category: Authentication & Identity Management provider: Cisco Systems commonfields: id: DUO Admin version: -1 sectionorder: - Connect configuration: - display: API Hostname name: hostname required: true type: 0 section: Connect - display: Integration Key name: integration_key type: 0 hidden: true required: false section: Connect - display: Secret Key name: secret_key type: 4 hidden: true required: false section: Connect - displaypassword: Secret Key name: credentials_key display: Integration Key type: 9 required: false section: Connect - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Connect - display: Use system proxy settings name: proxy type: 8 required: false section: Connect description: |- DUO for admins. Must have access to the admin api in order to use this. display: DUO Admin name: DUO Admin script: commands: - arguments: - description: The user associated with the logs. name: username required: true - auto: PREDEFINED description: Fetch logs from this time until now. name: from predefined: - 10_seconds_ago - 1_minute_ago - 10_minutes_ago - 1_hour_ago - 10_hours_ago - 1_day_ago - 1_week_ago - 1_month_ago - 1_year_ago - 5_years_ago - 10_years_ago required: true - defaultValue: '50' description: The maximum number of authentication logs to return. name: limit description: Returns authentication logs associated with a user. Limited to 30 at a time. name: duoadmin-get-authentication-logs-by-user outputs: - contextPath: DuoAdmin.UserDetails.auth_logs.result description: Result of the authentication attempt. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.event_type description: Type of activity logged. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.reason description: Reason for the authentication attempt result. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.ip description: The GeoIP location of the access device. IP field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.hostname description: The GeoIP location of the access device. Hostname field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.city description: The GeoIP location of the access device. City field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.state description: The GeoIP location of the access device. State field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.access_device.location.country description: The GeoIP location of the access device. Country field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.ip description: The GeoIP location of the authentication device. IP field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.hostname description: The GeoIP location of the authentication device. Hostname field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.city description: The GeoIP location of the authentication device. City field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.state description: The GeoIP location of the authentication device. State field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.auth_device.location.country description: The GeoIP location of the authentication device. Country field. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.timestamp description: Timestamp of the event. type: date - contextPath: DuoAdmin.UserDetails.auth_logs.application.name description: Name of the application accessed. type: string - contextPath: DuoAdmin.UserDetails.auth_logs.factor description: The authentication factor. type: string - arguments: - description: user to dissociate a device from. name: username required: true - description: the device id to dissociate. name: device_id required: true description: Dissociates a device from a user. name: duoadmin-dissociate-device-from-user compliantpolicies: - User Soft Remediation - arguments: - description: the id of the token to delete. name: token_id required: true description: Delete a u2f token. name: duoadmin-delete-u2f-token - description: Return usernames and their user id. name: duoadmin-get-users outputs: - contextPath: DuoAdmin.UserDetails.username description: Username. type: string - contextPath: DuoAdmin.UserDetails.user_id description: 'User Id.' type: string - contextPath: DuoAdmin.UserDetails.status description: Status. type: string - contextPath: DuoAdmin.UserDetails.is_enrolled description: is_enrolled. type: boolean - contextPath: DuoAdmin.UserDetails.last_login description: Last_login. type: date - contextPath: DuoAdmin.UserDetails.realname description: Real Name. type: string - contextPath: DuoAdmin.UserDetails.email description: Email. type: string - contextPath: DuoAdmin.UserDetails.phones description: Phone numbers. arguments: [] - arguments: - description: Username. name: username required: true description: Return devices associated with a user. name: