Duo Security
BitLyft AIR® v1.22 introduces native Duo Security integration with new detection policies for MFA abuse, identity compromise, and administrative risk — plus automated Duo remediation actions and two out-of-the-box automation mappings.
5
Detection Policies
4
Response Actions
v1.22
Available Since
MFA Threat Detection — Automated
MFA is a critical security control, but it's also a target. Attackers use MFA fatigue, bypass codes, and social engineering to circumvent Duo protection. BitLyft AIR® v1.22 connects directly to Duo to monitor authentication events and act automatically when abuse is detected.
Response actions execute natively through the Duo API — suspending users, pulling authentication logs, and coordinating response across connected identity providers — all as part of a fully automated AIR® playbook.
Detection Policies
MFA Fatigue Attack
Detects repeated Duo push requests targeting a user to approve fraudulent access — a common social engineering vector.
Suspicious Authentication Location
Flags authentication attempts from unexpected or high-risk geographies not consistent with normal user behavior.
Admin Account Abuse
Identifies unusual administrative activity within the Duo administrative console.
Bypass Code Usage
Detects use of Duo bypass codes, which may indicate account compromise or policy circumvention.
Failed Authentication Spike
Surfaces high volumes of failed Duo authentication attempts targeting specific users or the environment broadly.
Automated Response Actions
Suspend Duo User
Immediately suspend a Duo user to prevent further authentication.
Send Push Notification
Trigger a contextual security alert push to the user as part of a response workflow.
Enroll User in MFA
Initiate the Duo enrollment process for accounts that are not yet MFA-protected.
Retrieve Authentication Logs
Pull recent Duo authentication logs for a user to support case investigation.
Out-of-the-Box Automation Mappings
Pre-configured workflows ready to activate on day one:
MFA Fatigue Response
Detects repeated push notifications, suspends the user in Duo, and escalates a case with full authentication context.
Compromised Identity Containment
On identity compromise indicators, suspends Duo access and coordinates downstream action in connected identity providers.
Stop MFA abuse before it becomes a breach.
See how AIR® detects Duo-based identity threats and responds automatically — no analyst required.
Schedule a Demo