Cisco Umbrella Out-of-the-Box Data Collection Integration
Requirements
- A Cisco Umbrella DNS Security Essentials subscription or above
- An active Lumu Defender Subscription
Setup Cisco Umbrella
Rest API Client
This integration relies on the Cisco Umbrella Reporting REST API. The integration optimizes as it best how Cisco Umbrella REST API is used to collect data according to Cisco rate limits. For detailed information of the rate limits enforced by the REST API, check the Cisco Umbrella REST API Rate Limits document.
To interact with any of the Umbrella APIs, create an API Key in the Cisco Umbrella portal and use the credentials to obtain an access token for making requests. To do so, follow the steps bellow:
1. Login into Umbrella Console.
2. Navigate to Admin > API Keys.
3. Click on Add. Fill in the required data: API Key name and select Key Scope. For the integration to work with the least privileges, we recommend the scope of the following image.
4. Copy the API Key and Key Secret, these are required to setup the integration. Once you click on ACCEPT AND CLOSE, you will not be able to see the Key Secret.
Add Integration
1. Log in to you Lumu account through the Lumu Portal and navigate to the integrations screen.
2. Locate the Cisco Umbrella integration in the available apps area and click to add, then click to view details.
3. Familiarize yourself with the integration details available in the app description and click the button below to activate the integration.
4. To activate integration, add a Name and select the Label. It is always recommended to assign a label to organize and categorize the traffic of your organization. Click Next.
5. Fill in the required information, the API Key and the API Secret with the data collected before. Click Next.
The integration is now created and active. Now, the Lumu Portal will display the details of the created integration: