MELTr
Home Vendors Search Download
Login
Vendors / Cisco / Duo / Cisco Duo push success
Cisco logo

Event type

Cisco Duo push success

Duo successful push authentication; registry-backed user, access endpoint, phone and application with fresh timestamps and UUIDs.

JSON 67 fields Generator

cisco duo authentication mfa
Preview Sample View Schema
CLI Install
meltr templates install cisco

Overview

What this event covers

One successful duo_push authentication with the documented v2 default-format assessment context. Requires source-specific entities: entities/cisco/duo/authentication.yaml; example configuration: configs/cisco/duo/authentication.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

  • ›A user approves Duo Push authentication.

Security relevance

Informational

Frequency notes

Local test rate one event/second; five-event example burst. Each event is an independent transaction/session.

Resources

Docs and tools

Authentication Logs v2 response and example official

Generation

Configuration

Base frequency
3600 events/hour
Business hours
1.0x
Night hours
1.0x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

access_device
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"browser":"Chrome","browser_version":"67.0.3396.99","epkey":"EP000000000000000002","flash_version":"uninstalled","hostname":null,"ip":"192.0.2.11","is_encryption_enabled":true,"is_firewall_enabled":true,"is_password_set":true,"java_version":"uninstalled","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"os":"Mac OS X","os_version":"10.14.1","security_agents":[]}
access_device.browser
String Optional

Fixed scenario value: `"Chrome"`.

Source: Fixed scenario value: `"Chrome"`.

Example Chrome
access_device.browser_version
String Optional

Fixed scenario value: `"67.0.3396.99"`.

Source: Fixed scenario value: `"67.0.3396.99"`.

Example 67.0.3396.99
access_device.epkey
String Optional

`access['duo_key']`

Source: `access['duo_key']`

Example EP000000000000000002
access_device.flash_version
String Optional

Fixed scenario value: `"uninstalled"`.

Source: Fixed scenario value: `"uninstalled"`.

Example uninstalled
access_device.hostname
Null Optional

Fixed scenario value: `null`.

Source: Fixed scenario value: `null`.

Example null
access_device.ip
String Optional

`access['ip_address']`

Source: `access['ip_address']`

Example 192.0.2.11
access_device.is_encryption_enabled
Boolean Optional

Fixed scenario value: `true`.

Source: Fixed scenario value: `true`.

Example true
access_device.is_firewall_enabled
Boolean Optional

Fixed scenario value: `true`.

Source: Fixed scenario value: `true`.

Example true
access_device.is_password_set
Boolean Optional

Fixed scenario value: `true`.

Source: Fixed scenario value: `true`.

Example true
access_device.java_version
String Optional

Fixed scenario value: `"uninstalled"`.

Source: Fixed scenario value: `"uninstalled"`.

Example uninstalled
access_device.location
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"city":"Ann Arbor","country":"United States","state":"Michigan"}
access_device.location.city
String Optional

Fixed scenario value: `"Ann Arbor"`.

Source: Fixed scenario value: `"Ann Arbor"`.

Example Ann Arbor
access_device.location.country
String Optional

Fixed scenario value: `"United States"`.

Source: Fixed scenario value: `"United States"`.

Example United States
access_device.location.state
String Optional

Fixed scenario value: `"Michigan"`.

Source: Fixed scenario value: `"Michigan"`.

Example Michigan
access_device.os
String Optional

Fixed scenario value: `"Mac OS X"`.

Source: Fixed scenario value: `"Mac OS X"`.

Example Mac OS X
access_device.os_version
String Optional

Fixed scenario value: `"10.14.1"`.

Source: Fixed scenario value: `"10.14.1"`.

Example 10.14.1
access_device.security_agents
Array Optional

Fixed scenario value: `[]`.

Source: Fixed scenario value: `[]`.

