Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-cisco-duo

Cisco Duo

You can integrate Cisco Duo with Sophos Fusion so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Cisco Duo product overview

Cisco Duo's multi-factor authentication (MFA) solution is a cloud-based platform designed to confirm the identity of users before granting them access to applications. It does this by adding an additional layer of security, ensuring that users provide two or more verification methods to authenticate their identity.

Warning

The Cisco Duo API has a limit of 1 request per minute. We have a 1 minute delay between paginated calls, but we've seen in the past that some customers used Cisco Duo credentials with other services (such as Splunk), and these services were “stealing” the rate limit allowance, which resulted in multiple throttling and 429 failures. If that’s the case, you need to use a unique set of credentials for each service.

What we ingest

Sophos XDR collects Cisco Duo data by calling the Duo Admin API log endpoints on a schedule. For a typical Cisco Duo cloud integration, we focus on authentication activity that Duo exposes on that API (for example, sign-in and MFA outcomes).

Sophos XDR uses the following Cisco Duo Admin API log feeds:

  • Authentication logs: Sign-in and MFA events that Duo returns on the authentication log feed for the requested time window.
  • Administrator logs: Administrative actions and audit-style events that Duo returns from the administrator log feed (changes in the Duo Admin Panel and related context).
  • Telephony logs: Phone- and SMS-related authentication events that Duo returns from the telephony log feed.

See Event and data types for a more detailed summary of how data types get normalized to events.

Event and data types

We ingest the following event and data types from Cisco Duo:

  • End-user authentication and MFA: Authentication logs with event_type authentication, result, factor, reason, access device and browser context, auth_device, application name, txid, and adaptive trust fields when present. Normalized to authentication telemetry.
  • Enrollment: Authentication-log records with event_type enrollment (device or user enrollment lifecycle as Duo records them). Normalized to authentication telemetry.
  • Duo administrator auditing: Administrator logs with action, object, username, isotimestamp, and JSON description (integrations, directory sync, API keys, user updates, and similar admin actions). Normalized to cloud audit telemetry.
  • Duo admin console access: Events with action admin_login or admin_login_error: sign-in to the Duo admin console, including factor and IP embedded in description. Normalized to authentication telemetry.
  • Telephony: Compact telephony records (context, credits, phone, type, timestamps): SMS/voice factor usage and related metering-style fields as Duo exposes them. Normalized to generic telemetry.

Additional administrator log formats that follow the admin-log structure but do not map to a specialized subtype are processed using the same normalization paths described above, where applicable. Less common formats may appear as generic telemetry.

Data provided by this integration

Data provided by Cisco Duo gets normalized to the following schemas:

  • auth
  • cloudaudit
  • generic

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation