elastic · andrewkroh · Oct 11, 2021 · Sep 9, 2021 · Sep 9, 2021 · Sep 9, 2021
@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: git@1.11
@@ -0,0 +1,65 @@
+# Cisco Duo
+
+The Cisco Duo integration collects and parses data from the Cisco Duo Admin APIs.
+
+## Compatibility
+
+This module has been tested against Cisco Duo `Core Authentication Service: D224.13` and `Admin Panel: D224.18`
+
+## Requirements
+
+In order to ingest data from the Cisco Duo Admin API you must:
+- Have a the Cisco Duo administrator account with **Owner** role [Sign up](https://signup.duo.com/)
+- Sign in to [Duo Admin Panel](https://admin.duosecurity.com/)
+- Go through following tabs **Application > Protect an Application > Admin API > Protect**
+- Now you will find your **Hostname**, **Integration key** and **Secret key** which will be required while configuring the integration package.
+- For this integration you will require **Grant read information** and **Grant read log** permissions.
+- Make sure you have whitelisted your IP Address.
+
+## Note
+
+While setting up the interval take care of following.
+- `Interval has to be greater than 1m.`
+- `Larger values of interval might cause delay in data ingestion.`
+
+## Logs
+
+### Administrator
+
+This is the `admin` dataset.
+
+{{event "admin"}}
+
+{{fields "admin"}}
+
+### Authentication
+
+This is the `auth` dataset.
+
+{{event "auth"}}
+
+{{fields "auth"}}
+
+### Offline Enrollment
+
+This is the `offline_enrollment` dataset.
+
+{{event "offline_enrollment"}}
+
+{{fields "offline_enrollment"}}
+
+### Summary
+
+This is the `summary` dataset.
+
+{{event "summary"}}
+
+{{fields "summary"}}
+
+### Telephony
+
+This is the `telephony` dataset.
+
+{{event "telephony"}}
+
+{{fields "telephony"}}
@@ -0,0 +1,15 @@
+version: '2.3'
+services:
+  cisco_duo:
+    image: docker.elastic.co/observability/stream:v0.6.1
+    hostname: cisco_duo
+    ports:
+      - 8080
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: "8080"
+    command:
+      - http-server
+      - --addr=:8080
+      - --config=/files/config.yml
@@ -0,0 +1,31 @@
+rules:
+  - path: /admin/v1/logs/administrator
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {"response":[{"action":"admin_self_activate","description":"{\"name\": \"narroway\", \"phone\": \"+12345678901\", \"is_temporary_password\": false, \"email\": \"narroway@example.com\", \"hardtoken\": null, \"role\": \"Owner\", \"status\": \"Pending Activation\", \"restricted_by_admin_units\": false, \"administrative_units\": \"\"}","isotimestamp":"2021-07-20T11:44:37+00:00","object":"jsmith","timestamp":1626781477,"username":"narroway"},{"action":"activation_begin","description":"Starting activation process","isotimestamp":"2021-07-20T11: 41: 31+00: 00","object":null,"timestamp":1626781291,"username":"narroway"}],"stat":"OK"}
+  - path: /admin/v2/logs/authentication
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {"response":{"authlogs":[{"access_device":{"browser":"Chrome","browser_version":"67.0.3396.99","flash_version":"uninstalled","hostname":null,"ip":"169.232.89.219","is_encryption_enabled":true,"is_firewall_enabled":true,"is_password_set":true,"java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Mac OS X","os_version":"10.14.1","security_agents":[]},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Microsoft Azure Active Directory"},"auth_device":{"ip":"192.168.225.254","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"My iPhone X (734-555-2342)"},"email":"narroway@example.