Skip navigation

Duo Identity Security with Cisco Identity Intelligence

Last updated:

Duo Identity Security provides you with insights, signals, and remediation features across your multi-vendor identity environment.

Overview

Duo Identity Security combines Duo’s strong attack mitigation and remediation capabilities with cross-vendor identity insights powered by Cisco Identity Intelligence.

Cisco Identity Intelligence

Cisco Identity Intelligence (CII) is a multi-sourced, vendor-agnostic solution that works across your existing identity stack and brings together authentication and access insights, enabling you to proactively address vulnerabilities and risks in your multi-vendor identity environment.

Duo Premier and Duo Advantage editions include all Cisco Identity Intelligence features and capabilities.

Learn more about Cisco Identity Intelligence.

Requirements

To provision Cisco Identity Intelligence, you need:

  • A Duo Premier or Duo Advantage plan.
  • A Duo administrator with the Owner or Administrator role.
  • If you opt to use end-user role groups to manage Identity Intelligence console access, then everyone in your organization whom you want to be able to access the Cisco Identity Intelligence dashboard via Duo Single Sign-On should exist as an end-user in your Duo account or your SAML or Active Directory external authentication source, if you use them.
Duo User Data Requirement

If you sync users into Duo from Active Directory or Microsoft Entra ID, Cisco Identity Intelligence uses the source directory's unique identifiers to associate Duo identities with matching identities in other vendors.

If you do not sync users into Duo from Active Directory or Microsoft Entra ID, you must provide an email address in the username or email field for your Duo users in order for Cisco Identity Intelligence to map Duo user identities to corresponding identities in other data integrations. The email address used in Duo must match an email address in another integrated platform (e.g., Okta, Google Workspace, AWS).

Provision Your Cisco Identity Intelligence Tenant

Most customers have Cisco Identity Intelligence provisioned automatically.

If you don't see Identity Intelligence → Provision in the Duo Admin Panel navigation, then we've already provisioned your CII tenant with end-user SSO access. Skip to the next section.

  1. Log in to the Duo Admin Panel as an administrator with the Owner or Administrator admin role.

  2. Navigate to Identity Intelligence.

  3. Review the information on the "Cisco Identity Intelligence" page. Click the Connect to Cisco Identity Intelligence button to continue.

    Connect Cisco Identity Intelligence

  4. Duo automatically provisions your Duo integration with Identity Intelligence to enable your new Identity Intelligence tools to consume and analyze Duo user and authentication data. When initially connected, only the end-user SSO integration is set up by default.

Configure CII End-User Access

Verify the end-user access and group mappings for the new CII SSO application. The Duo end users you add to Identity Intelligence SSO role groups may access the CII console without having a Duo administrator account.

  1. Navigate to Identity Intelligence in the Duo Admin Panel and click the "SSO Access" tab.

  2. Click the Edit SSO button in the "End-User Access via Duo SSO" section to view the access groups for the CII SSO application.

    The CII provisioning process creates three groups in Duo for mapping CII role access: CII Admins, CII Help Desk, and CII Read-Only. For new tenants, Duo automatically adds the account owner to the CII Admins group.

    You should see that the "User access" setting for your autogenerated Cisco Identity Intelligence SSO application defaults to Enable only for permitted groups with the three CII role groups automatically selected. If these groups do not exist, you may create them manually. You may also add any Duo groups you already created that contain your CII administrators.

    Cisco Identity Intelligence Duo SSO User Access Restricted to Permitted Group

    Learn more about user access to applications.

  3. Scroll down to the "Role-based Access" section of the CII SSO application page. You should see default mappings in place as follows:

    CII role mapping Duo groups
    CII Admins CII Admins
    CII Help Desk CII Help Desk
    CII Read-Only CII Read-Only

    If you have other Duo groups containing your CII console access users, you can add them to the default CII role mappings with the drop-down selector.

    Cisco Identity Intelligence Service Provider Group Mappings

    If you do not plan to use one of the CII roles, you may remove it. Use the Add button to restore a CII role you've deleted. You may not add additional roles.

  4. If you made any changes to user access or to the group mappings, scroll down and click Save.

  5. Navigate to Users → Groups and populate the three CII groups with the Duo users who should have access to the CII dashboard by clicking each one's name and then clicking Add users to group.

    While you can't add users synced from external directories as members of the CII default groups, you can add groups managed by directory sync to the role mappings as described in the previous steps.

    Cisco Identity Intelligence Duo Groups

    See the Using Groups documentation for more detailed group management instructions.

Enable Duo Administrator SSO Access

Administrator SSO provides a streamlined experience for customers whose Duo administrators should also be CII administrators. You can enable direct administrator SSO access to Cisco Identity Intelligence so that Duo administrators can log in to CII with their existing Duo administrator account, without needing a separate Duo end-user account.

End-user SSO access remains available if you need fine-grained access control for CII. The end-user SSO integration lets you grant CII access to non-Duo administrators (such as security teams) and maintain other role-based access requirements.

