Log Formats and Versioning

Login

Cisco Umbrella DNS User Guide

Cisco Umbrella DNS User Guide
- Welcome to Cisco Umbrella
  - Find Your Organization ID
    - Prerequisites
    - Procedure
  - Determine Your Current Package
    - Prerequisites
    - Procedure
  - View Cloud Security Service Status
    - Cloud Security Platforms
      - Service Status Types
      - Cisco Umbrella
      - Cisco Secure Connect
      - Cisco Cloudlock
    - Scheduled Maintenance
    - Past Incidents
  - Contact Cisco Umbrella Support
    - Before You Contact Support
    - Prerequisites to Open a Case
    - Procedure
  - Password Policy FAQs
- Get Started
  - Set Up DNS Layer Security
    - Step 1: Add a Network Identity
    - Step 2: Configure Your DNS Settings
    - Step 3: Set Up Clients, Network Devices, and Virtual Appliances (Optional)
      - Set Up an Umbrella Roaming Client or AnyConnect Roaming Security Module
      - Set Up an Umbrella Mobile Client App
      - Set Up a Network Device
      - Set Up a Chromebook Client
      - Set Up a Virtual Appliance
    - Step 4: Add a DNS Policy
    - Step 5: Test Your DNS Policies
  - Point Your DNS to Cisco Umbrella
    - Anycast IP Addresses
      - Step 1 – Find out where your public DNS server addresses are configured
      - Step 2 – Log into the server or router where DNS is configured
      - Step 3 – Change your DNS server addresses
      - Step 4 – Test Your New DNS Settings
  - Get Started FAQ
    - Networks and Identities
    - Roaming Client
    - Umbrella Settings
    - Cisco Certificate
    - Limitations and Ranges
      - Umbrella DNS Security - Monthly DNS Query Average
      - Overages
- Limitations and Range Limits
- Data Retention
- Monthly DNS Query Average
- Manage Identities
  - Add a Network Identity
    - Prerequisites
    - Procedure
      - Step 1 – Select the Appropriate Network
      - Step 2 – Set up the Network Identity
        
        Dynamic IP Address—IPv4 Only
      - Step 3 – Change the DNS Settings on Your Relevant Network Device
      - Step 4 – Test Your Network
  - Delete a Network Identity
    - Prerequisites
    - Procedure
  - Identity and DNS Deployment
  - Add a Network Device
    - Prerequisites
    - Procedure
      - Step 1: Create a Network Devices API Key
      - Step 2: Register a Network Device
      - Step 3: Add Network Device to a DNS Policy
      - Step 4: Test Your Network Device Integration
  - Delete a Network Device
    - Prerequisites
    - Procedure
  - Find the Total Number of Identities in Your Organization
    - Prerequisites
    - Find the Total Number of Networks
    - Find the Total Number of Roaming Clients
    - Find the Total Number of Other Identity Types
- Manage Domains
  - Add Domains
    - Prerequisites
    - Procedure
  - Wildcards and Domain Management
    - Known Limitations
- Manage Policies
  - Add a Policy
    - Prerequisites
    - Procedure
      - Step 1: Add a Policy
      - Step 2: Select Identities
      - Step 3. Determine What You Want This Policy To Do
        
        Advanced Settings
      - Step 4. Setting Your Security and Content Details
        
        Step 4a. Configure Security Settings
        
        Step 4b. Configure Content Category Settings
        
        Step 4c. Configure Application Settings
        
        Step 4d. Configure Destination Lists
        
        An IP Address or CIDR of IP Addresses (Roaming Client Only)
        
