template_config.yml

# IMPORTANT!: Use single quotes (''), NOT double quotes ("")!
# All fields marked 'REQUIRED' must have a value otherwise the config will be
# considered invalid. If something is not marked required, you may remove that
# field from the config if you are fine with the default value.

# Version of the config file. Do not change! Automatically updated for each
# config file change
version: '1.0.0'

# Fields for changing the functionality of DuoLogSync (DLS)
# The fields for dls_settings, including dls_setting itself are not required.
# Default values may be given for all the fields if you choose not to include
# them.
#dls_settings:
    
  # File where DLS program messages / system messages will be written
  # This is only for monitoring/debugging purpose and wont have actual logs written to this file
  #log_filepath: '/tmp/duologsync.log'

  # How Duo logs should be formatted before being sent to a server/siem. Valid options are CEF, JSON
  # If this section is left commented, default will be JSON
  #log_format: 'JSON'

  # Setting related to API calls for Duo logs
  #api:

    # Days in the past from which record retrieval should begin.
    # Maximum logs that can be fetched is 180 days in past
    #offset: 180

    # Seconds to wait between API calls (for fetching Duo logs)
    # If timeout is less than 120 seconds, DLS will default it to 120 seconds to be in accordance
    # with Duo API rate limits
    #timeout: 120

  # Settings related to saving API call offset information into files for use
  # when DLS crashes so that DLS can pickup where it left off.
  # By default, entire section is commented out. DLS will still create checkpoint files in the
  # default directory which is /tmp/. Uncomment sections to give custom path
  #checkpointing:

    # Whether checkpoint files should be created to save offset information
    # about API calls. If true, the value set for directory (or the default of
    # '/tmp') is where DLS will look for checkpoint files to recover offset
    # information from.
    # Valid options are False, True
    #enabled: False

    # Directory where checkpoint files should be stored.
    #directory: '/tmp'

  # Setting related to Http Proxy to proxy Duo requests
  #proxy:

    # Host/IP for Http Proxy
    #proxy_server: 'example.proxy.com'

    # Port for Http Proxy
    #proxy_port: 8080

  # Settings related to Syslog support for JSON messages. By default, DLS JSON messages do not contain a header.
  # If your SIEM requires a Syslog header prepended to the JSON message set enabled to True.
  # DLS will default to the newer RFC5424 formatting, but also supports the older RFC3164.
  #syslog:

    # Whether a Syslog header should be prepended to each JSON log
    # Valid options are False, True
    #enabled: False

    # Syslog header format
    # Valid options are 'RFC5424', 'RFC3164'
    #format: 'RFC5424'

# List of servers and how DLS will communicate with them
servers:
  
    # Descriptive name for your server
    # REQUIRED
  - id: ''

    # Address of server to which Duo logs will be sent. If there is nothing that consumes these
    # logs, they will be lost, since writing to local storage is not supported
    # REQUIRED
    hostname: ''

    # Port of server to which logs will be sent
    # MINIMUM: 0
    # MAXIMUM: 65535
    # REQUIRED
    port:

    # Transport protocol used to communicate with the server
    # OPTIONS: TCP, TCPSSL, UDP
    # REQUIRED
    protocol: ''

    # Location of the certificate file used for encrypting communication for
    # TCPSSL. TCPSSL expects that there are .key and .cert files that store keys. For configuration,
    # give path of .cert/.pem file that has keys
    # REQUIRED only if protocol is TCPSSL
    cert_filepath: ''

# To add another server, copy and paste the above, change the server name to
# something unique and descriptive, and fill out the 3 (or 4) fields required
# like so...
# - id:
#   hostname:
#   port:
#   protocol:
#   cert_filepath:

# Account which is used to access Duo logs and tell DLS which logs to fetch.
# For MSP accounts, this should have details for the Accounts API integration.
# All child account logs will be fetched
account:
  
  # Integration key
  # REQUIRED
  ikey: ''

  # Private key, keep this safe
  # REQUIRED
  skey: ''

  # api-hostname of the server hosting this account's logs shown on duo admin panel
  # REQUIRED
  hostname: ''
    
  # Here you define to what servers the logs of certain endpoints should go.
  # This is done by creating a mapping (start with dash -) and then defining
  # what endpoints the mapping is for as a list and the what server apply to
  # those endpoints.
  # ENDPOINTS OPTIONS: adminaction, auth, telephony
  # SERVERS OPTIONS: any server id defined above in the list of servers
  # REQUIRED
  endpoint_server_mappings:
    #- endpoints: ['adminaction', 'auth']
    #  server: 'Server_2'
    #- endpoints: ['telephony']
    #  server: 'Server_1'

  # Whether this account is a Duo MSP account with child accounts. If True,
  # then all the child accounts will be accessed and logs will be pulled for
  # each child account. Not required.
  is_msp: False