Configure Cisco Duo Documentation

In this page:

Configuring Cisco Duo integration via Connections

To enable communication between Log360 Cloud and Cisco Duo, a connection must be configured.

  1. Log in to the product console.

  2. Navigate to the Settings tab and select Admin.

  3. Under Integrations, select Connections.

Cisco Duo configuration - Figure 1
Figure 1: Accessing connections

  1. From the list of available integrations, select Cisco Duo.

Cisco Duo configuration - Figure 2
Figure 2: Selecting Cisco Duo

  1. In the window that opens, click Create Connection.

Cisco Duo configuration - Figure 3
Figure 3: Creating a connection

  1. In the Create Connection - Cisco Duo window, provide the following details:

Field Description
Authentication Type Pre-selected as HMAC based on the integration.
Connection Name Enter a name to identify the connection.
Integration Key Enter the Integration Key from the Cisco Duo Admin Panel.
Secret Key Enter the Secret Key from the Cisco Duo Admin Panel.
API Hostname Enter the API Hostname associated with your Duo account (e.g., api-XXXXXXXX.duosecurity.com).

NOTE: The Integration Key, Secret Key, and API Hostname can be obtained from the Cisco Duo Admin Panel. To generate these credentials:

- Log in to the Duo Admin Panel

- In the left sidebar, click Applications and then click Protect an Application.

- Search for Admin API and click Protect. Use Admin API for SOAR/SIEM integrations, admin-level access (users, devices, policies), and log retrieval. For authentication-only use cases, use Auth API instead.

- Once the application is created (or if you're opening an existing one), you'll see a details page containing:

Field

Description

Integration Key

The ikey - public identifier for the application.

Secret Key

The skey - treat like a password, never share.

API Hostname

Format: api-XXXXXXXX.duosecurity.com (unique per Duo customer account).

- Scroll down to the Permissions section and enable only what your integration requires:
Grant read information
Grant read log

Grant read resource
Grant write resource

Grant applications

- Click Save Changes.

Cisco Duo configuration - Figure 4
Figure 4: Configuring connection details

  1. Click Authorize and Save to complete authentication and create the connection.

Supported SOAR functionalities

The Cisco Duo extension provides custom functions that enable playbooks to interact with Cisco Duo APIs. These functions can be used to manage users and groups, control MFA policies, handle bypass codes, administrator endpoints, and perform automated identity response actions.

1. ciscoduo_createGroup

Creates a new group with specified configuration settings.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
groupName String Name of the group to be created. Yes
description String Description of the group. No
status String Authentication status for the group. Possible values: Active (users must complete secondary auth), Bypass (users bypass secondary auth), Disabled (users cannot authenticate). No

Reference Link:

https://duo.com/docs/adminapi#create-group

2. ciscoduo_createUser

Creates a new user account with specified details and configuration.

Parameter Param Type Param Description Map Parameter Structure Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userName String Username for the new user account. Yes
bodyParams Map Additional user attributes to set on creation, such as name, email, status, date of birth, and custom aliases. "bodyParams":{
"realName": "string",
"enableAutoPrompt": integer,
"status": "string",
"notes": "string",
"firstName": "string",
"lastName": "string",
"email": "string",
"dateOfBirth": "string",
"alias1": "string",
"alias2": "string",
"alias3": "string",
"alias4": "string",
"customAttributes.attributeName": "string"
}		 No

Reference Link:

https://duo.com/docs/adminapi#create-user

3. ciscoduo_deleteBypassCode

Deletes a specific bypass code from the system.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
bypassCodeId String ID of the bypass code to be deleted. Yes

Reference Link:

https://duo.com/docs/adminapi#delete-bypass-code

4. ciscoduo_deleteGroup

Deletes an existing group from the system.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
groupId String ID of the group to be deleted. Yes

Reference Link:

https://duo.com/docs/adminapi#delete-group

5. ciscoduo_deleteUser

Deletes an existing user account from the system.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userId String ID of the user to be deleted. Yes

Reference Link:

https://duo.com/docs/adminapi#delete-user

6. ciscoduo_enrollUser

Enrolls a user for multi-factor authentication with a specified validity period.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userName String The username (or username alias) of the user to enroll. Yes
email String The email address of the user. Yes
validSecs Int Enrollment link expiration in seconds. Defaults to 30 days; adjustable from 1 minute to a maximum of 30 days. No

Reference Link:

https://duo.com/docs/adminapi#enroll-user

7. ciscoduo_getGroupMembers

Retrieves the list of members in a specific group with pagination support.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
groupId String ID of the group to retrieve members from. Yes
limit Int Maximum number of results to return. Default: 100; Max: 500. No
offset Int The offset from 0 at which to start record retrieval. Used with limit for pagination. Default: 0. No

Reference Link:

https://duo.com/docs/adminapi#get-group-members

8. ciscoduo_modifyUser

Modifies an existing user account with updated information.