        Step 4e. Configure File Analysis
        
        Step 4f. Configure Block Pages
        
        Block Page Settings
        
        Bypass Users
        
        Bypass Codes
      - Step 5: Set Policy Details
  - Policy Settings
    - Umbrella DNS Policy Settings
  - Best Practices for Policy Creation
  - Policy Precedence
    - Match an Identity and Destination to a Policy
      - Identities without Active Directory Integration
      - Identities with Active Directory Integration
      - DNS Policy without Virtual Appliance
      - DNS Policy with Virtual Appliance
    - Configure Policy Order
    - Identity Combinations
    - Policies and Block Page Bypass Settings
  - Umbrella Policy Tester
    - Prerequisites
    - Procedure
  - Enable SafeSearch
    - Prerequisites
    - Procedure
    - Confirm that SafeSearch is Enabled
      - Test for Google, Youtube, and Bing
      - Test Through a Lookup From the Command Line
- Manage Security Settings
  - Add a Security Setting
    - Prerequisites
    - Procedure
  - Security Categories
  - Dispute a Security Categorization
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - Third-party Security Integrations
  - Set Up Custom Integrations
    - Prerequisites
    - Additional Prerequisites for Cisco AMP Threat Grid
    - Create Customer Key
    - Enable Third-Party Platform Integration
    - Verify Custom Integration
      - View Custom Destination List
      - View Admin Audit Log
      - List the Blocked Domains
    - Add Custom Security Setting to a Policy
    - Logging and Reports
      - View Reports
      - Access Logs in S3
  - Custom Integration Best Practices
    - Known Domains and Destination Lists
    - Benefits of Custom Destination Allow List
    - Add a Destination List
    - Delete a Domain from Custom Destination Block List
- Manage Content Categories
  - Add a Content Category Setting
    - Prerequisites
    - Procedure
  - Legacy Content Category Definitions
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Categories Definitions
  - Content Category Definitions
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Category Definitions
  - Changes to Content Categories
    - Legacy Content Category Changes
    - New Content Categories
  - Migrate Content Categories
    - Prerequisites
    - Procedure
  - Dispute a Content Category Classification
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - View Content Categories in Reports
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
    - View Content Categories in Top Identities Report
- Manage Application Settings
  - Add an Application Setting
    - Prerequisites
    - Procedure
  - Delete an Application Setting
    - Prerequisites
    - Procedure
  - Application Categories
    - Category Descriptions
- Manage Destination Lists
  - Add a Destination List
    - Prerequisites
    - Procedure
  - Edit a Destination List
    - Prerequisites
    - Procedure
  - Add Destinations in Bulk
    - Prerequisites
    - Procedure
  - Download Destinations to a CSV File
    - Prerequisites
    - Procedure
  - Control Access to Custom URLs
    - Prerequisites
      - Enable the Intelligent Proxy
      - Install a Root Certificate
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Top-Level Domains to Destination Lists
    - Prerequisites
    - Procedure
  - Add Punycode Domain Name to Destination List
    - What is Punycode?
    - Examples of Unicode and Punycode Encoded Strings
  - Test Your Destinations
  - Search for a Destination List
  - Troubleshoot Destination Lists
    - Destination Lists and Common Error Conditions
- Manage the Intelligent Proxy
  - How the Intelligent Proxy Works
    - Advantages of Using the Intelligent Proxy
    - Sites That are Not Proxied by the Intelligent Proxy
    - Best Practices
    - SSL Decryption Requirements and Implementation
    - Selective Decryption Lists
  - Enable the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test Selective Decryption
    - Prerequisites
    - Procedure
  - Review the Intelligent Proxy Through Reports
    - Prerequisites
    - Procedure
  - Enable SSL Decryption
    - Root Certificate Requirement
    - Prerequisites
    - Procedure
- Manage File Inspection
  - How File Inspection Works
    - How is a File Inspected?
      - Cisco Advanced Malware Protection (AMP) Scanning
      - Antivirus Scanning
  - Enable File Inspection
    - Prerequisites
    - Procedure
  - Test File Inspection
    - Prerequisites
    - Procedure
  - Troubleshooting
    - Contact Support
  - File Inspection Reports
    - Security Activity Report for File Inspection
    - Security Activity Report for Activity Search
- Manage the Cisco Umbrella Root Certificate
  - Install the Cisco Umbrella Root Certificate
    - Prerequisites
    - Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
      - Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy
      - Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console
    - Manually Install the Cisco Umbrella Root Certificate (Single Computer)
      - Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows
      - Install the Cisco Umbrella Root Certificate in Firefox on Windows
      - Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X
      - Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line
      - Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux
  - View Cisco Trusted Root Store
    - Prerequisites
    - Before You Begin
    - Extract the Certificates
      - Step 1: Extract the Signing Certificate
      - Step 2: Extract Certificate Bundle as Message
      - Step 3: Extract PEM-Formatted Certificates From Bundle
      - Step 4: Generate Individual Certificate Files
        
