Skip to main content

Agent 0.5.66 (Oct 2026)

New Features​

Duo authentication log source​

Added a Duo source that collects Duo MFA authentication logs from the Duo Admin API into your pipelines.

  • In the Duo Admin Panel, add an Admin API application with only the Grant read log permission, then copy its integration key, secret key and API hostname into the source.
  • On first start the source back-fills the last hour (lookback); after that it resumes from the last record it delivered.

Microsoft Entra ID source for user context (AZURE_AD_CONTEXT)​

A new entra_id receiver takes a periodic snapshot of the Microsoft Entra ID user directory from Microsoft Graph, with each user's manager included, so Google SecOps can enrich events with identity context under the AZURE_AD_CONTEXT log type.

  • What it collects: every user in the tenant, each sent as the raw Microsoft Graph user object with its manager embedded. This is the same data the Google SecOps native Azure AD Organizational Context feed reads.
  • Schedule: a full snapshot every 24 hours by default (minimum 15 minutes), or on demand only.
  • Groups, devices and admin roles (optional, off by default): every group, every registered device (with its owners), and every active admin role assignment (who holds which Entra role, with the role name) as their own records, tagged entraid.source = groups / devices / roles. Google SecOps' AZURE_AD_CONTEXT parser maps users only, so these are for other uses.
  • Authentication: through an Azure Auth credential. The app registration needs the Microsoft Graph application permission User.Read.All (plus Group.Read.All / Device.Read.All / RoleManagement.Read.Directory for groups / devices / roles) with admin consent.
  • Requires Praxis Collector v0.5.62 or later.

See Microsoft Entra ID for setup steps.