# Duo Security

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fduo-security.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fduo-security.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Send your [Duo Security](https://duo.com/) authentication and administrative logs to Coralogix. Duo's `duo_log_sync` daemon polls the Admin API and streams events over TCP on your own host; a [Fluentd](https://coralogix.com/docs/integrations/files/fluentd.md) shipper picks them up from that port and forwards them to Coralogix.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* A Duo Security [account](https://signup.duo.com/) with administrator access.
* A host that can reach the Duo Admin API and run Python 3, an EC2 instance, VM, or equivalent.
* A Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md).

## Create the Admin API application [​](#create-the-admin-api-application- "Direct link to create-the-admin-api-application-")

The Admin API application is what `duo_log_sync` authenticates against. Creating it yields the three credentials the configuration file needs.

1

<!-- -->

.

Sign in to the Duo admin portal

Open the [Duo admin portal](https://admin.duosecurity.com), where your authentication and administrative logs are stored.

2

<!-- -->

.

Protect the Admin API application

Select **Applications**, then **Protect an Application**, then find **Admin API** in the list and select **Protect**.

[![Duo Protect an Application page with the Admin API row highlighted](/docs/assets/images/1-2-1024x400-7fc4c7829da150997a2bfdb2f2cb18ee.webp)](https://coralogix.com/docs/assets/images/1-2-1024x400-7fc4c7829da150997a2bfdb2f2cb18ee.webp)

Shows the application catalog with the Admin API entry that grants log access.

3

<!-- -->

.

Copy the credentials

From the application's **Details** section, copy the **Integration key**, **Secret key**, and **API hostname**. These become `ikey`, `skey`, and `host` in the configuration file.

[![Duo Admin API application details showing the Integration key, Secret key, and API hostname fields](/docs/assets/images/2-2-1024x509-06395bd4d94d5b38a6cf51d28029b8d3.webp)](https://coralogix.com/docs/assets/images/2-2-1024x509-06395bd4d94d5b38a6cf51d28029b8d3.webp)

Shows the three credentials that authenticate the log sync daemon.

Note

Duo reveals the secret key only on request and advises against storing it anywhere it can be read back. Treat it like any other credential.

## Set up the log sync daemon [​](#set-up-the-log-sync-daemon- "Direct link to set-up-the-log-sync-daemon-")

Duo documents the daemon in full in its [`duo_log_sync` README](https://github.com/duosecurity/duo_log_sync/blob/master/README.md).

1

<!-- -->

.

Install Python 3

Install [Python 3](https://python.org/downloads/) on the host if it isn't already present.

2

<!-- -->

.

Clone the repository

Clone the [`duo_log_sync` repository](https://github.com/duosecurity/duo_log_sync).

3

<!-- -->

.

Create a directory for the log files

Create `c:\temp` on Windows. Linux hosts already have `/tmp`.

4

<!-- -->

.

Create the configuration file

Create `config.yml` inside the `duologsync` directory and populate it with the `skey`, `ikey`, and `host` values from the Admin API application. On Windows, escape the directory references and give full paths.

```
duoclient:

  skey: "ENTER-SECRET-KEY-HERE"

  ikey: "ENTER-INTEGRATION-KEY-HERE"

  host: "ENTER-API-HOSTNAME-HERE"



logs:

  logDir: "/tmp"

  endpoints:

    enabled: ["auth", "telephony", "adminaction"]

  polling:

    duration: 5

    daysinpast: 1

  checkpointDir: "/tmp"



transport:

  protocol: "TCP"

  host: "localhost"

  port: 8877

  certFileDir: "/tmp"

  certFileName: "selfsigned.cert"



recoverFromCheckpoint:

  enabled: False
```

5

<!-- -->

.

Add a certificate

[Create a self-signed certificate](https://devopscube.com/create-self-signed-certificates-openssl/) and place it in the `tmp` directory, matching `certFileDir` and `certFileName`.

6

<!-- -->

.

Install the daemon

From inside the `duo_log_sync` directory, run the installer:

```
python3 setup.py install
```

7

<!-- -->

.

Ship the traffic to Coralogix

With the daemon running, deploy the [Fluentd log shipper](https://coralogix.com/docs/integrations/files/fluentd.md) to read from port `8877` and forward the events to Coralogix.

## Related resources[​](#related-resources "Direct link to Related resources")

[Fluentd log shipper](https://coralogix.com/docs/integrations/files/fluentd.md)[Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md)[duo\_log\_sync daemon on GitHub](https://github.com/duosecurity/duo_log_sync/)