        Linux
        
        macOS
    - View an Individual Certificate File
- Customize Block Pages
  - Create a Block Page
    - Prerequisites
    - Procedure
  - Create a Custom Message
    - Prerequisites
    - Procedure
  - Allow Users to Contact an Administrator
    - Prerequisites
    - Procedure
    - Link a Custom Block Page Appearance to a Policy
  - Upload a Custom Logo
    - Prerequisites
    - Procedure
  - Redirect to a Custom Block Page
    - Prerequisites
    - Procedure
  - Block Page IP Addresses
  - Set Up a Block Page Bypass User
    - Prerequisites
    - Procedure
      - Set up Block Page Bypass for an Existing User
      - Set Up Block Page Bypass for a New User
  - Create a Block Page Bypass Code
    - Prerequisites
    - Procedure
    - Delete a Block Page Bypass Code
  - Enable Block Page Bypass in a Policy
    - Prerequisites
    - Procedure
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Delete an Account
    - Prerequisites
    - Procedure
  - Change Account Settings
    - Procedure
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-Identification
    - Disable De-Identification
    - Limitations
- Manage User Roles
  - Add a New User
    - Prerequisites
    - Procedure
  - Add a Custom User Role
    - Prerequisites
    - Procedure
- Manage API Keys
  - Manage Umbrella API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Manage Umbrella Legacy API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Manage Static API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Manage KeyAdmin API Keys
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Manage Your Logs
  - Upgrade Reports
    - Prerequisites
    - Procedure
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites
      - JSON Bucket Policy
    - Enable Logging
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
      - Prerequisites
  - Enable Logging to a Cisco-Managed S3 Bucket
    - Best Practices for Rotating an S3 Bucket Key
      - About the Notifications for the IAM Key
    - Prerequisites
    - Procedure
      - Configure a Cisco-Managed S3 Bucket
      - Rotate Keys on a Cisco-Managed S3 Bucket
      - Get the S3 Bucket Data Path
    - Verify Your Access to an S3 Bucket
      - Download Files From the S3 Bucket Locally
        
        Sample Command
        
        Best Practices: Download Files From the S3 Bucket
  - Change the Location of Event Data Logs
    - Implications When You Change Data Warehouse Locations
    - Log Retention
    - Prerequisites
    - Procedure
  - Stop Logging
    - Prerequisites
    - Procedure
  - Delete Logs
    - Prerequisites
    - Procedure
  - Log Formats and Versioning
    - File Name Format
      - Subfolders
        
        Find Your Log Schema Version
        
        Log Schema Versions
        
        View Your Log Schema Version and Last Sync Time
        
        View Your Headers
        
        View Your Headers in S3 log management
        
        Log File Fields
        
        Estimate the Size of Your Logs
        
        Estimate the Size of an Exported Report
    - Admin Audit Log Formats
    - DNS Log Formats
    - Proxy Log Formats
- Manage Authentication
  - Enable Two-Step Verification
    - Prerequisites
    - Procedure
  - Disable Two-Step Verification
    - Prerequisites
    - Procedure
  - Enable Cisco Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Disable Cisco Security Cloud Sign On
    - Procedure
  - Get Started with Single Sign-On
    - Prerequisites
    - How SSO Changes Logging In
  - Enable SSO with Duo
    - Prerequisites
    - Procedure
  - Enable SSO with Okta
    - Prerequisites
    - Procedure
  - Enable SSO with PingID
    - Prerequisites
    - Procedure
  - Enable SSO with OneLogin
    - Prerequisites
    - Procedure
  - Enable SSO with Azure
    - Prerequisites
    - Procedure
  - Enable SSO with Other IDPs
  - Enable SSO (SAML) in Multi-Org Console
    - Procedure
    - FAQs
      - Other References
Identity Integrations
- Introduction
  - Configure Identity Providers or Manually Import Users and Groups
- Provision Identities from Active Directory
  - Prerequisites for AD Connectors
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Configure Authentication for AD Connectors and VAs
    - How to Set Up Your API Credentials
    - Prerequisites
  - Procedure
    - Step 1 – Create the Key Admin API Key Credentials
    - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
  - Configure Updates on AD Connectors
    - Prerequisites
    - Procedure
  - Connect Active Directory to Umbrella
    - How to Configure the Setup of the AD Connector
    - Prerequisites
    - Register a Domain Controller or Domain in the Umbrella Dashboard
      - Register a Domain Controller
      - Register a Domain
    - Specify AD Groups of Interest (Optional)
      - Rename Selective Sync File After Upgrading to AD Connector v1.14.4
      - Create AD Groups in a Selective Sync File
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Deploy LDIF Files for AD Connector
    - Best Practices for LDIF Source Deployments
    - Requirements
    - Known Limitations
    - Prerequisites
    - Procedure
      - Step 1 – Download the Cisco AD Connector
      - Step 2 – Install the Cisco AD Connector
      - Step 3 – Deploy the LDIF Source Files
    - Verify the Connector Syncs with Umbrella
    - Troubleshooting
      - Scenario 1
      - Scenario 2
      - Scenario 3
      - Scenario 4
      - Analyze Logs
  - View AD Components in Umbrella
    - Prerequisites
    - Procedure
  - Connect Multiple Active Directory Domains to Umbrella
  - Change the Connector Account Password
    - Prerequisites
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
- Provision Identities Through Manual Import
  - Prerequisites
    - CSV File Structure
    - CSV File Fields
  - Procedure
- Provision Identities from Microsoft Entra ID
  - Prerequisites
  - Limitations
  - Procedure
  - Configure Cisco User Management Connector App in Microsoft Entra ID
    - Supported Attributes for Users
    - Supported Attributes for Groups
  - Configure Guest Users
  - View Users and Groups in Umbrella
- Provision Identities from Okta
  - Prerequisites
  - Limitations
  - Supported Features
  - Import the ObjectGUID Attribute from Okta
  - Configure the Cisco User Management Connector App
  - Troubleshooting
- Active Directory Integration with the Virtual Appliances
  - Network Diagram for VA Deployments
  - Prerequisites for Integration with VAs
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Configure Active Directory User Exceptions
    - Prerequisites
    - Set Up Active Directory User Exceptions
    - Set Up Active Directory Group Exceptions
    - Set Up Active Directory IP Address Exceptions
  - Prepare Your Active Directory Environment
    - Prerequisites
    - AD Integration with Domain Controllers
      - Verify That Auditing of Logon Events is Enabled on the Domain Controllers
      - Run the Configuration Script on the Domain Controllers
        
