> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco Duo

> Sync users, ingest authentication and activity logs, and contain users from Cisco Duo

## Features

* **User Directory Sync** - Automatically sync users from Cisco Duo
* **Authentication Logs** - Ingest MFA authentication events for threat detection
* **Activity Logs** - Ingest administrator and system activity events (create, update, delete actions)
* **User Containment** - Disable compromised users directly from Wirespeed

## Setup Instructions

1. Login to **Cisco Duo Admin Panel**
2. Click on **Applications** on the left nav and select **Application Catalog**
3. Search for **Admin API** and click **+Add**
4. Name your application **Wirespeed**
5. Enable the following permissions:
   * **Grant read log** - Required for authentication log ingestion
   * **Grant read resource** - Required for user directory sync
   * **Grant write resource** - Required for user containment (disable/enable users)
6. Copy the **Integration Key**, **Secret Key**, and **API Hostname**
7. Click **Save changes**
8. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
9. Select Cisco Duo and click **Integrate**
10. Input the **Integration Key**, **Secret Key**, and **API Hostname**

## Capabilities

| Capability          | Description                              | Required Permission  |
| ------------------- | ---------------------------------------- | -------------------- |
| User Sync           | Sync users from Duo directory            | Grant read resource  |
| Authentication Logs | Ingest MFA authentication events         | Grant read log       |
| Activity Logs       | Ingest administrator and system actions  | Grant read log       |
| Contain User        | Disable a user to prevent authentication | Grant write resource |
| Uncontain User      | Re-enable a previously disabled user     | Grant write resource |

<Warning>There is a two minute delay in log publishing enforced by Duo</Warning>