Skip to main content

DUO

Duo is a comprehensive two-factor authentication (2FA) and multi-factor authentication (MFA) security platform designed to protect organizations by verifying user identities before granting access to applications and systems. This data integration provides visibility into Duo's security posture, user access patterns, administrative activities, and authentication infrastructure.

CategoryIdentity
DirectionQuery source
Sign-inDuo Admin API
Query languagesSQLite
Tables11
Query templates40
Websiteduo.com

Before you start​

Huntbase signs in to DUO with Duo Admin API. Create the credential in DUO first, then keep it to hand for the Connect step.

  1. Sign in to the Duo Admin Panel and go to Applications › Application Catalog.
  2. Find the Admin API entry and click + Add to create the application.
  3. Grant only the read permissions listed below, and leave the write permissions cleared.
  4. Copy the Integration key, Secret key and API hostname from the application page.

Permissions:

  • Grant read information
  • Grant read log
  • Grant resource - Read
  • Grant administrators - Read
Watch out for
  • Only administrators with the Owner role can create or modify an Admin API application.
  • Treat the secret key like a password. If you set allowed IP ranges on the application, requests from other networks are refused.

For the vendor's own instructions, see Duo Admin API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect DUO​

  1. Go to Connections and click New connection, or click New connection on the DUO product page.
  2. On Product, pick DUO and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your DUO lives:

FieldRequiredNotes
API HostnameYesThe API hostname shown on the Admin API application, such as api-xxxxxxxx.duosecurity.com, without https://.

Credentials​

The only Method is Duo Admin API. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Integration KeyYesSecret — not shown again after you save it.
Secret KeyYesSecret — not shown again after you save it.

Query it​

Once connected, DUO can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
SQLiteSQL over the 11 tables listed below, alongside every other connected source.

Example: SQLite​

Get account summary — Retrieve the full Duo account summary.

select
  *
from
  duo_account_summary;

DUO ships with 40 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically​

DUO comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

QueryFinds
Sync usersuser
Sync groupsgroup
Sync administratorsuser
Sync group membershipsgroup, user
Sync enrolled phonesdevice, user

Tables​

DUO adds 11 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 11 tables
TableContains
duo_account_settingsGet settings for the Duo account.
duo_account_summaryGet summary info for the Duo account.
duo_admin_log_recordAdmin log records in the Duo account.
duo_administrative_unitAdministrativeUnits in the Duo account.
duo_administratorAdministrators in the Duo account.
duo_auth_log_recordAuth log records in the Duo account.
duo_groupGroups in the Duo account.
duo_integrationIntegrations in the Duo account.
duo_phonePhones in the Duo account.
duo_tokenTokens in the Duo account.
duo_userUsers in the Duo account.

Next steps​