        Register a Domain Controller in the Umbrella Dashboard
        
        Verify the Domain Controller Registration in the Umbrella Dashboard
        
        Multi-AD domain and Multi-Forest Support
      - AD Integration with a Centralized Windows Event Log Collector
        
        Step 1 – Additional Prerequisites
        
        Step 2 – Register the Windows Event Log Collector with Umbrella
        
        Step 3 – Register the AD Domains with Umbrella
  - Connect Active Directory to Umbrella VAs
    - How to Configure the Setup of the AD Connector
    - Prerequisites
    - (Optional) Specify AD Groups of Interest
      - Rename Selective Sync File After Upgrading to AD Connector v1.14.4
      - Create AD Groups in a Selective Sync File
    - Install the Connector
    - Verify That the Connector Syncs with Umbrella
  - Multiple Active Directory and Umbrella Sites
    - Prerequisites
    - Active Directory Sites and Umbrella Sites
      - Active Directory Sites and Services
      - Umbrella Sites
      - When to Use Umbrella Sites
      - Caveats
    - Use Umbrella Sites
      - Assign a Site to a Component
  - Change the Connector Account Password
    - Prerequisites
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
Reports
- Get Started with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
    - Prerequisites
    - Procedure
  - Report Retention
    - Admin Audit Log Retention
- Schedule Reports
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Unsubscribe From a Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Overview Report
  - Message Center
  - Network Request Breakdown
  - Deployment Health
  - Security Categories
  - App Discovery and Control
  - Most Security Requests
- Security Activity Report
  - View Activity and Details by Filters
  - View Activity and Details by Event Type or Security Category
    - Group Security Categories
  - View an Event's Details
  - Search for Security Activity
    - Advanced Search
- Activity Search Report
  - Prerequisites
  - View the Activity Search Report
    - Configure Columns to Display
  - View Actions
    - See Full Details
    - Filter Views
    - Investigate View
  - Save Activity Search Report Columns and Filters for Future Use
  - Schedule an Activity Search Report
- Use Search and Advanced Search
  - Search
  - Wildcards
    - Domains
    - URLs
  - Advanced Search
  - Customize and Manage Saved Searches
- App Discovery Report
  - Prerequisites
  - View the Dashboard
  - View the Highest Risk Apps
    - Prerequisites
    - Procedure
  - Review Apps in the Apps Grid
    - Prerequisites
    - Procedure
    - Configure Columns to Display
    - Change the Label of an App
  - View App Details
    - Prerequisites
    - Procedure
  - Block Apps
    - Prerequisites
    - Procedure
    - Configure Application Settings for a Policy
- Top Threats Report
  - View the Threats Report
  - View Top Threat Types in the Threat Activity Breakdown
  - View How Threats Impact Your Environment
  - Search for Threats in Activity Search
  - Threat Type Details
    - Prerequisites
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Total Requests Report
  - Prerequisites
  - View Trends in the Total Requests Report
- Activity Volume Report
  - Prerequisites
  - View Requests by Volume of Activity
  - View Activity Volume by Security Categories
    - Prevent
    - Contain
    - Integrations
  - View Activity Volume by Policy Traffic
  - View Trends
- Top Destinations Report
  - Prerequisites
  - View the Top Destinations Report
    - Report Fields
  - View Further Details
  - Destination Details
    - Prerequisites
    - View the Destination Details
    - View the Request Traffic
      - View Requests by Blocked or Allowed
      - View Requests Through Global Traffic %
      - View Details in Investigate
    - View the Access & Policy Details
    - View Recent Activity
    - View the Most Visited URL Paths
- Top Categories Report
  - Prerequisites
  - Top Categories Quick View
  - View the Top Categories Report
    - Report Fields
    - Ascending or Descending Order
  - View Category in Other Reports
  - Category Details
    - Prerequisites
    - View a Category's Details Overview
    - View a Category's Traffic
      - View the Activity Breakdown
      - View the Traffic Bandwidth
    - View a Category's Identities
    - View the Category's Top Domains
- Top Identities Report
  - Prerequisites
  - View the Top Identities Report
    - Report Fields
  - View Identity in Other Reports
  - Identity Details
    - Prerequisites
    - View an Identity Report
- Admin Audit Log Report
  - Prerequisites
  - Generate Admin Audit Log Report
  - Export Admin Audit Log to an S3 Bucket
    - Prerequisites
    - Procedure
Manage Roaming Client
- Introduction
  - How Does It Work?
  - Benefits of the Umbrella Roaming Client
  - VPN Support
  - Antivirus and Endpoint Security Software Support
  - Prerequisites
    - Operating System
      - Supported Operating Systems
      - Unsupported Operating Systems
      - Windows Operating System
    - Transport Layer Security Protocol
      - TLS 1.2 Support for Windows
      - TLS 1.2 Support for macOS
    - Network Access
      - Host Names
      - DNS
        
