1_minute_ago, 10_minutes_ago, 1_hour_ago, 10_hours_ago, 1_day_ago, 1_week_ago, 1_month_ago, 1_year_ago, 5_years_ago, 10_years_ago.	Required
limit	The maximum number of authentication logs to return. Default is 50.	Optional

Context Output

Path	Type	Description
DuoAdmin.UserDetails.auth_logs.result	string	Result of the authentication attempt
DuoAdmin.UserDetails.auth_logs.event_type	string	Type of activity logged
DuoAdmin.UserDetails.auth_logs.reason	string	Reason for the authentication attempt result
DuoAdmin.UserDetails.auth_logs.access_device.ip	string	The GeoIP location of the access device. IP field
DuoAdmin.UserDetails.auth_logs.access_device.hostname	string	The GeoIP location of the access device. Hostname field
DuoAdmin.UserDetails.auth_logs.access_device.location.city	string	The GeoIP location of the access device. City field
DuoAdmin.UserDetails.auth_logs.access_device.location.state	string	The GeoIP location of the access device. State field
DuoAdmin.UserDetails.auth_logs.access_device.location.country	string	The GeoIP location of the access device. Country field
DuoAdmin.UserDetails.auth_logs.auth_device.ip	string	The GeoIP location of the authentication device. IP field
DuoAdmin.UserDetails.auth_logs.auth_device.hostname	string	The GeoIP location of the authentication device. Hostname field
DuoAdmin.UserDetails.auth_logs.auth_device.location.city	string	The GeoIP location of the authentication device. City field
DuoAdmin.UserDetails.auth_logs.auth_device.location.state	string	The GeoIP location of the authentication device. State field
DuoAdmin.UserDetails.auth_logs.auth_device.location.country	string	The GeoIP location of the authentication device. Country field
DuoAdmin.UserDetails.auth_logs.timestamp	date	Timestamp of the event
DuoAdmin.UserDetails.auth_logs.application.name	string	Name of the application accessed
DuoAdmin.UserDetails.auth_logs.factor	string	The authentication factor

duoadmin-dissociate-device-from-user

Dissociates a device from a user

Base Command

duoadmin-dissociate-device-from-user

Input

Argument Name	Description	Required
username	user to dissociate a device from.	Required
device_id	the device id to dissociate.	Required

Context Output

There is no context output for this command.

duoadmin-delete-u2f-token

Delete a u2f token

Base Command

duoadmin-delete-u2f-token

Input

Argument Name	Description	Required
token_id	the id of the token to delete.	Required

Context Output

There is no context output for this command.

duoadmin-get-users

Return usernames and their user id

Base Command

duoadmin-get-users

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
DuoAdmin.UserDetails.username	string	Username
DuoAdmin.UserDetails.user_id	string	User Id
DuoAdmin.UserDetails.status	string	Status
DuoAdmin.UserDetails.is_enrolled	boolean	is_enrolled
DuoAdmin.UserDetails.last_login	date	Last_login
DuoAdmin.UserDetails.realname	string	Real Name
DuoAdmin.UserDetails.email	string	Email
DuoAdmin.UserDetails.phones	unknown	Phone numbers

duoadmin-get-devices-by-user

Return devices associated with a user

Base Command

duoadmin-get-devices-by-user

Input

Argument Name	Description	Required
username	Username.	Required

Context Output

Path	Type	Description
DuoAdmin.UserDetails.phones.phone_id	string	Device Id
DuoAdmin.UserDetails.phones.number	string	Device number
DuoAdmin.UserDetails.phones.platform	string	Device platform
DuoAdmin.UserDetails.phones.last_seen	date	Last time the device was used

duoadmin-get-u2f-tokens-by-user

Returns a list of U2F tokens associated with the given username

Base Command

duoadmin-get-u2f-tokens-by-user

Input

Argument Name	Description	Required
username	username.	Required

Context Output

Path	Type	Description
DuoAdmin.UserDetails.u2ftokens	Unknown	The list of tokens

duoadmin-get-devices

Returns all existing devices

Base Command

duoadmin-get-devices

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
DuoAdmin.Phones.phone_id	Unknown	Device Id
DuoAdmin.Phones.number	Unknown	Device number
DuoAdmin.Phones.platform	Unknown	Device platform
DuoAdmin.Phones.last_seen	Unknown	Last time the device was used
DuoAdmin.Phones.users	Unknown	Users associated with this device

duoadmin-associate-device-to-user

Associates a device to a user

Base Command

duoadmin-associate-device-to-user

Input

Argument Name	Description	Required
username	Username.	Required
device_id	Device Id.	Required

