Duo_Security#
README
CortexResponder_DuoUserAccount#
Rep. for Cortex Responder (TheHive project - https://github.com/TheHive-Project/CortexDocs) to Lock/Unlock User Accounts in the Duo Admin Portal (Cisco Security)
There are two Responder available in order to change the status of a User in Duo Security via the AdminAPI (https://duo.com/docs/adminapi)
DuoLockUserAccount -> changes the "status" to “disabled” - The user will not be able to log in.
DuoUnlockUserAccount -> changes the "status" to “active” - The user must complete secondary authentication.
The Responder is looking for a "username" as input and queries the Duo Admin API, to receive the associated UserID. The UserID is used to change the "status" of the particular user.
How to install:#
- copy the folders "DuoLockUserAccount" & "DuoUnlockUserAccount" into your Cortex responders path
- install necessary python modules from the requirements.txt (pip install -r requirements.txt)
- restart Cortex to initialize the new Responder "systemctl restart cortex"
- add the ResponderConfig
- enable the Responder Actions
Add Observable type in TheHive**#
- per default TheHive has no "username" Observable type, so we have to add this in the Admin settings
Run the Responder action in TheHive#
If you have add an observable, you can now take action and lock/unlock the User in Duo Security
* 
DuoUnlockUserAccount#
Author: Sven Kutzer / Gyorgy Acs, @oscd_initiative
License: AGPL-V3
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: N/A
Description#
Unlock User Account in Duo Security via AdminAPI (The user must complete secondary authentication)
Configuration#
| API_hostname | Duo Admin API hostname, api-XXXXXXXX.duosecurity.com |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| Integration_Key | Integration Key |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| Secret_Key | Secret Key |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
DuoLockUserAccount#
Author: Sven Kutzer / Gyorgy Acs, @oscd_initiative
License: AGPL-V3
Version: 1.0
Supported data types:
- thehive:case_artifact
Registration required: N/A
Subscription required: N/A
Free subscription: N/A
Third party service: N/A
Description#
Lock User Account in Duo Security via AdminAPI (The user will not be able to log in)
Configuration#
| API_hostname | Duo Admin API hostname, api-XXXXXXXX.duosecurity.com |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| Integration_Key | Integration Key |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| Secret_Key | Secret Key |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |