QRadar - Cisco DUO protocol workflow

[davek01]

Hi,
I've a Cisco DUO log source that use protocol type Universal Cloud REST API with a protocol workflow as explained here in this link: https://www.ibm.com/docs/en/qradar-on-cloud?topic=options-cisco-duo-protocol-workflow

In this link there is an xml workflow and I would like to know if on this xml there is some kind of filter on DUO logs, or if it collects every Authentication Logs. Cause I'm noticing that probably some authentication logs are missing.

Thanks

[charlieqma]

It does collect Authentication logs but doesn't use the optional event_types filter in the XML workflow. It will collect the last 30 days of data initially and that's the only filter used in the workflow API query.