Context Output

There is no context output for this command.

duoadmin-get-admins

Returns administrator accounts

Base Command

duoadmin-get-admins

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
DuoAdmin.UserDetails.admin_id	string	Admin_id
DuoAdmin.UserDetails.admin_units	unknown	Admin Units
DuoAdmin.UserDetails.created	date	Created
DuoAdmin.UserDetails.email	string	Email
DuoAdmin.UserDetails.last_login	date	Last Login
DuoAdmin.UserDetails.name	string	Name
DuoAdmin.UserDetails.phone	unknown	Phone
DuoAdmin.UserDetails.role	string	Admin Role
DuoAdmin.UserDetails.status	string	Admin Status

duoadmin-get-bypass-codes

Retrieves the information from the bypass code table

Base Command

duoadmin-get-bypass-codes

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
DuoAdmin.UserDetails.bypass_code_id	unknown	Bypass Code Id
DuoAdmin.UserDetails.admin_email	string	Admin Email
DuoAdmin.UserDetails.created	date	Bypass Created
DuoAdmin.UserDetails.expiration	unknown	Bypass Expiration
DuoAdmin.UserDetails.reuse_count	unknown	Bypass Reuse Count
DuoAdmin.UserDetails.user.username	unknown	Username
DuoAdmin.UserDetails.user.created	unknown	Created
DuoAdmin.UserDetails.user.email	unknown	Email
DuoAdmin.UserDetails.user.last_login	unknown	Last Login
DuoAdmin.UserDetails.user.status	unknown	Status
DuoAdmin.UserDetails.user.user_id	unknown	User Id

duoadmin-modify-admin

Modify the administrator user.

Base Command

duoadmin-modify-admin

Input

Argument Name	Description	Required
admin_id	The id of the admin.	Required
name	The name of the admin.	Optional
phone	The phone number of the admin.	Optional
password	the password of the admin.	Optional
password_change_required	a flag to determine if the password should change. Possible values are: false, true. Default is false.	Optional

Context Output

There is no context output for this command.

duoadmin-modify-user

Modify the user account.

Base Command

duoadmin-modify-user

Input

Argument Name	Description	Required
user_id	The user id of the user.	Required
user_name	The user name of the user.	Optional
realname	The real name of the user.	Optional
status	The status of the user. Possible values are: active, disabled.	Optional
notes	Notes for the user.	Optional
email	The email of the user.	Optional
first_name	The first name of the user.	Optional
last_name	The last name of the user.	Optional
alias1	The first alias of the user.	Optional
alias2	The second alias of the user.	Optional
alias3	The third alias of the user.	Optional
alias4	The fourth alias of the user.	Optional
aliases	The aliases list of the user.	Optional

Context Output

There is no context output for this command.

Configuration parameters

hostname — API Hostname (required)
integration_key — Integration Key
secret_key — Secret Key
credentials_key — Integration Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (12)

duoadmin-associate-device-to-user
Associates a device to a user.
duoadmin-delete-u2f-token
Delete a u2f token.
duoadmin-dissociate-device-from-user
Dissociates a device from a user.
duoadmin-get-admins
Returns administrator accounts.
duoadmin-get-authentication-logs-by-user
Returns authentication logs associated with a user. Limited to 30 at a time.
duoadmin-get-bypass-codes
Retrieves the information from the bypass code table.
duoadmin-get-devices
Returns all existing devices.
duoadmin-get-devices-by-user
Return devices associated with a user.
duoadmin-get-u2f-tokens-by-user
Returns a list of U2F tokens associated with the given username.
duoadmin-get-users
Return usernames and their user id.
duoadmin-modify-admin
Modify the administrator user.
duoadmin-modify-user
Modify the user account.

