> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Duo

> Connect ThreatAware to Duo to monitor authentication events and security controls

## Overview

The Duo integration enables ThreatAware to collect read-only data from your Duo Admin Panel, providing visibility into authentication events, user devices, and security configurations.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: Duo Administrator account
</Info>

## Data collected

The Duo integration provides:

* Authentication events
* User device information
* Security policy status
* API access controls

## Use cases

<CardGroup cols={2}>
  <Card title="Authentication Monitoring" icon="shield-halved">
    Track authentication events and user access patterns
  </Card>

  <Card title="Device Tracking" icon="clipboard-check">
    Monitor devices used for authentication
  </Card>

  <Card title="Security Posture" icon="eye">
    Validate security configurations and policies
  </Card>

  <Card title="Compliance Validation" icon="file-contract">
    Generate reports on authentication coverage and controls
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Duo Admin Panel">
    Access the [Duo Admin Panel](https://admin.duo.com) with an administrator account.
  </Step>

  <Step title="Create API Integration">
    Navigate to **Applications** in the Duo Admin Panel. Click **Protect an Application**, search for **Partner Auth API** or the appropriate API option for ThreatAware, and click **Protect** next to the selected API option.

    <Warning>
      Ensure the API integration has appropriate read permissions for authentication and device data.
    </Warning>
  </Step>

  <Step title="Copy API Credentials">
    After creating the integration, copy the generated credentials: **Integration Key**, **Secret Key**, and **API Hostname**.

    <Tip>
      Store these credentials securely. The Secret Key will only be displayed once during setup.
    </Tip>
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware. Navigate to **Settings** > **Integrations**, search for and select **Duo**. Enter the required credentials: **Integration Key** (the key generated in Duo), **Secret Key** (for API authentication), and **API Hostname** (the Duo API hostname). Click **Connect** to establish the integration.
  </Step>

  <Step title="Verify Connection">
    After connecting, verify the integration is working by checking that the **Integration Status** shows as **Active** and confirming that authentication data is appearing in ThreatAware.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Integration Key" icon="key">
    **Field Name**: Duo Integration Key
    **Type**: String
    **Description**: The key generated for the Duo API integration

    This key is displayed when you create the API integration in the Duo Admin Panel.
  </Accordion>

  <Accordion title="Secret Key" icon="lock">
    **Field Name**: Duo Secret Key
    **Type**: Password (encrypted)
    **Description**: The secret associated with the Integration Key

    <Warning>
      The Secret Key is only displayed once during integration setup. Store it securely immediately after creation.
    </Warning>
  </Accordion>

  <Accordion title="API Hostname" icon="server">
    **Field Name**: Duo API Hostname
    **Type**: String
    **Description**: The hostname for the Duo API

    Example: `api-12345678.duosecurity.com`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Duo integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for the initial data sync
   * Check for authentication event data in ThreatAware
   * Verify device information is being collected

3. **Test Queries**
   * Create a test query to filter data from Duo
   * Verify the authentication events match your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Integration Key**, **Secret Key**, and **API Hostname** are exactly as displayed in Duo
    * Ensure there are no extra spaces in any credential
    * Confirm the API integration is marked as active in the Duo Admin Panel
    * Check that your Duo account has administrator privileges
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no data appears

    **Solutions**:

    * Verify the API integration has appropriate read permissions
    * Review the [Duo API Documentation](https://duo.com/docs/administration-api) for required permissions
    * Check that the integration is not restricted to specific application scopes
    * Ensure the integration has access to authentication logs and device information
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **API Hostname** is correct and matches your Duo instance
    * Check firewall rules allow outbound HTTPS (443) to Duo servers
    * Test the API hostname in a browser or with curl to verify reachability
    * Confirm your network allows access to Duo's API endpoints
  </Accordion>

  <Accordion title="No Data After 10 Minutes" icon="database">
    **Symptoms**: Integration shows active but no authentication data appears

    **Solutions**:

    * Verify there are authentication events in your Duo account to collect
    * Confirm the API integration has access to authentication logs
    * Check that users are logging in through Duo
    * Wait up to 15 minutes for the initial sync to complete
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Duo API Documentation" icon="book" href="https://duo.com/docs/administration-api">
    Official Duo API documentation for detailed permissions and configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API integration specifically for ThreatAware
  * Document credentials in your organisation's password manager
  * Rotate credentials annually or per your security policy
  * Monitor integration activity in Duo regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read permissions to the API integration
  * Limit API access to necessary authentication and device data
  * Review Duo's API usage logs periodically
  * Follow your organisation's least privilege principles
</Tip>