Skip to main content

​
Overview

The Duo integration enables ThreatAware to collect read-only data from your Duo Admin Panel, providing visibility into authentication events, user devices, and security configurations.
Connection Method: API Setup Time: 15 minutes Access Required: Duo Administrator account

​
Data collected

The Duo integration provides:
  • Authentication events
  • User device information
  • Security policy status
  • API access controls

​
Use cases

Authentication Monitoring

Track authentication events and user access patterns

Device Tracking

Monitor devices used for authentication

Security Posture

Validate security configurations and policies

Compliance Validation

Generate reports on authentication coverage and controls

​
Setup instructions

1

Log in to Duo Admin Panel

Access the Duo Admin Panel with an administrator account.
2

Create API Integration

Navigate to Applications in the Duo Admin Panel. Click Protect an Application, search for Partner Auth API or the appropriate API option for ThreatAware, and click Protect next to the selected API option.
Ensure the API integration has appropriate read permissions for authentication and device data.
3

Copy API Credentials

After creating the integration, copy the generated credentials: Integration Key, Secret Key, and API Hostname.
Store these credentials securely. The Secret Key will only be displayed once during setup.
4

Configure in ThreatAware

Complete the integration setup in ThreatAware. Navigate to Settings > Integrations, search for and select Duo. Enter the required credentials: Integration Key (the key generated in Duo), Secret Key (for API authentication), and API Hostname (the Duo API hostname). Click Connect to establish the integration.
5

Verify Connection

After connecting, verify the integration is working by checking that the Integration Status shows as Active and confirming that authentication data is appearing in ThreatAware.

​
Required credentials

Field Name: Duo Integration Key Type: String Description: The key generated for the Duo API integrationThis key is displayed when you create the API integration in the Duo Admin Panel.
Field Name: Duo Secret Key Type: Password (encrypted) Description: The secret associated with the Integration Key
The Secret Key is only displayed once during integration setup. Store it securely immediately after creation.
Field Name: Duo API Hostname Type: String Description: The hostname for the Duo APIExample: api-12345678.duosecurity.com

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the Duo integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 5-10 minutes for the initial data sync
    • Check for authentication event data in ThreatAware
    • Verify device information is being collected
  3. Test Queries
    • Create a test query to filter data from Duo
    • Verify the authentication events match your expectations

​
Troubleshooting

Symptoms: Integration status shows authentication failureSolutions:
  • Verify the Integration Key, Secret Key, and API Hostname are exactly as displayed in Duo
  • Ensure there are no extra spaces in any credential
  • Confirm the API integration is marked as active in the Duo Admin Panel
  • Check that your Duo account has administrator privileges
Symptoms: Integration connects but no data appearsSolutions:
  • Verify the API integration has appropriate read permissions
  • Review the Duo API Documentation for required permissions
  • Check that the integration is not restricted to specific application scopes
  • Ensure the integration has access to authentication logs and device information
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the API Hostname is correct and matches your Duo instance
  • Check firewall rules allow outbound HTTPS (443) to Duo servers
  • Test the API hostname in a browser or with curl to verify reachability
  • Confirm your network allows access to Duo’s API endpoints
Symptoms: Integration shows active but no authentication data appearsSolutions:
  • Verify there are authentication events in your Duo account to collect
  • Confirm the API integration has access to authentication logs
  • Check that users are logging in through Duo
  • Wait up to 15 minutes for the initial sync to complete

​
Additional resources

Duo API Documentation

Official Duo API documentation for detailed permissions and configuration

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated API integration specifically for ThreatAware
  • Document credentials in your organisation’s password manager
  • Rotate credentials annually or per your security policy
  • Monitor integration activity in Duo regularly
Security Considerations
  • Only grant read permissions to the API integration
  • Limit API access to necessary authentication and device data
  • Review Duo’s API usage logs periodically
  • Follow your organisation’s least privilege principles