Source

DuoAdminApi.py DuoAdminApi_test.py DuoAdminApi.yml DuoAdminApi_description.md

Download History Raw

category: Authentication & Identity Management
provider: Cisco Systems
commonfields:
  id: DUO Admin
  version: -1
sectionorder:
- Connect
configuration:
- display: API Hostname
  name: hostname
  required: true
  type: 0
  section: Connect
- display: Integration Key
  name: integration_key
  type: 0
  hidden: true
  required: false
  section: Connect
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Secret Key
  name: credentials_key
  display: Integration Key
  type: 9
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: |-
  DUO for admins.
  Must have access to the admin api in order to use this.
display: DUO Admin
name: DUO Admin
script:
  commands:
  - arguments:
    - description: The user associated with the logs.
      name: username
      required: true
    - auto: PREDEFINED
      description: Fetch logs from this time until now.
      name: from
      predefined:
      - 10_seconds_ago
      - 1_minute_ago
      - 10_minutes_ago
      - 1_hour_ago
      - 10_hours_ago
      - 1_day_ago
      - 1_week_ago
      - 1_month_ago
      - 1_year_ago
      - 5_years_ago
      - 10_years_ago
      required: true
    - defaultValue: '50'
      description: The maximum number of authentication logs to return.
      name: limit
    description: Returns authentication logs associated with a user. Limited to 30 at a time.
    name: duoadmin-get-authentication-logs-by-user
    outputs:
    - contextPath: DuoAdmin.UserDetails.auth_logs.result
      description: Result of the authentication attempt.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.event_type
      description: Type of activity logged.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.reason
      description: Reason for the authentication attempt result.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.ip
      description: The GeoIP location of the access device. IP field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.hostname
      description: The GeoIP location of the access device. Hostname field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.city
      description: The GeoIP location of the access device. City field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.state
      description: The GeoIP location of the access device. State field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.country
      description: The GeoIP location of the access device. Country field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.ip
      description: The GeoIP location of the authentication device. IP field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.hostname
      description: The GeoIP location of the authentication device. Hostname field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.city
      description: The GeoIP location of the authentication device. City field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.state
      description: The GeoIP location of the authentication device. State field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.country
      description: The GeoIP location of the authentication device. Country field.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.timestamp
      description: Timestamp of the event.
      type: date
    - contextPath: DuoAdmin.UserDetails.auth_logs.application.name
      description: Name of the application accessed.
      type: string
    - contextPath: DuoAdmin.UserDetails.auth_logs.factor
      description: The authentication factor.
      type: string
  - arguments:
    - description: user to dissociate a device from.
      name: username
      required: true
    - description: the device id to dissociate.
      name: device_id
      required: true
    description: Dissociates a device from a user.
    name: duoadmin-dissociate-device-from-user
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: the id of the token to delete.
      name: token_id
      required: true
    description: Delete a u2f token.
    name: duoadmin-delete-u2f-token
  - description: Return usernames and their user id.
    name: duoadmin-get-users
    outputs:
    - contextPath: DuoAdmin.UserDetails.username
      description: Username.
      type: string
    - contextPath: DuoAdmin.UserDetails.user_id
      description: 'User Id.'
      type: string
    - contextPath: DuoAdmin.UserDetails.status
      description: Status.
      type: string
    - contextPath: DuoAdmin.UserDetails.is_enrolled
      description: is_enrolled.
      type: boolean
    - contextPath: DuoAdmin.UserDetails.last_login
      description: Last_login.
      type: date
    - contextPath: DuoAdmin.UserDetails.realname
      description: Real Name.
      type: string
    - contextPath: DuoAdmin.UserDetails.email
      description: Email.
      type: string
    - contextPath: DuoAdmin.UserDetails.phones
      description: Phone numbers.
    arguments: []
  - arguments:
    - description: Username.
      name: username
      required: true
    description: Return devices associated with a user.
    name: duoadmin-get-devices-by-user
    outputs:
    - contextPath: DuoAdmin.UserDetails.phones.phone_id
      description: Device Id.
      type: string
    - contextPath: DuoAdmin.UserDetails.phones.number
      description: Device number.