        Encryption (Optional)
      - External DNS Resolution
      - HTTP and HTTPS
    - Software
    - Internal Domains
- Download and Install the Roaming Client
  - Single Machine or Manual Installation
    - Step 1 – Download the Roaming Client
    - Step 2 – Extract the installer and follow the wizard.
    - Step 3 – Verify installation by checking the tray icon.
  - Distributed or Automated Installation
  - Verify Roaming Client Operation
    - Verify on the Target Computer
    - Verify in the Umbrella Dashboard
      - Admin Audit Log
      - Roaming Computers Page
- Configure Policies
  - Step 1: Create an On-Network Policy
  - Step 2: Create an Off-Network Policy
  - Step 3: Order Your Policies Correctly
- Identity Support for the Roaming Client
  - Prerequisites
  - On-Premises Identity
  - Procedure
  - Prerequisites for AD Integration
  - Configure Identities on macOS
  - LAN IP Address Reporting Only—No AD integration
  - Enhanced Roaming Client UI
  - AnyConnect Umbrella Roaming Security Module UI
  - Identity Support in DNS Policy
  - Identity Support in Umbrella Reports
    - View Traffic in Umbrella
  - What Information is Sent to Cisco Umbrella and When
    - AD Directory Structure
    - AD User ID
    - User Group
    - LAN IP Address
    - Device ID
- Status, States, and Functionality
  - Status in the Umbrella Dashboard
  - Roaming Computer Information
  - Tray Icon Status
    - Status Indicators
  - Probes
    - Encrypted Probe
    - Unencrypted Probe
    - Virtual Appliance + Protected Network Probe
  - Advanced: Network Access per Service
  - Advanced: How the Umbrella Roaming Client Changes States
- Virtual Appliances
  - Behavior
- Troubleshooting
  - Scenarios
    - Did the Umbrella Roaming Client not install?
    - Unable to Resolve Internal Resources
    - Failed Installations
    - Unregistered Umbrella Roaming Clients
    - Unprotected/Unencrypted
    - Switching States or Statuses Frequently (Flapping)
  - Logs
  - Diagnostic Tool
- Domain Management
  - Internal Domains
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DHCP/Static DNS Servers
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computers Settings
  - Prerequisites
  - Procedure
    - General Settings
    - Client Settings
    - Secure Client Settings
    - Umbrella Roaming Client Settings
  - Backoff Settings
- Encryption and Authentication
  - Concepts
  - DNSCrypt
  - DNSCrypt versus DNSSEC
  - Encryption and Authentication
  - Encrypted State
  - Unencrypted State
- Command-line and Customization for Installation
  - Prerequisites and Instructions
  - Parameters
    - Windows
      - Required Parameters
      - Optional Parameters
    - macOS
      - Optional Parameters
  - Deploy Through the Command Line
    - Windows
    - macOS
- Remote Logging and Diagnostics
  - Objective
  - Privacy
  - Logs
  - The Diagnostic Tool
- macOS Mobile Device Management
  - Prerequisites
  - Register to an Organization
  - Change Organizations
  - Add a User Identity
Umbrella Roaming Security: Cisco Secure Client
- Introduction
- Umbrella Roaming Security: Cisco Secure Client (formerly AnyConnect)
  - Quick Start Guide
  - Prerequisites
    - System Requirements
    - Transport Layer Security Protocol
      - TLS 1.2 Support for Windows
      - TLS 1.2 Support for macOS
    - Network Requirements
      - Host Names
      - DNS
        
