Cisco OpenDNS Umbrella

[Charles Herring]

in cisco umbrella console

Log in to Umbrella for the organization and create a secret and key:

1. In Umbrella, navigate to Admin > API Keys and click Create; or
   in a management console (Multi-org, MSP, or MSSP), navigate to Settings > API Keys and click Add.
2. Select Umbrella Reporting and click Create.
3. Expand Umbrella Reporting and copy Your Key and Your Secret.
4. Click To keep it secure, … check box and then click Close.

You must acknowledge that your key and secret are only displayed once to activate the Close button.

Note: You have only one opportunity to copy your secret. Umbrella does not save it and it cannot be retrieved after its initial creation.

To generate a new key and secret, click Refresh for your current key and secret. Alternatively, delete the existing key and secret, then create a new key and secret pair.

 

CONFIGURE WITFOO PRECINCT

• Go to Admin > SOAR > Cisco Umbrella > Config
• Click the checkbox for Enable the Cisco Umbrella Integration
• Paste the API Key, API Secret, and Organization ID
• Click the disk icon (Save)
• Click Jobs and go to Artifacts from Cisco Umbrella.
• Select Triggers, expanding Manual Trigger and Interval Trigger. 
  • Toggle both to State: ENABLED
• The Interval Trigger is set to 2 hours by default, but you can update it to what best suits your organization. (Recommended: 30 minutes)
• Click the disk icon (Save)
• Within 1 hour the tool should be listed as an Artifact Source under Report->Tool Effectiveness->Artifact Source Types

 

Cisco Umbrella API Doc

[Author]

Posts