Example []
adaptive_trust_assessments
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"more_secure_auth":{"detected_attack_detectors":["USER_MARKED_FRAUD"],"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"reason":"Low level of trust; detection of one or more known attack patterns","trust_level":"LOW"},"remember_me":{"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Known Access IP","trust_level":"NORMAL"}}
adaptive_trust_assessments.more_secure_auth
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"detected_attack_detectors":["USER_MARKED_FRAUD"],"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":true,"reason":"Low level of trust; detection of one or more known attack patterns","trust_level":"LOW"}
adaptive_trust_assessments.more_secure_auth.detected_attack_detectors
Array Optional

Fixed scenario value: `["USER_MARKED_FRAUD"]`.

Source: Fixed scenario value: `["USER_MARKED_FRAUD"]`.

Example ["USER_MARKED_FRAUD"]
adaptive_trust_assessments.more_secure_auth.features_version
String Optional

Fixed scenario value: `"3.0"`.

Source: Fixed scenario value: `"3.0"`.

Example 3.0
adaptive_trust_assessments.more_secure_auth.model_version
String Optional

Fixed scenario value: `"2022.07.19.001"`.

Source: Fixed scenario value: `"2022.07.19.001"`.

Example 2022.07.19.001
adaptive_trust_assessments.more_secure_auth.policy_enabled
Boolean Optional

Fixed scenario value: `true`.

Source: Fixed scenario value: `true`.

Example true
adaptive_trust_assessments.more_secure_auth.reason
String Optional

Fixed scenario value: `"Low level of trust; detection of one or more known attack patterns"`.

Source: Fixed scenario value: `"Low level of trust; detection of one or more known attack patterns"`.

Example Low level of trust; detection of one or more known attack patterns
adaptive_trust_assessments.more_secure_auth.trust_level
String Optional

Fixed scenario value: `"LOW"`.

Source: Fixed scenario value: `"LOW"`.

Example LOW
adaptive_trust_assessments.remember_me
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"features_version":"3.0","model_version":"2022.07.19.001","policy_enabled":false,"reason":"Known Access IP","trust_level":"NORMAL"}
adaptive_trust_assessments.remember_me.features_version
String Optional

Fixed scenario value: `"3.0"`.

Source: Fixed scenario value: `"3.0"`.

Example 3.0
adaptive_trust_assessments.remember_me.model_version
String Optional

Fixed scenario value: `"2022.07.19.001"`.

Source: Fixed scenario value: `"2022.07.19.001"`.

Example 2022.07.19.001
adaptive_trust_assessments.remember_me.policy_enabled
Boolean Optional

Fixed scenario value: `false`.

Source: Fixed scenario value: `false`.

Example false
adaptive_trust_assessments.remember_me.reason
String Optional

Fixed scenario value: `"Known Access IP"`.

Source: Fixed scenario value: `"Known Access IP"`.

Example Known Access IP
adaptive_trust_assessments.remember_me.trust_level
String Optional

Fixed scenario value: `"NORMAL"`.

Source: Fixed scenario value: `"NORMAL"`.

Example NORMAL
alias
String Optional

Fixed scenario value: `""`.

Source: Fixed scenario value: `""`.

application
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"destination_name":"Microsoft 365","key":"DIE7E7FA079778E781C9","name":"Example Corp IdP"}
application.destination_name
String Optional

`app['duo_destination']`

Source: `app['duo_destination']`

Example Microsoft 365
application.key
String Optional

`app['duo_key']`

Source: `app['duo_key']`

Example DIE7E7FA079778E781C9
application.name
String Optional

`app['duo_name']`

Source: `app['duo_name']`

Example Example Corp IdP
auth_device
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"ip":"10.20.0.11","key":"DP000000000000000002","location":{"city":"Ann Arbor","country":"United States","state":"Michigan"},"name":"Ben Rivera enrolled phone"}
auth_device.ip
String Optional

`phone['ip_address']`

Source: `phone['ip_address']`

Example 10.20.0.11
auth_device.key
String Optional

`phone['duo_key']`

Source: `phone['duo_key']`

Example DP000000000000000002
auth_device.location
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"city":"Ann Arbor","country":"United States","state":"Michigan"}
auth_device.location.city
String Optional

Fixed scenario value: `"Ann Arbor"`.

