Duo Event Collector

Details

ID	`Duo Event Collector`
Provider	Cisco Systems
Category	Analytics & SIEM
From Version	6.8.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Collects Auth and Audit events for Duo using the API.

Configure Duo Event Collector in Cortex

Parameter	Description	Required
Server Host	The URL for the API.	True
First fetch timestamps	The first time fetch date range, for example: 2 days, 1 month, 3 years.	True
Integration key	The integration key for the admin API from Duo.	True
Secret key	The secret key for the admin API from Duo.	True
XSIAM request limit	The maximum number of events to collect from the API in each cycle.	True
Request retries	The number of times to retry a failed too many requests 429 HTTP error.	False
Use system proxy settings	Enable proxy support for running the collector.	False
logs_type_array	The type of APIs that this instance will use in the collector.	False
End of the fetch window	The number of minutes to delay when fetching events (to handle events creation delay in the DUO database). The default value is 0 minutes. The recommended value is 5.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

duo-get-events

Manual command to fetch events and display them.

Base Command

duo-get-events

Input

Argument Name	Description	Required
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: True, False. Default is False.	Required

Known Limitations and recommended configuration

As suggested by the DUO ADMIN API documentation “We recommend requesting logs no more than once per minute”.
Recomended fetch time interval 1 minute and limit of up to 1000 per fetch.
The returned logs are available ranging from the last 180 days up to as recently as two minutes before the API request.

Context Output

There is no context output for this command.

Additional information

The Duo eventing system is not real-time. It takes a few minutes for the events to be indexed and available for an API call due to consolidation. As a result the parameter “End of the fetch window” to adjust XSIAM to Duo’s delay was added.

Configuration parameters

host — Server Host (required)
after — First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year) (required)
integration_key — Integration key (required)
secret_key — (required)
limit — XSIAM request limit (required)
retries — Request retries
logs_type_array — APIs to use
proxy — Use system proxy settings
fetch_delay — End of the fetch window

Commands (1)

duo-get-events
Manual command to fetch events and display them.

Source

DuoEventCollector.py DuoEventCollector_test.py DuoEventCollector.yml DuoEventCollector_description.md

Download History Raw

Duo Admin API provides programmatic access to the administrative functionality of Duo Security's two-factor authentication platform.

To set up an instance you will need:
- API hostname: admin API hostname provided by Duo (e.g., api-XXXXXXXX.duosecurity.com).
- Integration key: your integration key provided by Duo.
- Secret key: your secret key/password provided by Duo.

For more information, check out the documentation at [https://duo.com/docs/adminapi](https://duo.com/docs/adminapi).


Duo Events collector XSIAM
-
 Retrieve log events from Duo using its API.


---

* **Server Host** - The API URL for Duo.
* **API KEY** - The integration key.
* **SECRET KEY** - The secret key.
* **First fetch from api time** - The time to take events from if no time is saved in the system.
* **XSIAM request limit** - The maximum amount of events to retrieve from the API.
* **Request retries** - The number of retries to perform in the API. (This is necessary because if there are too many retries, the API will return a "too many requests 429" error).


## Step-by-step configuration

- **Server Host** - `api-XXXX.duosecurity.com` where XXXX is your admin URL.  
- **INTEGRATION KEY** - Your integration key.
- **SECRET KEY** - Your secret key.
- **Api request limit** - 100  
- **First fetch from api time** - 1 Day  
- **XSIAM request limit** - 01 Minutes 
- **Request retries** - 5