Parameter Param Type Param Description Map Parameter Structure Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userId String ID of the user to modify. Yes
bodyParams Map User attributes to update, such as name, email, status, date of birth, and custom aliases. "bodyParams":{
"userName": "string",
"realName": "string",
"enableAutoPrompt": integer,
"status": "string",
"notes": "string",
"firstName": "string",
"lastName": "string",
"email": "string",
"dateOfBirth": "string",
"alias1": "string",
"alias2": "string",
"alias3": "string",
"alias4": "string",
"customAttributes.attributeName": "string"
}		 No

Reference Link:

https://duo.com/docs/adminapi#modify-user

9. ciscoduo_retrieveBypassCodesByUserId

Retrieves all bypass codes associated with a specific user ID.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userId String ID of the user to retrieve bypass codes for. Yes
limit Int Maximum number of results to return. No
offset Int Number of records to skip for pagination. No

Reference Link:

https://duo.com/docs/adminapi#retrieve-bypass-codes

10. ciscoduo_retrieveEndpointById

Retrieves detailed information about a specific endpoint by its ID.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
endpointId String epKey of the endpoint to retrieve. Yes

Reference Link:

https://duo.com/docs/adminapi#retrieve-endpoint

11. ciscoduo_retrieveEndpoints

Retrieves a list of all endpoints with pagination support.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
limit Int Maximum number of results to return. No
offset Int Number of records to skip for pagination. No

Reference Link:

https://duo.com/docs/adminapi#retrieve-endpoints

12. ciscoduo_retrieveGroups

Returns a paged list of groups. To fetch all results, call repeatedly with the offset parameter as long as the result metadata has a next_offset value.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
groupIds List A list of group IDs used to fetch multiple groups. You can provide up to 100 group_ids. If provided, limit and offset parameters are ignored. No
limit Int Maximum number of results to return. No
offset Int Number of records to skip for pagination. No
groupIdList List Alternative parameter for specifying a list of group IDs to retrieve. No

Reference Link:

https://duo.com/docs/adminapi#retrieve-groups

13. ciscoduo_updateGroup

Updates an existing group with new configuration settings.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
groupId String ID of the group to update. Yes
groupName String Updated name for the group. No
description String Updated description for the group. No
status String Updated group status. Possible values: Active, Bypass, Disabled. No

Reference Link:

https://duo.com/docs/adminapi#modify-group

14. ciscoduo_createPolicy

Creates a new policy with specified configuration settings for applications and user groups.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
policyName String The name of the policy to create. Policy names do not have to be unique. Yes
applyToApps String Application assignment information: affect_all_apps, apply_list, replace_list, unassign_list. No
applyToGroupsInApps String Groups (within applications) to apply the policy: apply_group_policies_list, group_policy_apply_order, replace_group_policies_list, unassign_group_policies_list. No
applyToUserGroups String Groups to apply the policy for all apps: user_group_apply_order, apply_user_group_list, replace_user_group_list, unassign_user_group_list. No
sections String The list of policy sections to add with associated keys/values for each section. No

Reference Link:

https://duo.com/docs/adminapi#create-policy

15. ciscoduo_retrievePolicies

Retrieves a list of all policies with pagination support.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
limit Int Maximum number of results to return. No
offset Int Number of records to skip for pagination. No

Reference Link:

https://duo.com/docs/adminapi#retrieve-policies

16. ciscoduo_deletePolicy

Deletes an existing policy from the system.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
policyKey String Key/ID of the policy to be deleted. Yes

Reference Link:

https://duo.com/docs/adminapi#delete-policy

17. ciscoduo_updatePolicy

Updates an existing policy with new configuration settings.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
policyKey String Key/ID of the policy to be updated. Yes
policyName String A new name for the custom policy. No
applyToApps String Application assignment information: affect_all_apps, apply_list, replace_list, unassign_list. No
applyToGroupsInApps String Groups (within applications) to apply the policy, including unassign_all boolean. No
applyToUserGroups String Groups to apply the policy for all apps: user_group_apply_order, apply_user_group_list, replace_user_group_list, unassign_user_group_list. No
sections String The list of policy sections to add with associated keys/values for each section. No
sectionsToDelete List An array of section names to remove from this policy. Sections cannot be removed from the global policy. No

Reference Link:

https://duo.com/docs/adminapi#update-policy

18. ciscoduo_associateGroupWithUser

Associates a group with a specific user account.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userId String ID of the user. Yes
groupId String The ID of the group to associate with the user. Yes

Reference Link:

https://duo.com/docs/adminapi#associate-group-with-user

19. ciscoduo_retrieveUserById

Retrieves detailed information about a specific user by their ID.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
userId String ID of the user to retrieve. Yes

Reference Link:

https://duo.com/docs/adminapi#retrieve-user-by-id

20. ciscoduo_retrieveAdministrators

Retrieves a list of all administrators with pagination support.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
limit Int Maximum number of results to return. No
offset Int Number of records to skip for pagination. No

Reference Link:

https://duo.com/docs/adminapi#retrieve-administrators

21. ciscoduo_modifyAdministrators

Modifies an existing administrator with specified configuration settings.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
adminId String The ID of the administrator to modify. Yes
name String The administrator's name. No
phone String The administrator's phone number. No
passwordChangeRequired String Indicates if the administrator is required to change their password. No
roleId String The ID of the administrator's role. No
restrictedByAdminUnits String Indicates if the administrator's access is restricted by administrative units. No
status String The administrator's status. Valid values: active, inactive. No
subAccountRoleId String The ID of the administrator's sub-account role. No
tokenId String The ID of the token to assign to the administrator. No

Reference Link:

https://duo.com/docs/adminapi#modify-administrator

22. ciscoduo_retrievePolicyById

Retrieves detailed information about a specific policy by its key/ID.

Parameter Param Type Param Description Mandatory
connectionName Connection The name of the pre-configured Cisco Duo connection used for authentication and API access. Yes
policyKey String The key/ID of the policy to retrieve. Yes

Reference Link:

https://duo.com/docs/adminapi#retrieve-policy