Duo admin/auth logs in Cortex XDR

[mgreer]

Hello!

Has anyone started ingesting Duo admin or authentication logs into Cortex XDR?

Duo provides a log sync utility but it doesn't support an API key like the HTTP Custom Collector would require and it doesn't write logs to disk (design decision) so the XDR filebeat collector can't pick them up.  I'm hoping there's an easier way than Duo log sync > some intermediate collector > Cortex XDR Custom Collector.

Thanks for any ideas!

[afurze · Accepted solution]

Hi Mgreer,

Cortex XDR does not natively support ingesting Duo admin/auth logs, however, the Duo log sync utility does support sending via CEF.  You can deploy the Broker VM and enable the Syslog Collector applet (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/external-data-ingestion/add...) and configure to receive CEF logs.  Cortex XDR will automatically create a data set for you and you can then search logs, as well as create BIOCs, IOCs, and correlation rules. 

[mgreer]

You are correct, CEF is an option but there seems to be a significant difference between the CEF and JSON data:

I can start with CEF though and go from there.  Maybe Duo is on the roadmap for a native integration.
Thanks!