        Encryption (Optional)
      - External DNS Resolution
      - HTTP and HTTPS
    - Internal Domains
  - Deploy Umbrella module in Cisco Secure Client
    - Manual Installation of Cisco Secure Client (Windows and macOS)
    - Mass Deployment Overview
    - Contents
    - Remote Installation
      - Profile Installation
      - Customization Options
    - Mass Deployment (Windows)
    - Contents
      - (Optional) Package Customization
        
        Add Umbrella Profile
      - Automated Installation (Windows)
        
        Install Cisco Secure Client
        
        Install the Umbrella Profile
        
        (Optional) Disable VPN Functionality (Post installation)
    - Customize Windows Installation of Cisco Secure Client
      - Procedure
        
        Deploy the Cisco Secure Client VPN Module
        
        Deploy the Cisco Secure Client Umbrella Roaming Security Module
        
        (Optional) Deploy Cisco Secure Client DART
        
        Hide Cisco Secure Client Modules from Add/Remove Programs List
      - Optional OrgInfo.json Parameter Configurations
    - Mass Deployment (macOS)
    - Contents
      - (Optional) Package Customization
        
        Add Umbrella Profile
        
        (Optional) Disable VPN Functionality
        
        Save the .dmg image
      - Automated Installation (macOS)
        
        Installation (Pre-Deployment Package)
        
        Installation (Web Deployment Package)
        
        Install Umbrella Profile
        
        (Optional) Disable VPN Functionality (Post-Installation)
        
        Allow Secure Client System Extensions
    - Customize macOS Installation of Cisco Secure Client
      - Contents
      - Procedure
      - Step 1 – Make the .dmg Package Writeable
        
