View MFA Events in Dashboard and Tabular Forms

Security Cloud Control retrieves the Duo Admin Panel logs and displays them as MFA events in the dashboard and tabular forms on the MFA page. These MFA events are retrieved on a schedule for every 10 minutes from the Duo Admin Panel, so new MFA events that occurred within the last 10 minutes may not be immediately visible.

Dashboard View

Click the Show Charts View icon appearing at the top right corner of the screen to see the dashboard.

You will see an interactive heat map for visualizing the location of the MFA events retrieved from the Duo Admin Panel for the last three months.

  • The countries that have MFA events appear in shades of blue.

  • The legend at the bottom of the map provides a scale that indicates the correlation between the number of MFA events in a country and the shade of blue used to color the country.

  • Hover the mouse pointer on the map to see the country's name and the total number of MFA events.

  • Hover the mouse pointer on the table to see the country's location and the total number of MFA events.

Tabular View

Click the Show Tabular View icon appearing at the top right corner of the screen to see only the tabular view.

You can see the following information in the tabular view:

  • Date/Time: The date and time of the attempted authentication. Note that the time displayed is based on your specified Time Zone and Region.

  • Result: The outcome of the authentication event. For more information, see Authentication Logs.

  • Username: The username of the user attempted authentication.

  • Device Name: The name of the Duo admin panel.

  • Application: The Duo-protected application that the attempted authentication was being made to.

  • Second Factor: This shows the method used as a second factor (push, passcode, SMS, or phone call) method used for accessing the application.

  • Location: The place from where the authentication was attempted.

  • IP Address: The IP address the user connected to the application from.

  • Password Set: Whether the local admin password is set on the endpoint as detected by the Duo Device Health app. One of "Yes", "No", or "?: Unknown".

  • Encrypted: The encryption status of an Android or iOS device file system. One of: "Yes", "No", or "Unknown". Blank for non Andriod and iOS platforms.

  • Firewalled: Status of the endpoint's local firewall as detected by the Duo Device Health app. One of "Yes", "No", or "?:Unknown".

  • Security Agents: Information about security agents present on the endpoint as detected by the Duo Device Health app. Returned for Duo Beyond customers only.

  • OS Type & OS Version: The operating system and version running on the device used by the user.

Note

You can see an interactive heat map to visualize the location of the MFA events retrieved from the Duo Admin Panel for the last three months.

  • The countries that have MFA events are highlighted in blue.

  • Hover the mouse pointer on a country appearing on the world map to see its name and the total number of MFA events retrieved for the last three months.

  • Hover the mouse pointer on a country appearing in the table to see the country's location and the number of MFA events on the map.