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2020-02-13T18:56:20.351346+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1581620180,"trusted_endpoint_status":"not trusted","txid":"340a23e3-23f3-23c1-87dc-1491a23dfdbb","user":{"groups":["Duo Users","CorpHQ Users"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway@example.com"}},{"access_device":{"browser":"Chrome","browser_version":"92.0.4515.107","flash_version":"uninstalled","hostname":null,"ip":"169.232.89.219","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Windows","os_version":"10"},"alias":"","application":{"key":"DIY231J8BR23QK4UKBY8","name":"Duo Access Gateway Launcher"},"auth_device":{"ip":"169.232.89.112","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"+91 12345 12345"},"email":"narroway@example.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-07-23T07:21:51.271776+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1627024911,"txid":"fa59a691-9139-43e9-9854-f9e1dbf72af5","user":{"groups":["AD Sync"],"key":"DU3KC77WJ06Y5HIV7XKQ","name":"narroway"}}]},"stat":"OK"}
+  - path: /admin/v1/logs/offline_enrollment
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {"response": [{"action": "o2fa_user_provisioned","description": "{\"user_agent\": \"DuoCredProv/4.0.6.413 (Windows NT 6.3.9600; x64; Server)\", \"hostname\": \"WKSW10x64\", \"factor\": \"duo_otp\"}","isotimestamp": "2019-08-30T16:10:05+00:00","object": "Acme Laptop Windows Logon","timestamp": 1567181405,"username": "narroway"}], "stat": "OK"}
+  - path: /admin/v1/info/summary
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {"response":{"admin_count":3,"integration_count":9,"telephony_credits_remaining":960,"user_count":8},"stat":"OK"}
+  - path: /admin/v1/logs/telephony
+    methods: ["GET"]
+    responses:
+      - status_code: 200
+        body: |
+          {"response": [{"context":"administrator login","credits":5,"isotimestamp":"2021-07-22T12:59:30+00:00","phone":"+121234512345","timestamp":1626958770,"type":"phone"},{"context":"verify","credits":1,"isotimestamp":"2021-08-16T06:03:32+00:00","phone":"+121234512345","timestamp":1629093812,"type":"sms"},{"context": "authentication","credits": 1,"isotimestamp":"2020-03-20T15:38:12+00:00","phone":"+121234512345","timestamp":1584718692,"type":"sms"}], "stat": "OK"}
@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.1.0"
+  changes:
+    - description: initial release
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1629
@@ -0,0 +1,8 @@
+{"action":"activation_begin","description":null,"isotimestamp":"2021-07-20T11: 41: 31+00: 00","object":null,"timestamp":1626781291,"username":"narroway"}
+{"action":"admin_activate_duo_push","description":"{\"number\": \"+12345678901\", \"extension\": \"\"}","isotimestamp":"2021-07-20T11:44:37+00:00","object":"940-967-2177","timestamp":1626781477,"username":""}
+{"action":"activation_begin","description":"Starting activation process","isotimestamp":"2021-07-20T11: 41: 31+00: 00","object":null,"timestamp":1626781291,"username":"narroway"}
+{"action":"activation_set_password","description":null,"isotimestamp":"2021-07-20T11: 44: 09+00: 00","object":"narroway","timestamp":1626781449,"username":"narroway"}
+{"action":"admin_self_activate","description":"{\"name\": \"narroway\", \"phone\": \"+12345678901\", \"is_temporary_password\": false, \"email\": \"narroway@example.com\", \"hardtoken\": null, \"role\": \"Owner\", \"status\": \"Pending Activation\", \"restricted_by_admin_units\": false, \"administrative_units\": \"\"}","isotimestamp":"2021-07-20T11:44:37+00:00","object":"jsmith","timestamp":1626781477,"username":"narroway"}
+{"action":"admin_update","description":"{\"phone\": \"+451234567890\"}","isotimestamp":"2021-07-20T11:45:11+00:00","object":"narroway","timestamp":1626781511,"username":"narroway"}
+{"action":"user_update","description":"{\"realname\": \"test 4\", \"Sync Ref. Code\": \"41c7e5714a91d17dea11157539d5d1ac\"}","isotimestamp":"2021-07-20T11:45:11+00:00","object":"narroway","timestamp":1626781511,"username":"narroway"}
+{"action":"user_update","description":"{\"email\": \"narroway@example.com\", \"Sync Ref. Code\": \"41c7e5714a91d17dea11157539d5d1ac\"}","isotimestamp":"2021-07-20T11:45:11+00:00","object":"narroway","timestamp":1626781511,"username":"narroway"}