  1. Navigate to Identity Intelligence and click the "SSO Access" tab, then scroll to the "Duo Administrator SSO" section.

    Cisco Identity Intelligence Duo SSO Configuration

  2. Click the Enable Duo Administrator SSO Access button. Duo updates your existing configuration to add an administrator SSO connection, and all administrators with the following administrator roles receive full CII administrator access:

    • Owner
    • Administrator
    • Security Analyst

    Administrators in these roles can cross-launch directly from the Duo Admin Panel into CII.

    Cisco Identity Intelligence Duo Administrator SSO Configuration

To disable administrator SSO access, return to the "Duo Administrator SSO" section and click the Disable Duo Administrator SSO Access button.

Next Steps After Configuration

You can now use your Identity Intelligence tenant. Navigate to Identity Intelligence in the Admin Panel to view the "Identity Insights" tab, then click Launch Identity Intelligence in the top right. This opens the Identity Intelligence dashboard from the Duo Admin Panel. If you enabled SSO access for Duo administrators, then Duo administrators logged into the Admin Panel with the Owner, Administrator, or Security Analyst role can access the Identity Intelligence dashboard from this link.

If you opted for Duo SSO access to CII for end users, make sure that any Duo administrators accessing Identity Intelligence also exist as end-users in Duo who are members of a group granted access to the CII SSO application. Active Duo users in the permitted groups whose effective policy requires MFA can sign in to Cisco Identity Intelligence via Duo SSO. Active Duo users whose effective policy requires MFA who are not members of one of the CII permitted groups will receive an access error from Duo SSO. Review the warnings about user access.

If you use an external identity source for SSO, also ensure the CII dashboard user exists there for primary authentication.

Duo automatically begins ingesting and analyzing your data. Depending on how many identities exist in your environment, it can take a few days for all the data to fully synchronize in the Cisco Identity Intelligence tenant.

Create Additional Integrations

Set up additional available integrations to maximize the cross-vendor visibility that Cisco Identity Intelligence provides and to ensure protection of your full identity ecosystem.

Navigate to Identity Intelligence and click the "Integrations" tab to view the status of your connected CII integrations in the Duo Admin Panel. Click Connect integrations or View all integrations to launch the relevant page for that action in the CII console.

Cisco Identity Intelligence Integration Status

Allow Write from CII to Duo

You may wish to permit CII to write information back to Duo, for example, to take remediation actions like disabling a compromised user or removing a suspicious phone. To enable this access:

  1. Navigate to Identity Intelligence and click the "Settings" tab.

  2. Toggle on the Grant write resource option and look for confirmation that the setting has changed.

    Cisco Identity Intelligence Write Setting

Identity Insights

The "Identity Insights" page provides a high-level summary of your identity security environment with data provided by Cisco Identity Intelligence. Duo administrators with the Owner, Administrator, or Security Analyst roles can view the "Identity Insights" page.

Navigate to Identity Intelligence to view the "Identity Insights" tab and review your organization's current top risks. You can also access Cisco Identity Intelligence directly from this page by clicking Launch Identity Intelligence in the top right.

CII Identity Security Insights Page

Trust Levels in the Admin Panel

After provisioning, the Duo Admin Panel displays Cisco Identity Intelligence trust levels on the "Users" list page and individual user detail pages.

Users List

The "Users" page displays a "CII Trust Level" column. You can sort by trust level or use the single-click filter at the top of the page to show only untrusted users.

List of Users

User Detail Page

A user's details page shows their CII trust level information. Duo administrators who are members of the appropriate Cisco Identity Intelligence SSO RBAC group also see a View User in Identity Intelligence link, which launches the CII "User360" page for the selected user in a new tab.

CII Trust Level Information in User Details

Trust Level Values

Trust Level Meaning
Trusted Normal identity behavior; low risk.
Favorable Mostly positive signals with minor risk indicators.
Neutral Baseline trust level. Insufficient data to assess trust in either direction.
Questionable Some risk signals detected. Review is recommended.
Untrusted Significant risk signals detected. Action is recommended.
Unknown Not yet calculated (insufficient data, or the integration is not yet fully active).

For more information about CII trust levels, refer to the User Trust Level documentation.

Visibility and Cross-Launch Privileges

Any Duo administrator role with access to the "Users" page and user detail pages can view trust levels and associated tooltips. Only administrators who are members of the appropriate CII RBAC group see the link to cross-launch the related page in Cisco Identity Intelligence.

Integrations

Cisco Identity Intelligence can integrate with a number of vendors for data ingestion, ticketing, notifications, and SIEM usage.

You can read more about the integrations and find configuration instructions by following the links below.

Cisco Identity Intelligence can ingest data from the following sources:

Additionally, integrations are available for notifications, ticketing, and SIEMs:

Explore all available CII integrations.

Troubleshooting

Need some help? Take a look at our Identity Intelligence Knowledge Base articles or Community discussions. For further assistance, contact Support.