      type: string
    - contextPath: DuoAdmin.UserDetails.phones.platform
      description: Device platform.
      type: string
    - contextPath: DuoAdmin.UserDetails.phones.last_seen
      description: Last time the device was used.
      type: date
  - arguments:
    - description: username.
      name: username
      required: true
    description: Returns a list of U2F tokens associated with the given username.
    name: duoadmin-get-u2f-tokens-by-user
    outputs:
    - contextPath: DuoAdmin.UserDetails.u2ftokens
      description: The list of  tokens.
      type: Unknown
  - description: Returns all existing devices.
    name: duoadmin-get-devices
    outputs:
    - contextPath: DuoAdmin.Phones.phone_id
      description: Device Id.
      type: Unknown
    - contextPath: DuoAdmin.Phones.number
      description: Device number.
      type: Unknown
    - contextPath: DuoAdmin.Phones.platform
      description: Device platform.
      type: Unknown
    - contextPath: DuoAdmin.Phones.last_seen
      description: Last time the device was used.
      type: Unknown
    - contextPath: DuoAdmin.Phones.users
      description: Users associated with this device.
      type: Unknown
    arguments: []
  - arguments:
    - description: Username.
      name: username
      required: true
    - description: Device Id.
      name: device_id
      required: true
    description: Associates a device to a user.
    name: duoadmin-associate-device-to-user
  - arguments: []
    description: Returns administrator accounts.
    name: duoadmin-get-admins
    outputs:
    - contextPath: DuoAdmin.UserDetails.admin_id
      description: Admin_id.
      type: string
    - contextPath: DuoAdmin.UserDetails.admin_units
      description: Admin Units.
    - contextPath: DuoAdmin.UserDetails.created
      description: Created.
      type: date
    - contextPath: DuoAdmin.UserDetails.email
      description: Email.
      type: string
    - contextPath: DuoAdmin.UserDetails.last_login
      description: Last Login.
      type: date
    - contextPath: DuoAdmin.UserDetails.name
      description: Name.
      type: string
    - contextPath: DuoAdmin.UserDetails.phone
      description: Phone.
    - contextPath: DuoAdmin.UserDetails.role
      description: Admin Role.
      type: string
    - contextPath: DuoAdmin.UserDetails.status
      description: Admin Status.
      type: string
  - arguments: []
    description: Retrieves the information from the bypass code table.
    name: duoadmin-get-bypass-codes
    outputs:
    - contextPath: DuoAdmin.UserDetails.bypass_code_id
      description: Bypass Code Id.
      type: unknown
    - contextPath: DuoAdmin.UserDetails.admin_email
      description: Admin Email.
      type: string
    - contextPath: DuoAdmin.UserDetails.created
      description: Bypass Created.
      type: date
    - contextPath: DuoAdmin.UserDetails.expiration
      description: Bypass Expiration.
    - contextPath: DuoAdmin.UserDetails.reuse_count
      description: Bypass Reuse Count.
    - contextPath: DuoAdmin.UserDetails.user.username
      description: Username.
    - contextPath: DuoAdmin.UserDetails.user.created
      description: Created.
    - contextPath: DuoAdmin.UserDetails.user.email
      description: Email.
    - contextPath: DuoAdmin.UserDetails.user.last_login
      description: Last Login.
    - contextPath: DuoAdmin.UserDetails.user.status
      description: Status.
    - contextPath: DuoAdmin.UserDetails.user.user_id
      description: User Id.
  - arguments:
    - description: The id of the admin.
      name: admin_id
      required: true
    - description: The name of the admin.
      name: name
    - description: The phone number of the admin.
      name: phone
    - description: the password of the admin.
      name: password
    - description: a flag to determine if the password should change.
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'false'
      - 'true'
      name: password_change_required
    outputs: []
    description: Modify the administrator user.
    name: duoadmin-modify-admin
  - arguments:
    - description: The user id of the user.
      name: user_id
      required: true
    - description: The user name of the user.
      name: user_name
    - description: The real name of the user.
      name: realname
    - description: The status of the user.
      name: status
      auto: PREDEFINED
      predefined:
      - 'active'
      - 'disabled'
    - description: Notes for the user.
      name: notes
    - description: The email of the user.
      name: email
    - description: The first name of the user.
      name: first_name
    - description: The last name of the user.
      name: last_name
    - description: The first alias of the user.
      name: alias1
    - description: The second alias of the user.
      name: alias2
    - description: The third alias of the user.
      name: alias3
    - description: The fourth alias of the user.
      name: alias4
    - description: The aliases list of the user.
      name: aliases
      isArray: true
    outputs: []
    description: Modify the user account.
    name: duoadmin-modify-user
    compliantpolicies:
    - User Soft Remediation
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
  script: ''
  type: python
  subtype: python3
tests:
- DuoAdmin API test playbook
fromversion: 5.0.0