Duo Event Collector

Details

ID	`Duo Event Collector`
Provider	Cisco Systems
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Collects Auth and Audit events for Duo using the API.

Configure Duo Event Collector in Cortex

Parameter	Description	Required
Server Host	The URL for the API.	True
First fetch timestamps	The first time fetch date range, for example: 2 days, 1 month, 3 years.	True
Integration key	The integration key for the admin API from Duo.	True
Secret key	The secret key for the admin API from Duo.	True
XSIAM request limit	The maximum number of events to collect from the API in each cycle.	True
Request retries	The number of times to retry a failed too many requests 429 HTTP error.	False
Use system proxy settings	Enable proxy support for running the collector.	False
logs_type_array	The type of APIs that this instance will use in the collector.	False
End of the fetch window	The number of minutes to delay when fetching events (to handle events creation delay in the DUO database). The default value is 0 minutes. The recommended value is 5.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

duo-get-events

Manual command to fetch events and display them.

Base Command

duo-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Known Limitations and recommended configuration

As suggested by the DUO ADMIN API documentation “We recommend requesting logs no more than once per minute”.
Recomended fetch time interval 1 minute and limit of up to 1000 per fetch.
The returned logs are available ranging from the last 180 days up to as recently as two minutes before the API request.

Context Output

There is no context output for this command.

Additional information

The Duo eventing system is not real-time. It takes a few minutes for the events to be indexed and available for an API call due to consolidation. As a result the parameter “End of the fetch window” to adjust XSIAM to Duo’s delay was added.

Configuration parameters

host — Server Host (required)
after — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
integration_key — Integration key (required)
secret_key — (required)
limit — XSIAM request limit (required)
retries — Request retries
logs_type_array — APIs to use
proxy — Use system proxy settings
fetch_delay — End of the fetch window

Commands (1)

duo-get-events
Manual command to fetch events and display them.

Source

DuoEventCollector.py DuoEventCollector_test.py DuoEventCollector.yml DuoEventCollector_description.md

Download History Raw

commonfields:
  id: Duo Event Collector
  version: -1
name: Duo Event Collector
display: Duo Event Collector
category: Analytics & SIEM
provider: Cisco Systems
description: Collects Auth and Audit events for Duo using the API.
sectionorder:
- Connect
- Collect
configuration:
- display: Server Host
  name: host
  type: 0
  required: true
  section: Connect
- display: First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)
  name: after
  type: 0
  required: true
  defaultvalue: 1 day
  section: Collect
- display: Integration key
  name: integration_key
  type: 0
  required: true
  section: Connect
- displaypassword: Secret key
  name: secret_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: XSIAM request limit
  name: limit
  type: 0
  defaultvalue: 1000
  required: true
  section: Collect
- display: Request retries
  name: retries
  type: 0
  defaultvalue: 5
  required: false
  section: Collect
- additionalinfo: A comma-delimited string that specifies the initial order and type in which to get logs from the available APIs. Possible values are AUTHENTICATION, ADMINISTRATION, and TELEPHONY.
  display: APIs to use
  name: logs_type_array
  type: 0
  defaultvalue: AUTHENTICATION,ADMINISTRATION,TELEPHONY
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- section: Collect
  advanced: true
  display: End of the fetch window
  additionalinfo: The number of minutes to delay when fetching events (to handle events creation delay in the DUO database). The default value is 0 minutes. The recommended value is 5.
  name: fetch_delay
  defaultvalue: 0
  type: 0
  required: false
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - defaultValue: 'AUTHENTICATION'
      description: The wanted log type. The default value is AUTHENTICATION. Enter one log type for each command execution.
      name: logs_type_array
      required: false
      auto: PREDEFINED
      predefined:
      - "AUTHENTICATION"
      - "ADMINISTRATION"
      - "TELEPHONY"
    - defaultValue: 1 day
      description: Date from which to get events (e.g. <number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year or 2023-13-30T03:11:29Z).
      name: after
      required: false
    - defaultValue: 1000
      description: Maximum results to return.
      isArray: false
      name: limit
      required: false
    description: Manual command to fetch events and display them.
    name: duo-get-events
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests
supportedModules:
- xsiam