--- title: "Integrate Cisco Duo with Red Canary" slug: "integrate-cisco-duo-with-red-canary" updated: 2026-09-09T16:09:40Z published: 2026-09-09T16:09:40Z canonical: "docs.redcanary.com/integrate-cisco-duo-with-red-canary" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Cisco Duo with Zscaler MDR Cisco Duo is a multi-factor authentication (MFA) and security platform that helps organizations boost security by verifying user identity, establishing device trust, and providing a secure connection to company networks and applications. It provides authentication logs, activity monitoring, and security event detection through its Trust Monitor feature. Connecting Duo’s security data to Zscaler MDR gives your team the ability to shut down identity-based attacks in near real time, long before they escalate into a major incident. ## Prerequisites Before you start the Duo integration, please make sure the following requirements are met. - You have a Cisco Duo administrator account with the Owner role - You’re licensed for one of the following Cisco Duo editions: - Duo Essentials - Duo Advantage - Duo Premier - You’ve enabled identity discovery in Zscaler MDR. See [Endpoint/Identity Discovery](/doc/docs/endpoint-identity-discovery) for details. Note that for Trust Monitor alerts, you need the Advantage or Premier edition. For more information about Duo licensing, see Cisco’s [Editions and Pricing](https://duo.com/editions-and-pricing) page. ## 1 Zscaler MDR | Add the Integration The first step is to add the new integration in Zscaler MDR. 1. In the Zscaler MDR portal, go to the **Integrations** page then click **Add Integration**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 2. On the **Add integration** dialog, search for the **Cisco Duo** integration then click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 3. On the configuration page, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) If you don’t supply a name, the **API hostname** value will be used by default. ## 2 Cisco | Configure a Duo Admin API Application In order to feed the necessary logs and alerts to Zscaler MDR, you need to set up an Admin API application in your Duo environment. 1. Sign in to your **Duo Admin Panel** as an Administrator with Owner access. 2. Go to **Applications > Manage > Application Catalog**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 3. Use the filter bar to locate the **Admin API** application then click **Add**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-2_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 4. Give the application a unique name and copy the **Integration key,** **Secret key**, and **API hostname** values from the **Details** section. You’ll enter them into Zscaler MDR later. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-2_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 5. In the **Settings** section, give the application the following permissions: See the FAQ section for an explanation of these permissions and why Zscaler MDR needs them. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-2_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) - **Grant read log** - **Grant resource - Read** - **Grant resource - Write** 6. Click **Save Changes**. ## 3 Zscaler MDR | Enter the Duo Credentials into Zscaler MDR Once you’ve configured the Duo application, enter the copied credentials into Zscaler MDR. 1. In the **Record the API credentials** section, enter the **Integration key, Secret key, and API hostname** from the Duo Admin API application. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-3_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) ## 4 Zscaler MDR | Confirm Permissions and Activate the Integration 1. In the **Configure permissions for the API credentials** section, check the **I’ve configured the permissions** box. (This confirms that you’ve completed the [Configure a Duo Admin API Application](/doc/docs/integrate-cisco-duo-with-red-canary#2-cisco-configure-a-duo-admin-api-application) steps above.) ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-4_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) 2. *Optional*: Under the **Advanced Configuration** dropdown: - Deselect **Ingest Trust Monitor alerts** if you don’t have Cisco Duo’s Advantage or Premier Edition, or if you don’t want Zscaler MDR to ingest your Trust Monitor alerts. - Exclude selected Cisco Duo identity groups from being counted as monitored identities. Note that excluded groups and identities may still be included in investigations and threats, but will not be included in the MDR Identities count on the [License Usage](/doc/docs/mdr-identities-licensing-how-licensing-and-usage-are-determined) page. 3. Click **Save** to activate the integration. > [!TIP] > The Cisco Duo integration is now live! > > You should start to see Duo data being ingested on your Zscaler MDR dashboard within 24 hours. ## 5 Zscaler MDR | Modifying the Integration Once the integration is active, there are no routine maintenance tasks to perform. However, you’ll need to modify the configuration if you want to delete the integration. To modify the configuration: 1. In the Zscaler MDR portal, go to the **Integrations** page then click on the name of the integration you want to modify. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/duo-5_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) #### Deleting the Integration To remove the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D) button then click **OK** to confirm. > [!WARNING] > Important > > If you delete the integration, no new alerts will be sent to Zscaler MDR and all processed alerts will be deleted. This action cannot be undone. ## FAQ --- ### #### What Duo Admin API permissions does Zscaler MDR need? You’ll need to grant Zscaler MDR the following permissions via the Duo Admin API application: | Permission (Scope) | Used for | Reason Zscaler MDR needs this | | --- | --- | --- | | Grant read log | The Admin API application can read authentication, offline access, telephony, and administrator action log information | Allows Zscaler MDR to ingest telemetry and logs from the Admin API | | Grant resource - Read | The Admin API application can read information about resource objects such as end users, policies, and devices | Allows Zscaler MDR to fetch information about identities and resources from the Admin API | | Grant resource - Write | The Admin API application can create, update, and delete resource objects such as end users, policies, and devices | Allows Zscaler MDR to update resources with the Admin API, specifically to add comments or update the status of a Security Event or run response actions |