Skip to main content

Cisco Umbrella

Visualize Cisco Umbrella networks, domains, destinations, users, and discovered applications in the JupiterOne graph. Use this integration to also map Cisco Umbrella users to employees in your JupiterOne account and to monitor changes to Cisco Umbrella entities using JupiterOne alerts.

Installation​

info

Cisco Umbrella uses OAuth 2.0 client credentials (API Key and Key Secret) to authenticate API requests. You must have an Umbrella user account with the Full Admin role to create the API key. You must also have permission in JupiterOne to install new integrations.

Configuration in Cisco Umbrella​

  1. Sign in to Cisco Umbrella and navigate to Admin > API Keys. In a Multi-org, MSP, or MSSP console, go to Console Settings > API Keys instead.
  2. Click API Keys, then click Add.
  3. Enter a name for the key, and an optional description.
  4. Grant the following scopes, selecting Read-Only for each. Expand a scope to view its categories, then check each category to grant access:
    • Admin — Roles, Users
    • Deployments — Internal Domains, Internal Networks, Network Devices, Policies, Sites, Network Tunnels, Virtual Appliances
    • Policies — Destination Lists, Destinations
    • Reports — App Discovery
  5. Set an Expiry Date for the key, or choose for it to never expire. Optionally add network restrictions.
  6. Click Create Key, then copy and save the API Key and Key Secret. You have only one opportunity to copy the Key Secret.
  7. Click Accept And Close.
note

Network tunnel data requires a Cisco Umbrella SIG (Secure Internet Gateway) license. If the API returns 403 for network tunnels, the integration skips network tunnel ingestion and shows a warning. All other data types are still collected.

Configuration in JupiterOne​

To install the Cisco Umbrella integration in JupiterOne, navigate to the Integrations tab, select Cisco Umbrella, and click New Instance.

Creating an instance requires the following:

  • API Key — The Cisco Umbrella API key used for authentication.
  • Key Secret — The secret associated with the API key.

You can also set an optional Description and choose a Polling Interval for how often the integration runs. Leave the polling interval as DISABLED to trigger runs manually.

Click Create to save and activate the integration.

Next steps​

After creating the instance, the integration will run on the polling interval you configured and populate data in JupiterOne. See the Instance management guide for more on managing integration instances.