Cisco Duo Activity Logs
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CiscoDuoActivityConnectorDefinition |
| Publisher | Cisco Systems, Inc. |
| Used in Solutions | CiscoDuoSecurity |
| Collection Method | CCF |
| Connector Definition Files | CiscoDuoActivity_ConnectorDefinition.json |
| DCR Definition Files | CiscoDuoActivity_DCR.json |
| CCF Configuration | CiscoDuoActivity_PollingConfig.json |
| CCF Capabilities | CiscoDuo, Paging |
The Cisco Duo Activity Logs connector ingests admin and user activity log data from the Cisco Duo Admin API into Microsoft Sentinel.
Activity logs capture admin panel actions such as user creation, modification, deletion, admin logins, and configuration changes.
Supports HMAC-based API Key authentication (Integration Key and Secret Key).
For more information, visit Cisco Duo Admin API Docs.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
DuoActivity_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): read and write permissions are required.
Custom Permissions:
- Cisco Duo API Key: A Cisco Duo Integration Key and Secret Key are required. These are obtained by creating an Admin API application in the Duo Admin Panel with 'Grant read log' permission. See documentation.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect Cisco Duo Activity Logs to Microsoft Sentinel
To enable the Cisco Duo Activity Logs connector, provide your Duo Admin API credentials below.
- Log in to the Duo Admin Panel.
- Navigate to Applications > Protect an Application.
- Find Admin API and click Protect.
- Ensure the application has Grant read log permission enabled.
- Copy the Integration Key, Secret Key, and API Hostname and enter them below.
- Integration Key (ikey): DIXXXXXXXXXXXXXXXXXX
- Secret Key (skey): (password field)
- API Base URL: https://api-XXXXXXXX.duosecurity.com
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