duoadmin-get-devices-by-user outputs: - contextPath: DuoAdmin.UserDetails.phones.phone_id description: Device Id. type: string - contextPath: DuoAdmin.UserDetails.phones.number description: Device number. type: string - contextPath: DuoAdmin.UserDetails.phones.platform description: Device platform. type: string - contextPath: DuoAdmin.UserDetails.phones.last_seen description: Last time the device was used. type: date - arguments: - description: username. name: username required: true description: Returns a list of U2F tokens associated with the given username. name: duoadmin-get-u2f-tokens-by-user outputs: - contextPath: DuoAdmin.UserDetails.u2ftokens description: The list of tokens. type: Unknown - description: Returns all existing devices. name: duoadmin-get-devices outputs: - contextPath: DuoAdmin.Phones.phone_id description: Device Id. type: Unknown - contextPath: DuoAdmin.Phones.number description: Device number. type: Unknown - contextPath: DuoAdmin.Phones.platform description: Device platform. type: Unknown - contextPath: DuoAdmin.Phones.last_seen description: Last time the device was used. type: Unknown - contextPath: DuoAdmin.Phones.users description: Users associated with this device. type: Unknown arguments: [] - arguments: - description: Username. name: username required: true - description: Device Id. name: device_id required: true description: Associates a device to a user. name: duoadmin-associate-device-to-user - arguments: [] description: Returns administrator accounts. name: duoadmin-get-admins outputs: - contextPath: DuoAdmin.UserDetails.admin_id description: Admin_id. type: string - contextPath: DuoAdmin.UserDetails.admin_units description: Admin Units. - contextPath: DuoAdmin.UserDetails.created description: Created. type: date - contextPath: DuoAdmin.UserDetails.email description: Email. type: string - contextPath: DuoAdmin.UserDetails.last_login description: Last Login. type: date - contextPath: DuoAdmin.UserDetails.name description: Name. type: string - contextPath: DuoAdmin.UserDetails.phone description: Phone. - contextPath: DuoAdmin.UserDetails.role description: Admin Role. type: string - contextPath: DuoAdmin.UserDetails.status description: Admin Status. type: string - arguments: [] description: Retrieves the information from the bypass code table. name: duoadmin-get-bypass-codes outputs: - contextPath: DuoAdmin.UserDetails.bypass_code_id description: Bypass Code Id. type: unknown - contextPath: DuoAdmin.UserDetails.admin_email description: Admin Email. type: string - contextPath: DuoAdmin.UserDetails.created description: Bypass Created. type: date - contextPath: DuoAdmin.UserDetails.expiration description: Bypass Expiration. - contextPath: DuoAdmin.UserDetails.reuse_count description: Bypass Reuse Count. - contextPath: DuoAdmin.UserDetails.user.username description: Username. - contextPath: DuoAdmin.UserDetails.user.created description: Created. - contextPath: DuoAdmin.UserDetails.user.email description: Email. - contextPath: DuoAdmin.UserDetails.user.last_login description: Last Login. - contextPath: DuoAdmin.UserDetails.user.status description: Status. - contextPath: DuoAdmin.UserDetails.user.user_id description: User Id. - arguments: - description: The id of the admin. name: admin_id required: true - description: The name of the admin. name: name - description: The phone number of the admin. name: phone - description: the password of the admin. name: password - description: a flag to determine if the password should change. defaultValue: 'false' auto: PREDEFINED predefined: - 'false' - 'true' name: password_change_required outputs: [] description: Modify the administrator user. name: duoadmin-modify-admin - arguments: - description: The user id of the user. name: user_id required: true - description: The user name of the user. name: user_name - description: The real name of the user. name: realname - description: The status of the user. name: status auto: PREDEFINED predefined: - 'active' - 'disabled' - description: Notes for the user. name: notes - description: The email of the user. name: email - description: The first name of the user. name: first_name - description: The last name of the user. name: last_name - description: The first alias of the user. name: alias1 - description: The second alias of the user. name: alias2 - description: The third alias of the user. name: alias3 - description: The fourth alias of the user. name: alias4 - description: The aliases list of the user. name: aliases isArray: true outputs: [] description: Modify the user account. name: duoadmin-modify-user compliantpolicies: - User Soft Remediation dockerimage: demisto/vendors-sdk:1.0.0.10120494 script: '' type: python subtype: python3 tests: - DuoAdmin API test playbook fromversion: 5.0.0