Troubleshoot XDR Device Insights and DUO Integration

Available Languages

Download Options

PDF (179.1 KB)
View with Adobe Reader on a variety of devices
ePub (255.4 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (146.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:June 7, 2023

Document ID:220683

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Background Information

Introduction

This document describes the steps to configure the integration and troubleshoot XDR Device Insights and Cisco DUO integration.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics.

XDR
DUO
Basic knowledge of APIs
Postman API tool

Components Used

The information in this document is based on these software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

XDR Device Insights provides a unified view of the devices in your organization and consolidates inventories from integrated data sources.

Duo secures your workforce and takes access security beyond the corporate network perimeter to protect your data at every authentication attempt, from any device, anywhere. With Duo, you can confirm your identities in a snap, monitor the health of managed and unmanaged devices, set adaptive security policies tailored for your business, secure remote access without a device agent, and provide secure, user-friendly Single Sign-On quickly and easily.

If you want to know more about the configuration, please review the integration module details.

Troubleshoot

In order to troubleshoot common issues with the XDR and DUO integration, you can verify the connectivity and performance of the API.

Review the License Level

Check license in Duo Admin Panel
Duo Licensed for Duo Access, Duo Beyond (or any newer high-end license, MFA only or Free does not apply), as shown in the image

billing_license

No data from Duo

Verify you use Duo Health Agent data in Auth Policy, as shown in the image

duo_health

Verify you use Trusted Endpoint in Auth Policy, as shown in the image

trusted_endpoint

Connectivity test with XDR Device Insights and DUO

You can use Postman Tool to have a more visual output while you test the connectivity.

Note: Postman is not a Cisco-developed tool. If you have a question about Postman tool functionality, please contact Postman support.

Error code 40301 “Access Forbidden” means you do not have the right level of license, as shown in the image

leisanch_5-1650213797387

You can select No Auth as an authorization method

You can use this API call in order to get a list of the devices (API returns the maximum supported number of entries per page), and you can find documentation about DUO API pagination

https://<DUO admin API FQDN>/admin/v1/endpoints

In response to the first call, the total number of objects is returned (offset and limit parameters can be used to get the next pages), as shown in the image

https://<DUO admin API FQDN>/admin/v1/endpoints?limit=5&offset=5

leisanch_11-1650214902907

leisanch_15-1650215037253

Verify

Once DUO is added as a source to XDR Device Insights, you can see a successful REST API connection status.

You can see the REST API connection with a green status
Press on SYNC NOW to trigger the initial full sync, as shown in the image

leisanch_4-1650213569365

In case the issue persists with the XDR Device Insights and DUO integration,please collect HAR logs from the browser and contact TAC support in order to perform a deeper analysis.