Cisco Duo is a common MFA application. SEM can ingest several other vendors' logs, but apparently not Duo (Verified with support on 5/17/24). I would like to see a connector developed for these logs. Duo has the format documented at Understanding Duo Authentication Proxy SIEM Logging.
