commonfields:
  id: Duo Event Collector
  version: -1
name: Duo Event Collector
display: Duo Event Collector
category: Analytics & SIEM
provider: Cisco Systems
description: Collects Auth and Audit events for Duo using the API.
sectionorder:
- Connect
- Collect
configuration:
- display: Server Host
  name: host
  type: 0
  required: true
  section: Connect
- display: First fetch timestamp (<number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year)
  name: after
  type: 0
  required: true
  defaultvalue: 1 day
  section: Collect
- display: Integration key
  name: integration_key
  type: 0
  required: true
  section: Connect
- displaypassword: Secret key
  name: secret_key
  hiddenusername: true
  type: 9
  required: true
  section: Connect
- display: XSIAM request limit
  name: limit
  type: 0
  defaultvalue: 1000
  required: true
  section: Collect
- display: Request retries
  name: retries
  type: 0
  defaultvalue: 5
  required: false
  section: Collect
- additionalinfo: A comma-delimited string that specifies the initial order and type in which to get logs from the available APIs. Possible values are AUTHENTICATION, ADMINISTRATION, and TELEPHONY.
  display: APIs to use
  name: logs_type_array
  type: 0
  defaultvalue: AUTHENTICATION,ADMINISTRATION,TELEPHONY
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- section: Collect
  advanced: true
  display: End of the fetch window
  additionalinfo: The number of minutes to delay when fetching events (to handle events creation delay in the DUO database). The default value is 0 minutes. The recommended value is 5.
  name: fetch_delay
  defaultvalue: 0
  type: 0
  required: false
script:
  script: ""
  type: python
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - defaultValue: 'AUTHENTICATION'
      description: The wanted log type. The default value is AUTHENTICATION. Enter one log type for each command execution.
      name: logs_type_array
      required: false
      auto: PREDEFINED
      predefined:
      - "AUTHENTICATION"
      - "ADMINISTRATION"
      - "TELEPHONY"
    - defaultValue: 1 day
      description: Date from which to get events (e.g. <number> <time unit>, for example, 12 hours, 7 days, 3 months, 1 year or 2023-13-30T03:11:29Z).
      name: after
      required: false
    - defaultValue: 1000
      description: Maximum results to return.
      isArray: false
      name: limit
      required: false
    description: Manual command to fetch events and display them.
    name: duo-get-events
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
  isfetchevents: true
  subtype: python3
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests
supportedModules:
- xsiam