Source: Fixed scenario value: `"Ann Arbor"`.

Example Ann Arbor
auth_device.location.country
String Optional

Fixed scenario value: `"United States"`.

Source: Fixed scenario value: `"United States"`.

Example United States
auth_device.location.state
String Optional

Fixed scenario value: `"Michigan"`.

Source: Fixed scenario value: `"Michigan"`.

Example Michigan
auth_device.name
String Optional

`phone['duo_name']`

Source: `phone['duo_name']`

Example Ben Rivera enrolled phone
email
String Optional

`user['email']`

Source: `user['email']`

Example ben.rivera@example.com
event_type
String Optional

Fixed scenario value: `"authentication"`.

Source: Fixed scenario value: `"authentication"`.

Example authentication
factor
String Optional

Fixed scenario value: `"duo_push"`.

Source: Fixed scenario value: `"duo_push"`.

Example duo_push
isotimestamp
String Optional

`clock | iso8601_utc`

Source: `clock | iso8601_utc`

Example 2026-10-01T22:47:50.708880Z
ood_software
Null Optional

Fixed scenario value: `null`.

Source: Fixed scenario value: `null`.

Example null
passport_assessment
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"is_supported":false,"reason":"absent_health_report"}
passport_assessment.is_supported
Boolean Optional

Fixed scenario value: `false`.

Source: Fixed scenario value: `false`.

Example false
passport_assessment.reason
String Optional

Fixed scenario value: `"absent_health_report"`.

Source: Fixed scenario value: `"absent_health_report"`.

Example absent_health_report
reason
String Optional

Fixed scenario value: `"user_approved"`.

Source: Fixed scenario value: `"user_approved"`.

Example user_approved
result
String Optional

Fixed scenario value: `"success"`.

Source: Fixed scenario value: `"success"`.

Example success
timestamp
Integer Optional

`(clock | unix_timestamp) | int`

Source: `(clock | unix_timestamp) | int`

Example 1790894870
trusted_endpoint_status
String Optional

Fixed scenario value: `"not trusted"`.

Source: Fixed scenario value: `"not trusted"`.

Example not trusted
trusted_session_info
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"trusted_session_uuid":"7a11005a-772a-46b9-a05e-50b67def9ca3"}
trusted_session_info.trusted_session_uuid
String Optional

`fake.uuid4()`

Source: `fake.uuid4()`

Example 7a11005a-772a-46b9-a05e-50b67def9ca3
txid
String Optional

`fake.uuid4()`

Source: `fake.uuid4()`

Example 290ae120-3f23-4cdf-9b06-c18197b38bd4
user
Object Optional

Object containing the fields below.

Source: Object containing the fields below.

Example {"groups":["Example Employees","Example Headquarters"],"key":"DU4E8C7F6514E98DFA4D","name":"ben.rivera@example.com"}
user.groups
Array Optional

`duo_groups` (from user.department)

Source: `duo_groups` (from user.department)

Example ["Example Employees","Example Headquarters"]
user.key
String Optional

`duo_user_key` (generated)

Source: `duo_user_key` (generated)

Example DU4E8C7F6514E98DFA4D
user.name
String Optional

`user['email']`

Source: `user['email']`

Example ben.rivera@example.com
adaptive_trust_assessments.more_secure_auth.detected_attack_detectors[0]
String Optional

Fixed scenario value: `["USER_MARKED_FRAUD"]`. This field is the adaptive_trust_assessments.more_secure_auth.detected_attack_detectors[0] member.

Source: Fixed scenario value: `["USER_MARKED_FRAUD"]`.

Example USER_MARKED_FRAUD
user.groups[0]
String Optional

`duo_groups` (from user.department) This field is the user.groups[0] member.

Source: `duo_groups` (from user.department)

Example Example Employees
user.groups[1]
String Optional

`duo_groups` (from user.department) This field is the user.groups[1] member.

Source: `duo_groups` (from user.department)

Example Example Headquarters