Linking Cisco Duo as a source
This source is currently in alpha. The interface and available tables may change.
The Cisco Duo connector syncs your Duo Admin API data into the PostHog Data warehouse: authentication, administrator, telephony, and activity logs, plus users, groups, phones, admins, and integrations. This lets you analyze MFA success and failure rates, enrollment coverage, and unusual access patterns alongside your product data.
Prerequisites
You need a Duo account on an edition that includes the Admin API, and a Duo administrator with the Owner role to create the Admin API application.
Adding a data source
- In PostHog, go to the Sources tab of the data pipeline section.
- Click + New source and click Link next to this source.
- Enter your credentials (see Configuration below) and click Next.
- Select the tables you want to sync, choose a sync method and frequency, then click Import.
Once the syncs are complete, you can start querying this data in PostHog.
When linking Cisco Duo, you'll need credentials from a Duo Admin API application:
- In the Duo Admin Panel, go to Applications and click Protect an Application.
- Search for Admin API and click Protect.
- Copy the integration key, secret key, and API hostname (e.g.
api-XXXXXXXX.duosecurity.com) into PostHog.
Grant the application the permissions matching the tables you want to sync:
- Grant read log – authentication, administrator, telephony, and activity logs
- Grant read resource – users, groups, phones
- Grant administrators – admins
- Grant applications – integrations
Sync modes
Each table can be synced in one of several modes, depending on what the source supports:
- Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
- Incremental – only new or updated rows are synced on each run, using a cursor field (such as an
updated_attimestamp). Cheaper than a full refresh, but deletes aren't captured. - Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
- Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.
See sync methods for a full explanation of how each mode works and how to choose between them.
The log tables sync incrementally using Duo's time-based filters. Administrator log events have no unique id, so that table is append-only. The resource tables (users, groups, phones, admins, integrations) are full refresh only.
Configuration
| Option | Type | Required |
|---|---|---|
API hostname | text | Yes |
Integration key | text | Yes |
Secret key | password | Yes |
Supported tables
| Table | Description | Sync method | Incremental field | Primary key |
|---|---|---|---|---|
authentication_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | timestamp | — |
administrator_logs | Administrator log events have no unique id, so this table is append-only | Append only, Full refresh | timestamp | — |
telephony_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | ts | — |
activity_logs | Only syncs the last 180 days on initial sync | Incremental, Full refresh | ts | — |
users | Users enrolled in Duo, with their status, contact details, associated phones, and group memberships. | Full refresh | — | — |
groups | Duo groups used to organize users and scope policies. | Full refresh | — | — |
phones | Phones and tablets registered with Duo, including platform, capabilities, and attached users. | Full refresh | — | — |
admins | Administrators of the Duo account, with their role and status. | Full refresh | — | — |
integrations | Applications (integrations) protected by Duo, one per integration key. | Full refresh | — | — |
Troubleshooting
- If you see an authentication error, the integration key, secret key, or API hostname is wrong, or the keys were revoked. Duo also rejects requests from servers with significant clock skew.
- If you see a permissions error, your Admin API application is missing the permission needed for that table. Grant the matching permission (read log, read resource, administrators, or applications) in the Duo Admin Panel, then try again.
- Duo retains logs for a limited period (around 180 days depending on edition), so the first sync of a log table only reaches back that far.
If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.