        Step 2 – Generate the Module Installation Configuration File
        
        Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
        
        Step 4 – (Optional) Hide the VPN Module
        
        Step 5 – Customize the Cisco Secure Client Installation Modules
        
        Sample Customization
        
        Step 6 – Set Up the Correct Extension Permission Settings
        
        Step 7 – Install Secure Client with Selected Modules
      - Optional OrgInfo.json Parameter Configurations
    - VPN Headend Deployment
    - Secure Firewall Management Center and Secure Firewall Threat Defense
      - Prerequisites to provision the Umbrella Module
      - Procedure to enable Secure Client Umbrella Module in Management Center and Threat Defense
      - (OPTIONAL) VPN Local Authentication (Management Center 7.0 or later required)
    - Migration from Umbrella Roaming Client
    - Install the Root CA
    - Automatic Updates
    - Cloud Management
    - Contents
    - Overview
    - Deploying Cisco Secure Client
    - Profiles
    - Uploading the Orginfo.json Profile
    - Create a Deployment
    - Post Deployment
      - Additional Reference
    - Additional References
    - Remote Monitoring and Management Deployment Tutorials
  - Meraki Systems Manager (SM) Deployment
  - DNS Protection Status
    - Prerequisites
    - Procedure
    - DNS Protection Status Descriptions
  - Interpret Diagnostics
- Active Directory Policy Enforcement and Identities
  - Procedure
  - macOS User Identity
- Virtual Appliances
  - Behavior
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computer Settings
  - Procedure
  - General Settings
  - Client Settings
    - Secure Client Settings.
    - Umbrella Roaming Client Settings
  - Backoff Settings
Manage Virtual Appliance
- Introduction
  - How Umbrella Virtual Appliances Work
  - Benefits of Virtual Appliances
  - Prerequisites
    - Virtual Appliance Requirements
      - VMware Requirements
      - Microsoft Hyper-V Requirements
      - Cloud Platform Requirements
      - KVM Requirements
      - Nutanix Requirements
    - Networking Requirements
      - SSH Support Tunnel
      - Networking: Additional Considerations
      - DNSCrypt
  - Deployment Guidelines
    - Virtual Appliance Deployment Best Practices
      - Redundancy
      - Multiple DNS Egresses
      - Single DNS Egress
      - Double NAT
  - Importance of Running Two VAs
    - Benefits of Two VAs
- Deploy Virtual Appliances
  - Configure Authentication for Virtual Appliances
    - How to Set Up Your API Credentials
    - Prerequisites
    - Procedure
      - Step 1 – Create the Key Admin API Key Credentials
      - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
      - Recreate API Key Credentials for Authentication
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - 1. Download the Hyper-V Installer
      - 2. Import the Virtual Appliance
      - 3. Copy and Rename Image Files
      - 4. Select Network Adapter
      - 5. Select Hard Drive
      - 6. Power on the Virtual Machine
      - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - 1. Download OVF Template
      - 2. Deploy OVF Template
      - 3. Deploy a Second Virtual Appliance
      - 4. Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
      - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - 1. Prepare the Virtual Appliance Amazon Machine Image
      - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Prepare the Virtual Appliance Instance Template on GCP
      - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
      - 1. Download and Extract the KVM Installer
      - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
  - Deploy VAs in Alibaba Cloud
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Download and Extract the Hyper-V Installer
    - Alibaba Cloud Setup
      - Procedural Overview
      - Create an Alibaba Virtual Private Cloud (VPC)
      - Create a Bucket for the Umbrella VAs
      - Configure a ZIP Package Decompression Rule
      - Upload the Umbrella VHD Images to the OSS Bucket
    - Create a Custom Image
    - Deploy the Umbrella VAs from the Imported Custom Image
      - What to do Next
    - First-time Login to Umbrella VA
      - Related Topics
      - Dual-NIC Support on the VA
      - IP Addressing
        
        General Guidelines
        
        Support for IPv6 Addressing
      - Anycast Configuration Support
      - DNS Performance on Alibaba ECS Instances
      - Extensions on Alibaba ECS Instances
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Configure Failover to Third-Party Resolvers
  - Enable Third-Party Resolver Failover
  - Verify the Current Resolver on the Virtual Appliance
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is an Umbrella Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Umbrella Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Umbrella Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Support Tunnel From the VA
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed in Azure
  - Troubleshoot DNS Resolution in Configuration Mode
  - Troubleshoot DNS Resolution Failures Behind a Firewall
  - Troubleshoot Egress Network Connectivity From VA
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure Umbrella Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Anycast
        
        Configure Anycast over BGP on the VA
        
        Configure Load Balancing
        
        Configure Identity Association Timeouts
        
        Configure API Key Credentials for Authentication
        
        Configure the Client ID and Client Secret
Internal Networks
- Internal Networks Setup Guide
  - Set Up Internal Networks
- Provision a Subnet for Your Virtual Appliance
  - Prerequisites
  - Procedure
- Manage Sites
  - Prerequisites
  - Before You Begin
  - Procedure
- Manage Internal Networks
  - Prerequisites
  - Before You Begin
  - Procedure
  - Apply DNS Policies to Internal Network
- Assign a Policy to Your Site
Managed iOS Device
- Cisco Security Connector—Umbrella Setup Guide
  - Requirements
  - Getting Started
  - Quick Start
    - Prerequisites
    - Procedure
      - Step 1: Install the Cisco Security Connector App
      - Step 2: Add an Organization Administrator's Email Address
      - Step 3: Register Your iOS Device Through Your MDM to Umbrella
    - Verify Umbrella on Your iOS Device
    - Install Umbrella Root Certificate
- Meraki Registration
  - Prerequisites
  - Procedure
  - Verify Push of Profile Config
  - Anonymize Your Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
    - Verify Umbrella with Meraki
      - Prerequisites
      - Procedure
        
