Splunk® SOAR (Cloud)

Administer Splunk SOAR (Cloud)

Acrobat logo Download manual as PDF

The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
Acrobat logo Download topic as PDF

Secure using two factor authentication

This feature is deprecated.
The Duo two factor authentication feature is deprecated as of version 5.5.0. Although this feature continues to function, it might be removed in a future version.

In the version 5.5.0 Release Notes, see Deprecated features.

Duo is integrated with to enable two factor authentication. When enabled, two factor authentication applies to all local users. sets each user's email address as the Duo username. If an email address is not available, then the username is used.

Perform the following steps to enable two factor authentication in :

  1. Create a web SDK application in the Duo administrative interface. Refer to your Duo documentation for more information.
  2. When the web SDK application integration is ready, record the following information to provide to :
    • Integration key
    • Secret key
    • API hostname
  3. In , from the Home menu, select Administration.
  4. Select User Management > Two Factor.
  5. Check the Enable Duo Two Factor Authentication checkbox.
  6. Provide the information you collected in the Integration Key, Secret Key, and API Hostname fields.
  7. Click Test Duo Connectivity to verify the keys and hostname are correct.
  8. Click Save Changes.

Disable two factor authentication for the default admin account as a failsafe mechanism so there is at least one account that can log in to administer Duo settings if the integration breaks.

With two factor authentication enabled, two new fields appear in the Edit User page:

  • Two Factor Authentication. Set this field to Duo to enable two factor authentication. Select None to disable two factor authentication.
  • Duo Username. Use this field to make sure the and Duo usernames match. For example, a user's username is jsmith but his Duo username is jsmith@splunk.com. In this case, set the Duo username to jsmith@splunk.com so the correct Duo user is used when logging in to .
Last modified on 29 November, 2023
Configure single sign-on authentication for
Configure role based access control inside Splunk apps

This documentation applies to the following versions of Splunk® SOAR (Cloud): current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters