TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: API Log Source
ENVIRONMENT: Cisco Umbrella
SUMMARY: Configuration Guide for Cisco Umbrella Log Ingestion
Vendor Information
|
Vendor |
Cisco |
|---|---|
|
Supported Model Name/Number |
Cisco Umbrella |
|
Supported License Version(s) |
Advanced Security |
|
Collection Method |
REST API |
|
Query Syntax: event.provider |
Cisco Umbrella |
|
Additional Information |
The Cisco Umbrella integration is limited to specific organizations which should match the equivalent organization due to Cisco Umbrella's API by Organization requirement. The Cisco Umbrella integration is only available in the Source Management page for specific organizations. |
Device Configuration Checklist
- Follow the directions found on Cisco's Documentation site for Umbrella to create a new API key. API key creation requires a Full Admin user for the Cisco Umbrella portal.
- The Huntress Managed SIEM integration for Cisco Umbrella requires "Read Only" permissions to the Reports scope.
- After creating the key, copy and save the API Key and Key Secret for use in the Huntress Managed SIEM integration setup.
- In the Huntress Console (from the Account-Level Dashboard), navigate to SIEM -> Source Management.
- The Cisco Umbrella integration is not available at the Account-Level as the Cisco Umbrella API's are limited to specific Cisco organizations.
- Select the "Categories" tab below the Source Management header.
- Select View Details on the Cisco Umbrella source card.
- Select the green +Add button to create a new Cisco Umbrella configuration.
- Enter the details of the configuration as needed, including the API key obtained in the first two steps.
- Select the correct Base URI for your Cisco Umbrella instance.
- Save the configuration.