Integrating Duo MFA Authentication Logs with Your SIEM Stack Using Copilot

3 min readJun 21, 2024

In today’s cybersecurity landscape, integrating multiple layers of security is essential for protecting sensitive data and systems. One effective method is to use Multi-Factor Authentication (MFA) services like Duo. In this guide, we will walk you through the process of integrating Duo MFA authentication logs into your SIEM (Security Information and Event Management) stack using Copilot. This integration enhances your ability to monitor and respond to authentication events, ensuring a robust security posture.

Setting Up the Integration

To begin, you need a Duo account with the appropriate API permissions. The first step is to generate API credentials from Duo, which include an API hostname, integration key, and secret key. These credentials are essential for configuring the integration.

Configuring the Event Shipper

1. Event Shipper Setup: Within your SIEM stack, configure the event shipper to handle logs from Duo’s API. This setup allows seamless ingestion of authentication logs into your SIEM.

Adding the Integration in Copilot

1. Access Copilot: Open the Copilot interface and navigate to the ‘Customers’ tab. Select the customer for whom you want to enable the Duo integration.
2. Add Integration: Go to ‘Third Party Integrations’, select ‘Add Integrations’, and find Duo in the catalog. Enter your API hostname, integration key, and secret key, then hit submit.
3. Deploy the Integration: Once submitted, deploy the integration. This step provisions the necessary components within your SIEM stack to handle Duo events.

4. Add DUO Module Service: Add the copilot-duo-module to your docker compose file.

copilot-duo-module:
       image: ghcr.io/socfortress/copilot-duo-module:latest

Verifying the Integration

1. Check Graylog: In Graylog, verify that a new index has been created for Duo events. This index should match the integration name you specified.
2. Stream Rules: Ensure that stream rules are correctly applied to route Duo events to the appropriate index.

Copilot provides automated scheduling for regular log ingestion. After deploying the integration, Copilot sets up a scheduled job to invoke the Duo integration every 15 minutes. This automation ensures continuous monitoring without manual intervention.

For testing purposes, you can manually invoke the integration:
1. Run the Job: Go to the Schedulersection in Copilot and manually run the job to ensure logs are being ingested correctly.
2. Verify Log Data: Check the Duo stream in your SIEM to confirm that data is coming in as expected.

Monitoring with Grafana

To provide a comprehensive view of Duo events, Copilot includes a Grafana dashboard. This dashboard visualizes authentication events, helping you quickly identify and respond to security incidents.

1. Navigate to Grafana: Open Grafana and go to the ‘Dashboards’ section.
2. Select Duo Folder: Find the Duo folder and open the provided dashboard to view real-time authentication events.

Conclusion

Integrating Duo MFA logs into your SIEM stack using Copilot enhances your security monitoring capabilities. By following this guide, you can set up the integration, automate log ingestion, and leverage dashboards for effective incident response. This setup not only strengthens your security posture but also streamlines the management of authentication events. Stay secure and proactive with your SIEM strategy by integrating essential services like Duo.

Need Help?

The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.

Website: https://www.socfortress.co/