Skip to main content

​
Features

  • User Directory Sync - Automatically sync users from Cisco Duo
  • Authentication Logs - Ingest MFA authentication events for threat detection
  • User Containment - Disable compromised users directly from Wirespeed

​
Setup Instructions

  1. Login to Cisco Duo Admin Panel
  2. Click on Applications on the left nav and select Application Catalog
  3. Search for Admin API and click +Add
  4. Name your application Wirespeed
  5. Enable the following permissions:
    • Grant read log - Required for authentication log ingestion
    • Grant read resource - Required for user directory sync
    • Grant write resource - Required for user containment (disable/enable users)
  6. Copy the Integration Key, Secret Key, and API Hostname
  7. Click Save changes
  8. Login to Wirespeed
  9. Navigate to Integrations > Add Integration
  10. Select Cisco Duo and click Integrate
  11. Input the Integration Key, Secret Key, and API Hostname

​
Capabilities

CapabilityDescriptionRequired Permission
User SyncSync users from Duo directoryGrant read resource
Authentication LogsIngest MFA authentication eventsGrant read log
Contain UserDisable a user to prevent authenticationGrant write resource
Uncontain UserRe-enable a previously disabled userGrant write resource
There is a two minute delay in log publishing enforced by Duo