---
url: https://docs.realmsec.info/integration/cisco_duo.md
---

# Cisco Duo Integration

![Cisco Duo Architecture](../images/cisco_duo.png)

### Send Cisco Duo Logs to Realm

This guide walks you through connecting [Cisco Duo](https://duo.com/) to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Duo Admin API to retrieve authentication, administrator, and telephony logs, then forwards them through your data pipeline to your configured destination.

## Prerequisites

* An active Cisco Duo account with the **Owner** administrator role (only Owners can create or modify an Admin API application)
* Access to the Realm Security console
* Realm IP addresses to add to the Admin API application's **Networks for API Access** list, if you restrict API access by network (contact [Realm Support](mailto:support@realmsec.info) for the current list)

## Generate API Credentials in Cisco Duo

1. Log in to the [Duo Admin Panel](https://admin.duosecurity.com) as an administrator with the **Owner** role.
2. Navigate to **Applications > Application Catalog**.
3. Locate the **Admin API** entry in the catalog and click **+ Add**.
4. Under **Permissions**, select **Grant read log**. This permission allows the application to read authentication, offline access, telephony, and administrator action logs. No other permissions are required.
5. (Optional) In **Networks for API Access**, add the Realm Cloud IP addresses to restrict which networks can use this application:
   1. Contact [Realm Support](mailto:support@realmsec.info) and request the current list of Realm Cloud egress IP addresses if you do not have them.
   2. Enter each Realm Cloud IP address in CIDR notation (e.g., `10.0.0.1/32` for a single IP).
   3. Add all provided Realm IPs to the list.

> **Note:** If you restrict **Networks for API Access**, only requests from the listed IP addresses are permitted, and requests from Realm are rejected unless its IPs are included. If you leave this field empty, the application can be accessed from any network.

6. Click **Save Changes**.
7. On the application page, copy the **Integration key**, **Secret key**, and **API hostname**.

> **Important:** Treat the secret key like a password. Copy and save it securely — do not share it or send it by email. You will enter it in the Realm Security console.

> **Note:** The API hostname is unique to your account and has the form `api-XXXXXXXX.duosecurity.com`. Use it exactly as shown in the Duo Admin Panel.

> **Note:** For more details, refer to the [Duo Admin API documentation](https://duo.com/docs/adminapi).

## Configure the Integration in Realm

1. In Realm, go to **Sources > Add Source**.
2. Select the `Cisco Duo` source, then enter a name for the source (e.g. `Cisco Duo`).
3. Click **Next**.
4. Enter the credentials copied from Duo:
   > **Integration Key:** `<your Duo integration key>`\
   > **Secret Key:** `<your Duo secret key>`\
   > **API Hostname:** `<your Duo API hostname>`
5. Click **Save**.
6. Select the desired destination for this data and click **Save**.

Once saved, the Realm poller will begin retrieving Cisco Duo logs from the Admin API at regular intervals. The data is converted to JSON and forwarded through your data pipeline to your configured destination (e.g., SIEM).