https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255911#M7059 <P>Yes this is true, but you will need a custom handler and will need to track the ** mintime** request param to prevent duplicate events.</P> Mon, 21 Mar 2016 22:36:52 GMT bmacias84 2016-03-21T22:36:52Z https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255909#M7057 <P>Hello,<BR /> How to pull authentication logs from duosecurity (<A href="http://www.duo.com">www.duo.com</A>) 2FA cloud service provider.<BR /> Any help is appreciated.<BR /> Thanks, </P> Mon, 21 Mar 2016 16:02:27 GMT https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255909#M7057 avshch 2016-03-21T16:02:27Z https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255910#M7058 <P>Hi avshch,</P> <P>I have no idea about duo security, but I can google that for you <A href="http://bfy.tw/4ro7">http://bfy.tw/4ro7</A> and found this <A href="https://duo.com/docs/adminapi#logs">https://duo.com/docs/adminapi#logs</A></P> <P>Which means you can get your logs using the API from duo.com ; that said you should be able to use the REST Modular input <A href="https://splunkbase.splunk.com/app/1546/">https://splunkbase.splunk.com/app/1546/</A> to pull the logs and index them in Splunk.</P> <P>Hope that helps ...</P> <P>cheers, MuS</P> Mon, 21 Mar 2016 20:47:40 GMT https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255910#M7058 MuS 2016-03-21T20:47:40Z https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255911#M7059 <P>Yes this is true, but you will need a custom handler and will need to track the ** mintime** request param to prevent duplicate events.</P> Mon, 21 Mar 2016 22:36:52 GMT https://community.splunk.com/t5/Security/how-to-pull-authentication-logs-from-duosecurity/m-p/255911#M7059 bmacias84 2016-03-21T22:36:52Z