Skip to main content

Duo Security

thumbnail icon

Duo provides two-factor authentication, endpoint remediation, and secure single sign-on tools. The Sumo Logic App for Duo Security helps you monitor your Duo account’s authentication logs, administrator logs, and telephony logs. The dashboards provide insight into failed and successful authentications, events breakdown by applications, factors, and users, geo-location of events, admin activities, outliers, threat analysis of authentication, and administrator events.

Log types

The Duo Security App uses following logs. See Duo documentation for details of the log schema.

When you generate the Duo credentials, you should do it for the Admin API application.

  • Authentication Logs
  • Administrator Logs
  • Telephony Logs

Collecting Logs for the Duo Security app

To collect logs from the Duo Security App, use the new Cloud-to-Cloud Integration for Duo Security App to create the source and use the same source category while installing the app.

Installing the Duo Security app

To install the app, do the following:

  1. Select App Catalog.
  2. In the Search Apps field, search for and then select your app.
    Optionally, you can scroll down to preview the dashboards included with the app.
  3. To install the app, click Install App.
  4. Click Next in the Setup Data section.
  5. In the Configure section of the respective app, complete the following fields.
    1. Key. Select either of these options for the data source.
      • Choose Source Category, and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
  6. Click Next. You will be redirected to the Preview & Done section.

Your app will be installed in the Installed Apps folder and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, updating with full graphs and charts over time.

Viewing Duo Security dashboards

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

  • You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
  • You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
  • Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

The Duo Security app helps you monitor your Duo account’s authentication, administrator, and telephony logs.


Overview of Duo Events including events breakdown by type, geographic location, one-day time comparison of events, and admin activity.

Duo Security dashboards

Administrator Events

Geographic location of admin events, one-day time comparison of events, login errors, admin activity over time, and events breakdown by action.

Duo Security dashboards

Success Authentications

Geographic location of successful authentication events, one-day time comparison of events, breakdown of events by Application, Factor, Users, Country, State, and City.

Duo Security dashboards

Failed Authentications

Geographic location of failed authentication events, one-day time comparison of failed events, breakdown of events by Application, Factor, Users, Country, State, and City.

Duo Security dashboards

Outliers and Threat Analysis

Outliers and threat analysis of Duo events.

Duo Security dashboards
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.