diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md index ad55388e70..e8b320f056 100644 --- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md +++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/duo-source.md @@ -5,7 +5,7 @@ sidebar_label: Duo tags: - cloud-to-cloud - duo -description: The Duo Source provides a secure endpoint to receive authentication logs from the Duo Authentication Logs API. +description: The Duo Source provides a secure endpoint to receive logs from multiple API endpoints. --- import ForwardToSiem from '/docs/reuse/forward-to-siem.md'; @@ -13,13 +13,17 @@ import useBaseUrl from '@docusaurus/useBaseUrl'; thumbnail icon -The Duo Source provides a secure endpoint to receive authentication logs from the Duo [Authentication Logs API](https://duo.com/docs/adminapi#logs). It securely stores the required authentication, scheduling, and state tracking information. +The Duo Source collects logs from multiple Duo API endpoints. It securely stores the required authentication, scheduling, and state tracking information. ## Data collected | Polling Interval | Data | | :--- | :--- | -| 5 min | [Authentication Logs](https://duo.com/docs/adminapi#logs) | +| 5m | [Authentication Logs](https://duo.com/docs/adminapi#logs) | +| 5m | [Administrator Logs](https://duo.com/docs/adminapi#administrator-logs)| +| 5m | [Telephony Logs](https://duo.com/docs/adminapi#telephony-logs)| +| 5m | [Activity Logs](https://duo.com/docs/adminapi#activity-logs)| +| 24h | [User Inventory Logs](https://duo.com/docs/adminapi#users) | ## Setup @@ -48,6 +52,8 @@ To configure a Duo Source: 1. **Duo Domain**. Provide your **API hostname**, such as `api-********.duosecurity.com`. 1. **Integration Key**. Provide the Duo Integration Key you want to use to authenticate collection requests. 1. **Secret Key**. Provide the Duo Secret Key you want to use to authenticate collection requests.  +1. **Supported APIs to Collect**. Choose the API endpoints you wish to collect logs from. +1. **Collect User Inventory Every 24h**. Check this box if you want to collect user inventory every 24 hours. 1. (Optional) The **Polling Interval** is set for 300 seconds by default, you can adjust it based on your needs. This sets how often the Source checks for new data. 1. When you are finished configuring the Source, click **Submit**. @@ -81,6 +87,8 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma | domain | String | Yes | `null` | Provide your API hostname, such as api-********.duosecurity.com.| | | integration_key | String | Yes | `null` | Provide the Duo Integration Key you want to use to authenticate collection requests. | | | secret_key | String | Yes | `null` | Provide the Duo Secret Key you want to use to authenticate collection requests. | | +| supported_apis| String Array| Yes | All APIs|Add an element for each of the APIs the integration should collect from.|`["authentication", "administrator", "telephony", "activity"]`| +| collectUserInventory | Boolean | No | True| Set to true if the integration should collect user inventory logs. |`True`| | polling_interval | Integer | No | 300 | This sets how often the Source checks for new data. | | ### JSON example diff --git a/static/files/c2c/duo/example.json b/static/files/c2c/duo/example.json index ed8a4c36cb..31e9413e2c 100644 --- a/static/files/c2c/duo/example.json +++ b/static/files/c2c/duo/example.json @@ -1,21 +1,28 @@ { - "api.version":"v1", - "source":{ - "schemaRef":{ - "type":"Duo" + "api.version": "v1", + "source": { + "schemaRef": { + "type": "Duo" + }, + "config": { + "name": "Duo", + "description": "East field", + "domain": "api-********.duosecurity.com", + "integration_key": "********", + "secret_key": "********", + "supported_apis": [ + "administrator", + "authentication", + "telephony", + "activity" + ], + "collectUserInventory": true, + "fields": { + "_siemForward": false }, - "config":{ - "name":"Duo", - "description":"East field", - "domain":"api-********.duosecurity.com", - "integration_key":"********", - "secret_key":"********", - "fields":{ - "_siemForward":false - }, - "category":"eastTeamF", - "polling_interval":300 - }, - "sourceType":"Universal" - } - } \ No newline at end of file + "category": "eastTeamF", + "polling_interval": 300 + }, + "sourceType": "Universal" + } +} diff --git a/static/files/c2c/duo/example.tf b/static/files/c2c/duo/example.tf index a5e4c2910f..1482f81bb6 100644 --- a/static/files/c2c/duo/example.tf +++ b/static/files/c2c/duo/example.tf @@ -9,6 +9,13 @@ resource "sumologic_cloud_to_cloud_source" "duo_source" { "domain":"api-********.duosecurity.com", "integration_key":"********", "secret_key":"********", + "supported_apis": [ + "administrator", + "authentication", + "telephony", + "activity", + ], + "collectUserInventory": true, "fields":{ "_siemForward":false },