Cisco Duo is a multi-factor authentication (MFA) and security platform that helps organizations boost security by verifying user identity, establishing device trust, and providing a secure connection to company networks and applications. It provides authentication logs, activity monitoring, and security event detection through its Trust Monitor feature. Connecting Duo’s security data to Zscaler MDR gives your team the ability to shut down identity-based attacks in near real time, long before they escalate into a major incident.
Prerequisites
Before you start the Duo integration, please make sure the following requirements are met.
You have a Cisco Duo administrator account with the Owner role
You’re licensed for one of the following Cisco Duo editions:
Duo Essentials
Duo Advantage
Duo Premier
You’ve enabled identity discovery in Zscaler MDR. See Endpoint/Identity Discovery for details.
Note that for Trust Monitor alerts, you need the Advantage or Premier edition. For more information about Duo licensing, see Cisco’s Editions and Pricing page.
1 Zscaler MDR | Add the Integration
The first step is to add the new integration in Zscaler MDR.
In the Zscaler MDR portal, go to the Integrations page then click Add Integration.
On the Add integration dialog, search for the Cisco Duo integration then click Configure.
On the configuration page, enter a name for the integration.
If you don’t supply a name, the API hostname value will be used by default.
2 Cisco | Configure a Duo Admin API Application
In order to feed the necessary logs and alerts to Zscaler MDR, you need to set up an Admin API application in your Duo environment.
Sign in to your Duo Admin Panel as an Administrator with Owner access.
Go to Applications > Manage > Application Catalog.
Use the filter bar to locate the Admin API application then click Add.
Give the application a unique name and copy the Integration key, Secret key, and API hostname values from the Details section. You’ll enter them into Zscaler MDR later.
In the Settings section, give the application the following permissions:
Grant read log
Grant resource - Read
Grant resource - Write
See the FAQ section for an explanation of these permissions and why Zscaler MDR needs them.
Click Save Changes.
3 Zscaler MDR | Enter the Duo Credentials into Zscaler MDR
Once you’ve configured the Duo application, enter the copied credentials into Zscaler MDR.
In the Record the API credentials section, enter the Integration key, Secret key, and API hostname from the Duo Admin API application.
4 Zscaler MDR | Confirm Permissions and Activate the Integration
In the Configure permissions for the API credentials section, check the I’ve configured the permissions box. (This confirms that you’ve completed the Configure a Duo Admin API Application steps above.)
Optional: Under the Advanced Configuration dropdown:
Deselect Ingest Trust Monitor alerts if you don’t have Cisco Duo’s Advantage or Premier Edition, or if you don’t want Zscaler MDR to ingest your Trust Monitor alerts.
Exclude selected Cisco Duo identity groups from being counted as monitored identities. Note that excluded groups and identities may still be included in investigations and threats, but will not be included in the MDR Identities count on the License Usage page.
Click Save to activate the integration.
The Cisco Duo integration is now live!
You should start to see Duo data being ingested on your Zscaler MDR dashboard within 24 hours.
5 Zscaler MDR | Modifying the Integration
Once the integration is active, there are no routine maintenance tasks to perform. However, you’ll need to modify the configuration if you want to delete the integration.
To modify the configuration:
In the Zscaler MDR portal, go to the Integrations page then click on the name of the integration you want to modify.
Deleting the Integration
To remove the integration from Zscaler MDR, click the 
button then click OK to confirm.
Important
If you delete the integration, no new alerts will be sent to Zscaler MDR and all processed alerts will be deleted. This action cannot be undone.
FAQ
What Duo Admin API permissions does Zscaler MDR need?
You’ll need to grant Zscaler MDR the following permissions via the Duo Admin API application:
Permission (Scope) | Used for | Reason Zscaler MDR needs this |
|---|---|---|
Grant read log | The Admin API application can read authentication, offline access, telephony, and administrator action log information | Allows Zscaler MDR to ingest telemetry and logs from the Admin API |
Grant resource - Read | The Admin API application can read information about resource objects such as end users, policies, and devices | Allows Zscaler MDR to fetch information about identities and resources from the Admin API |
Grant resource - Write | The Admin API application can create, update, and delete resource objects such as end users, policies, and devices | Allows Zscaler MDR to update resources with the Admin API, specifically to add comments or update the status of a Security Event or run response actions |