Update C2C Duo source with current docs (#5869)

* Update C2C Duo source with current docs

* Updates from review

---------

Co-authored-by: John Pipkin <[email protected]>

Author: carlos-castillo-jask

docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md

@@ -5,21 +5,25 @@ sidebar_label: Duo
 tags:
   - cloud-to-cloud
   - duo
-description: The Duo Source provides a secure endpoint to receive authentication logs from the Duo Authentication Logs API.
+description: The Duo Source provides a secure endpoint to receive logs from multiple API endpoints.
 ---
 
 import ForwardToSiem from '/docs/reuse/forward-to-siem.md';
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
 <img src={useBaseUrl('img/integrations/security-threat-detection/duo.png')} alt="thumbnail icon" width="55"/>
 
-The Duo Source provides a secure endpoint to receive authentication logs from the Duo [Authentication Logs API](https://duo.com/docs/adminapi#logs). It securely stores the required authentication, scheduling, and state tracking information.
+The Duo Source collects logs from multiple Duo API endpoints. It securely stores the required authentication, scheduling, and state tracking information.
 
 ## Data collected
 
 | Polling Interval | Data |
 | :--- | :--- |
-| 5 min |  [Authentication Logs](https://duo.com/docs/adminapi#logs) |
+| 5m  | [Authentication Logs](https://duo.com/docs/adminapi#logs)   |
+| 5m  | [Administrator Logs](https://duo.com/docs/adminapi#administrator-logs)|
+| 5m  | [Telephony Logs](https://duo.com/docs/adminapi#telephony-logs)|
+| 5m  | [Activity Logs](https://duo.com/docs/adminapi#activity-logs)|
+| 24h | [User Inventory Logs](https://duo.com/docs/adminapi#users) |
 
 ## Setup
 
@@ -48,6 +52,8 @@ To configure a Duo Source:
 1. **Duo Domain**. Provide your **API hostname**, such as `api-********.duosecurity.com`.
 1. **Integration Key**. Provide the Duo Integration Key you want to use to authenticate collection requests.
 1. **Secret Key**. Provide the Duo Secret Key you want to use to authenticate collection requests. 
+1. **Supported APIs to Collect**. Choose the API endpoints you wish to collect logs from.
+1. **Collect User Inventory Every 24h**. Check this box if you want to collect user inventory every 24 hours.
 1. (Optional) The **Polling Interval** is set for 300 seconds by default, you can adjust it based on your needs. This sets how often the Source checks for new data.
 1. When you are finished configuring the Source, click **Submit**.
 
@@ -81,6 +87,8 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma
 | domain | String | Yes | `null`  | Provide your API hostname, such as api-********.duosecurity.com.| |
 | integration_key | String | Yes | `null` | Provide the Duo Integration Key you want to use to authenticate collection requests. |  |
 | secret_key | String | Yes | `null` | Provide the Duo Secret Key you want to use to authenticate collection requests. |  |
+| supported_apis| String Array| Yes | All APIs|Add an element for each of the APIs the integration should collect from.|`["authentication", "administrator", "telephony", "activity"]`|
+| collectUserInventory | Boolean | No | True| Set to true if the integration should collect user inventory logs. |`True`|
 | polling_interval | Integer | No | 300 | This sets how often the Source checks for new data. |  |
 
 ### JSON example

static/files/c2c/duo/example.json

@@ -1,21 +1,28 @@
 {
-    "api.version":"v1",
-    "source":{
-      "schemaRef":{
-        "type":"Duo"
+  "api.version": "v1",
+  "source": {
+    "schemaRef": {
+      "type": "Duo"
+    },
+    "config": {
+      "name": "Duo",
+      "description": "East field",
+      "domain": "api-********.duosecurity.com",
+      "integration_key": "********",
+      "secret_key": "********",
+      "supported_apis": [
+        "administrator",
+        "authentication",
+        "telephony",
+        "activity"
+      ],
+      "collectUserInventory": true,
+      "fields": {
+        "_siemForward": false
       },
-      "config":{
-        "name":"Duo",
-        "description":"East field",
-        "domain":"api-********.duosecurity.com",
-        "integration_key":"********",
-        "secret_key":"********",
-        "fields":{
-          "_siemForward":false
-        },
-        "category":"eastTeamF",
-        "polling_interval":300
-      },
-      "sourceType":"Universal"
-    }
-  }
+      "category": "eastTeamF",
+      "polling_interval": 300
+    },
+    "sourceType": "Universal"
+  }
+}

static/files/c2c/duo/example.tf

@@ -9,6 +9,13 @@ resource "sumologic_cloud_to_cloud_source" "duo_source" {
       "domain":"api-********.duosecurity.com",
       "integration_key":"********",
       "secret_key":"********",
+      "supported_apis": [
+        "administrator",
+        "authentication",
+        "telephony",
+        "activity",
+      ],
+      "collectUserInventory": true,
       "fields":{
         "_siemForward":false
       },