Duo Security connector setup

Polls the Cisco Duo Admin API for authentication, telephony, and activity logs, plus optional user inventory snapshots.

What you need first

Requirement	Details
Duo access	Owner, Administrator, or Application Manager (to create or view the Admin API application)
Admin API app	Dedicated Admin API application in the Duo Admin Panel
Hostname	API hostname for your Duo account (e.g. api-xxxxxxxx.duosecurity.com)

For Duo Federal, use the *.duofederal.com hostname instead of *.duosecurity.com.

1. Create an Admin API application

1. Sign in to the Duo Admin Panel.
2. Go to Applications → Application Catalog.
3. Search for Admin API and click Add.
4. Name the application (e.g. Perpetual Duo).
5. On the Properties tab, enable:
   • Grant read resource
   • Grant read log
   • Grant read info
6. Save the application.
7. On the application details page, copy:
   • Integration key (ikey)
   • Secret key (skey) — click to reveal; treat like a password
   • API hostname (e.g. api-xxxxxxxx.duosecurity.com)

2. Perpetual credential

1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
2. Choose Text.
3. Fill in:

Field	Value
Name	Unique identifier using letters, digits, and underscores only (e.g. duo_security).
Allowed URL patterns	*.duosecurity.com, *.duofederal.com
Value	Secret key from step 1

4. Save the credential.

The integration key and API hostname are connector settings (step 3), not the credential secret.

3. Create the Duo Security connector

1. Go to Datasets → Connectors → Create Connector.
2. Select Duo Security.
3. Connector name: unique identifier (letters, numbers, underscores).
4. Configure:
   • Secret key: select the credential from step 2.
   • Poll interval (minutes): default 5 for log streams.
   • API hostname: full hostname from step 1 (no https:// prefix).
   • Integration key: ikey from step 1.
   • Enable streams:

Setting	Default	Admin API path	Notes
Authentication logs	On	/admin/v2/logs/authentication	Login and enrollment events
Telephony logs	On	/admin/v2/logs/telephony	Phone and SMS authentication
Activity logs	On	/admin/v2/logs/activity	Admin and system activity
User inventory	On	/admin/v1/users	Periodic user roster snapshot

At least one log stream or user inventory must stay enabled.

5. Optionally check Deploy, then save.

First run backfills roughly the last 24 hours for log streams. Duo log APIs have an ingestion delay; the connector accounts for this when choosing time windows.

Operational notes

• Secret key access: Only Owner, Administrator, or Application Manager roles can view the secret key.
• Federal environments: Use the duofederal.com API hostname and allow that domain in URL patterns.
• User inventory: Runs as a paginated snapshot alongside log polling, not as a real-time stream.

Reference

• Duo Admin API
• Duo Admin API authentication