Integrate Cisco Duo with Red Canary
- 07 Jul 2025
- 3 Minutes to read
- PDF
Integrate Cisco Duo with Red Canary
- Updated on 07 Jul 2025
- 3 Minutes to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback!
Cisco Duo is a multi-factor authentication (MFA) and security platform that helps organizations boost security by verifying user identity, establishing device trust, and providing a secure connection to company networks and applications. It provides authentication logs, activity monitoring, and security event detection through its Trust Monitor feature. Connecting Duo’s security data to Red Canary gives your team the ability to shut down identity-based attacks in near real time, long before they escalate into a major incident.
Prerequisites
Before you start the Duo integration, please make sure the following requirements are met.
You have a Cisco Duo administrator account with the Owner role
You’re licensed for one of the following Cisco Duo editions:
Duo Essentials
Duo Advantage
Duo Premier
Note that for Trust Monitor alerts, you need the Advantage or Premier edition. For more information about Duo licensing, see Cisco’s Editions and Pricing page.
1 Red Canary | Add the Integration
The first step is to add the new integration in Red Canary.
From your Red Canary homepage, go to the Integrations page then click Add Integration.
On the Add integration dialog, search for the Cisco Duo integration then click Configure.
On the configuration page, enter a name for the integration.
If you don’t supply a name, the API hostname value will be used by default.
2 Cisco | Configure a Duo Admin API Application
In order to feed the necessary logs and alerts to Red Canary, you need to set up an Admin API application in your Duo environment.
Sign in to your Duo Admin Panel as an Administrator with Owner access.
Go to Applications > Manage > Application Catalog.
Use the filter bar to locate the Admin API application then click Add.
Give the application a unique name and copy the Integration key, Secret key, and API hostname values from the Details section. You’ll enter them into Red Canary later.
In the Settings section, give the application the following permissions:
Grant read log
Grant resource - Read
Grant resource - Write
See the FAQ section for an explanation of these permissions and why Red Canary needs them.
Click Save Changes.
3 Red Canary | Enter the Duo Credentials into Red Canary
Once you’ve configured the Duo application, enter the copied credentials into Red Canary.
In the Record the API credentials section, enter the Integration key, Secret key, and API hostname from the Duo Admin API application.
4 Red Canary | Confirm Permissions and Activate the Integration
In the Configure permissions for the API credentials section, check the I’ve configured the permissions box. (This confirms that you’ve completed the Configure a Duo Admin API Application steps above.)
Optional: Under the Advanced Configuration dropdown:
Deselect Ingest Trust Monitor alerts if you don’t have Cisco Duo’s Advantage or Premier Edition, or if you don’t want Red Canary to ingest your Trust Monitor alerts.
Exclude selected Cisco Duo identity groups from being counted as monitored identities. Note that excluded groups and identities may still be included in investigations and threats, but will not be included in the MDR Identities count on the License Usage page.
Click Save to activate the integration.
The Cisco Duo integration is now live!
You should start to see Duo data being ingested on your Red Canary dashboard within 24 hours.
5 Red Canary | Modifying the Integration
Once the integration is active, there are no routine maintenance tasks to perform. However, you’ll need to modify the configuration if you want to delete the integration.
To modify the configuration:
From your Red Canary homepage, go to the Integrations page then click on the name of the integration you want to modify.
Deleting the Integration
To remove the integration from Red Canary, click the 
button then click OK to confirm.
Important
If you delete the integration, no new alerts will be sent to Red Canary and all processed alerts will be deleted. This action cannot be undone.
FAQ
What Duo Admin API permissions does Red Canary need?
You’ll need to grant Red Canary the following permissions via the Duo Admin API application:
Permission (Scope) | Used for | Reason Red Canary needs this |
|---|---|---|
Grant read log | The Admin API application can read authentication, offline access, telephony, and administrator action log information | Allows Red Canary to ingest telemetry and logs from the Admin API |
Grant resource - Read | The Admin API application can read information about resource objects such as end users, policies, and devices | Allows Red Canary to fetch information about identities and resources from the Admin API |
Grant resource - Write | The Admin API application can create, update, and delete resource objects such as end users, policies, and devices | Allows Red Canary to update resources with the Admin API, specifically to add comments or update the status of a Security Event or run response actions |
Was this article helpful?