SourcesSource TypesDuo Security

Duo Security

Collect authentication logs from your Duo Security account to monitor user authentication events and multi-factor authentication activities.

Duo Security logs allow you to view authentication events from your Duo account. RunReveal will poll the Duo Admin API to retrieve your authentication logs every 5 minutes.

Duo Security Source

Setup

To setup your Duo Security source, you will need API credentials from your Duo account with the appropriate permissions.

Duo API Credentials

  1. Log in to your Duo Admin Panel
  2. Navigate to Applications → Application Catalog
  3. Find Admin API and click + Add to create a new Admin API application

Duo API Credentials

  1. When configuring the Admin API application, ensure it has Read logs permission enabled

  2. Copy the following credentials from the application details:

    • Integration key
    • Secret key
    • API hostname (e.g., api-xxxxx.duosecurity.com)

Duo Admin API Configuration

  1. In RunReveal, create a new Duo Security source
  2. Enter the credentials from step 5:
    • Integration key: Your Duo integration key
    • Secret key: Your Duo secret key
    • API hostname: Your Duo API hostname
⚠️

Firewall Rules: If your Duo account has firewall rules or IP restrictions that limit API access, you may need to whitelist RunReveal’s outbound IP addresses. See Network Connectivity and IP Whitelisting for the IP addresses to add to your firewall allowlist.

Verify It’s Working

Once added, the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'duo' LIMIT 1

Related Documentation

For more information about Duo Security and the Admin API, see these resources:

DropboxFastly WAF