Cisco DUO Integration Issues

InsightIDR
1

Hi all,
Starting on Friday last week, we are seeing a massive increase in logs from DUO.
The strange part is, there seems to be alot of duplicates, verified by timestamps on the DUO logs.
I have manually queried the API and cannot replicate this duplication of logs, so it seems to be related to IDR’s integration with DUO.
I have tried stopping and starting the connector, but it still occurs.
We have seen an 1900% increase in logs compared to the previous week.
Is there any known issues around this log connector?

2

Hey Ross,

Our teams did make changes to the DUO integration last week. Our engineers have an idea of what might be causing this issue, so will let you know once the fix is scheduled.

Any other questions/issues in the meantime let me know.

3

Thanks Cathal.
Is there anyway that we can be alerted about upcoming changes such as this?

4

Is there any update on this please?

5

Hi, sorry for slow reply! We have a fix identified and it’s currently in code review, so we’d expect it to be in place this week latest.

On being alerted about similar changes in the future, this is something that I’ll bring back to the team to see if we can get something in place, right now we don’t have a process around this but I think it’s a very fair ask.

Will touch base again once fix is deployed.

6

Hi Cathal,
Has a fixed been deployed yet?
We are still seeing issues

7

Hi Ross,

The fix is now complete, and being scheduled for release - engineering teams have advised it’s likely to be live within next 48 hours.

Apologies for shifting timelines on this one & appreciate the patience,

Anything I can do for you in the meantime just let me know,

Thanks,
Cathal

8

Can confirm, the issue has been fixed since yesterday in my environment.

9

Yep, same here

10

Thanks for confirming! Let me know if any more issues pop up.