# Elastic Agent Integration - Duo **URL:** \ **Category:** Elastic Agent\ **Created:** [November 21, 2024, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895 "2024-11-21T13:28:01Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [November 21, 2024, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/1 "2024-11-21T13:28:01Z")
I'm trying to use the Duo integration in Elastic Agent. In standalone mode. The issue is that it is not using the last event published time so it is using the default value and re-pulling all Duo events. After much troubleshooting, I have determined that the variables used are not working. The basic code is this: ```auto inputs: - id: httpjson-cisco_duo name: cisco_duo revision: 1 type: httpjson use_output: default meta: package: name: cisco_duo version: 1.23.0 data_stream: namespace: default streams: - id: httpjson-cisco_duo.auth data_stream: dataset: cisco_duo.auth type: logs config_version: 2 interval: 1m request.method: GET request.url: https://api-redacted.duosecurity.com/admin/v2/logs/authentication request.transforms: - set: target: url.params.limit value: 1000 - set: target: url.params.sort value: 'ts:asc' - set: target: url.params.mintime value: '[[.cursor.last_published]]' default: >- [[div (((now (parseDuration "-2m")).Add (parseDuration "-1m")).UnixNano) 1e6]] - set: target: url.params.maxtime value: '[[div ((now (parseDuration "-2m")).UnixNano) 1e6]]' - set: target: header.Date value: '[[formatDate (now) "Mon, 02 Jan 2006 15:04:05 -0700"]]' - set: target: header.Authorization value: >- [[sprintf "Basic %s" (base64Encode (sprintf "%s:%s" "redacted" (hmac "sha1" "redacted" (formatDate (now) "Mon, 02 Jan 2006 15:04:05 -0700") "\n" "GET" "\n" .url.Host "\n" "/admin/v2/logs/authentication" "\n" .url.RawQuery)))]] response.split: target: body.response.authlogs ignore_empty_value: true cursor: last_published: value: '[[mul (toInt .last_event.timestamp) 1000]]' tags: - cisco_duo-auth publisher_pipeline.disable_host: true ``` The problem is that .cursor.last\_published is not working. I can pipe it to a field with fields: TESTLASTPUBLISHED: '[[.cursor.last\_published]]' and its value is just literally '[[.cursor.last\_published]]'. I don't understand the details of Agent enough to troubleshoot this further. Any ideas? Could I keep track of the last published date in a file instead, and reference that file in this config? If so, how? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 21, 2024, 1:38pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/2 "2024-11-21T13:38:12Z")
Can you try to update to the last version and see if this still happens? The last version of this integration is 2.2.5, there were a lot of changes on it. You could also enable the request tracer to see what timestamp is being used as the url.params.mimtime. But I'm not sure how you do it in standalone. ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [November 21, 2024, 1:58pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/3 "2024-11-21T13:58:54Z")
How does one update an integration? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 21, 2024, 3:01pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/4 "2024-11-21T15:01:06Z")
> [@mgotechlock](#): > > How does one update an integration? I think you need to upgrade the integration assets in Kibana and then get the new config in the integrations page. I do not use standalone agents, only fleet managed, so I'm not sure. ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [November 21, 2024, 6:01pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/5 "2024-11-21T18:01:23Z")
Ah, you've gotten me on a path I didn't even think about. I am using Kibana 8.12 which maxes out the Duo integration at 1.23.0. I am going to try to upgrade my Kibana to the newest version that supports new Duo integrations and see if the configs are different. Thanks ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [November 21, 2024, 6:11pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/6 "2024-11-21T18:11:16Z")
> [@mgotechlock](#): > > I am going to try to upgrade my Kibana to the newest version that supports new Duo integrations and see if the configs are different. > Thanks You will need to upgrade the entire stack. ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [November 21, 2024, 6:38pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/7 "2024-11-21T18:38:13Z")
Yeah, no problem, its just a dev server just to run Fleet to get the configs I need for standalone. Testing now. The config is very different so here's hoping... ---
**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Post date:** [November 21, 2024, 7:31pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895/8 "2024-11-21T19:31:04Z")
Tada. Newest version works great. Thanks for the help. I didn't know to look for newer versions of Agent integrations. I do now.