Hello,
How to pull authentication logs from duosecurity (www.duo.com) 2FA cloud service provider.
Any help is appreciated.
Thanks,
Hi avshch,
I have no idea about duo security, but I can google that for you http://bfy.tw/4ro7 and found this https://duo.com/docs/adminapi#logs
Which means you can get your logs using the API from duo.com ; that said you should be able to use the REST Modular input https://splunkbase.splunk.com/app/1546/ to pull the logs and index them in Splunk.
Hope that helps ...
cheers, MuS
Yes this is true, but you will need a custom handler and will need to track the ** mintime** request param to prevent duplicate events.