> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking Cisco Duo as a source - Docs

Copy page

# Linking Cisco Duo as a source - Docs

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

[Learn more](/wizard.md)

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

**Alpha release**

This source is currently in **alpha**. The interface and available tables may change.

The Cisco Duo connector syncs your Duo Admin API data into the PostHog Data warehouse: authentication, administrator, telephony, and activity logs, plus users, groups, phones, admins, and integrations. This lets you analyze MFA success and failure rates, enrollment coverage, and unusual access patterns alongside your product data.

## Prerequisites

You need a Duo account on an edition that includes the Admin API, and a Duo administrator with the **Owner** role to create the Admin API application.

## Adding a data source

1.  In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section.
2.  Click **\+ New source** and click **Link** next to this source.
3.  Enter your credentials (see [Configuration](#configuration) below) and click **Next**.
4.  Select the tables you want to sync, choose a sync method and frequency, then click **Import**.

Once the syncs are complete, you can start querying this data in PostHog.

When linking Cisco Duo, you'll need credentials from a Duo **Admin API** application:

1.  In the [Duo Admin Panel](https://admin.duosecurity.com/), go to **Applications** and click **Protect an Application**.
2.  Search for **Admin API** and click **Protect**.
3.  Copy the **integration key**, **secret key**, and **API hostname** (e.g. `api-XXXXXXXX.duosecurity.com`) into PostHog.

Grant the application the permissions matching the tables you want to sync:

-   **Grant read log** – authentication, administrator, telephony, and activity logs
-   **Grant read resource** – users, groups, phones
-   **Grant administrators** – admins
-   **Grant applications** – integrations

## Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

-   **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
-   **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured.
-   **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
-   **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See [sync methods](/docs/cdp/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them.

The log tables sync incrementally using Duo's time-based filters. Administrator log events have no unique id, so that table is append-only. The resource tables (users, groups, phones, admins, integrations) are full refresh only.

## Configuration

| Option | Type | Required |
| --- | --- | --- |
| API hostname | text | Yes |
| Integration key | text | Yes |
| Secret key | password | Yes |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| authentication_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | timestamp | — |
| administrator_logs | Administrator log events have no unique id, so this table is append-only | Append only, Full refresh | timestamp | — |
| telephony_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | ts | — |
| activity_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | ts | — |
| users | Users enrolled in Duo, with their status, contact details, associated phones, and group memberships. | Full refresh | — | — |
| groups | Duo groups used to organize users and scope policies. | Full refresh | — | — |
| phones | Phones and tablets registered with Duo, including platform, capabilities, and attached users. | Full refresh | — | — |
| admins | Administrators of the Duo account, with their role and status. | Full refresh | — | — |
| integrations | Applications (integrations) protected by Duo, one per integration key. | Full refresh | — | — |

## Troubleshooting

-   If you see an authentication error, the integration key, secret key, or API hostname is wrong, or the keys were revoked. Duo also rejects requests from servers with significant clock skew.
-   If you see a permissions error, your Admin API application is missing the permission needed for that table. Grant the matching permission (read log, read resource, administrators, or applications) in the Duo Admin Panel, then try again.
-   Duo retains logs for a limited period (around 180 days depending on edition), so the first sync of a log table only reaches back that far.

If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.

### Was this page useful?

HelpfulCould be better