CortexResponder_DuoUserAccount

Rep. for Cortex Responder (TheHive project - https://github.com/TheHive-Project/CortexDocs) to Lock/Unlock User Accounts in the Duo Admin Portal (Cisco Security)

There are two Responder available in order to change the status of a User in Duo Security via the AdminAPI (https://duo.com/docs/adminapi)

DuoLockUserAccount -> changes the "status" to “disabled” - The user will not be able to log in.

DuoUnlockUserAccount -> changes the "status" to “active” - The user must complete secondary authentication.

The Responder is looking for a "username" as input and queries the Duo Admin API, to receive the associated UserID. The UserID is used to change the "status" of the particular user.

How to install:

• copy the folders "DuoLockUserAccount" & "DuoUnlockUserAccount" into your Cortex responders path
• install necessary python modules from the requirements.txt (pip install -r requirements.txt)
• restart Cortex to initialize the new Responder "systemctl restart cortex"
• add the ResponderConfig
• 
• enable the Responder Actions
• 

Add Observable type in TheHive**

• per default TheHive has no "username" Observable type, so we have to add this in the Admin settings
• 

Run the Responder action in TheHive

If you have add an observable, you can now take action and lock/unlock the User in Duo Security

•