        Verify Local Operation on the iOS Device
        
        Verify Umbrella
        
        Verify Clarity
        
        Upgrade the Cisco Security Connector
        
        Uninstall the Cisco Security Connector
  - Meraki Documentation
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS device
  - Install Umbrella Root Certificate
  - MobileIron Configuration
    - Add Cisco Security Connector to MobileIron MDM
    - Configure the MobileIron Cloud
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Generic MDM System Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify That Your Device is Protected by Umbrella
  - Install Umbrella Root Certificate
- Apply Umbrella Policies to Your Mobile Device
  - Policy > Security Settings
  - Policy > Passive Reporting Mode
- Umbrella Reporting
  - Activity Search Report
  - Security Activity Report
  - App Discovery Report
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Anonymize Devices
  - Prerequisites
  - Procedure
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Prerequisites
  - Generate Diagnostics and Email the Umbrella Reports
  - Generate Diagnostics and Share the Umbrella Reports
- Push the Umbrella Certificate to Devices
  - Prerequisites
  - Procedure
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
- Configuring DNS Suffix Whitelisting
  - Prerequisites for Configuration
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Umbrella Certificate
  - Android Configuration Download
    - Procedure
      - Fail Close/Open Scenario
  - Cisco Meraki MDM
    - Add App to Cisco Meraki
    - Add Configuration for App
    - Push the App to Devices
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - MobileIron MDM
    - Configure the App
    - Push the App
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - VMware Workspace ONE
    - Prerequisites for Deployment
    - Deployment Procedure
      - Create an Always On VPN Profile
    - Add and Publish the Cisco Secure Client Application
  - Microsoft Intune MDM
    - Publish the Umbrella AnyConnect app to Managed Android Devices
    - Configure Umbrella
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Samsung Knox MDM
    - Register with the Enterprise Mobile Manager (EMM)
    - Enroll Android Devices
    - Push the App
    - Set Managed Configuration
    - Create Profile in Knox Manage
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Push the Umbrella Certificate to Devices
    - Prerequisites
    - Procedure
  - Manage Pop-Ups and App Controls
    - App Settings and First-Time Launch
      - Benefits of Enabling Always-On VPN with Umbrella
    - Configure the App for Umbrella DNS and Remote VPN
      - Configure the App for Umbrella Without Remote VPN
      - Configure the App for Umbrella With Remote VPN
    - Add Android Restriction
    - Additional Notes
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access the User Identities on the Umbrella Dashboard
    - Configure Policy Based on User Identity
    - Monitor User Activity
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Is this a VPN to Umbrella?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Unmanaged Mobile Device Protection
- Umbrella Unmanaged Mobile Device Protection
- Administrator Actions
  - Prerequisites
  - Procedure
- End-User Actions
  - Android
    - Known Limitations
    - Prerequisites:
    - Deployment
    - Enrollment
    - Enrollment by QR code
    - Enrollment without Camera Access
    - Registration and Activation
  - iOS
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment by Link
    - Enrollment by QR code
    - Registration and Activation
Manage Chromebook Client (Legacy)
- Get Started with Umbrella Chromebook Client
  - Umbrella's Policies
  - Umbrella Chromebook Client Use Cases
  - How the Umbrella Chromebook Client Works
  - Umbrella Chromebook Client Prerequisites
    - Supported Devices and Operating Systems
    - Unsupported Devices and Operating Systems
    - Networking Requirements
  - Google Workspace Identity Service
    - Integrate Google Workspace Identities with Umbrella
- Deploy the Chromebook Client
  - Prerequisites
    - Trusted Network Detection
  - Procedure
    - Step 1: Download Umbrella Chromebook Configuration
    - Step 2: Install the Cisco Umbrella Chromebook Client Extension
    - Step 3: Install the Cisco Umbrella Chromebook Client Application
  - Apply Policies
  - Add a Chromebook Specific Policy
    - Prerequisites
    - Procedure
  - Enable Trusted Network Detection
    - How Trusted Network Detection Works
    - Prerequisites
      - Network Access
    - Procedure
  - Filter Content with Public Session Support (Managed Guest Session Support)
    - Prerequisites
    - Enable a Public Session (Managed Guest Session)
    - Update the Cisco Umbrella Configuration File
    - Install Umbrella Chromebook Client in Your Public Session (Managed Guest Session)
    - Monitor Public Sessions (Managed Guest Sessions) in Umbrella
    - Create Policy for Chromebooks in Public Session Mode (Managed Guest Mode)
  - Remove Umbrella Chromebook Client Software
- Integrate the Google Workspace Identity Service
  - Known Limitations
  - Prerequisites
  - Procedure
    - Step 1: Update the Umbrella Chromebook Configuration
    - Step 2: Install the Cisco User Management Connector App
    - Step 3: Enter Your Google Workspace Super Administrator ID in the Umbrella Dashboard
- Chromebook Client FAQ
- Google Workspace Identity Service FAQ
Cisco Security for Chromebook Client
- Get Started
  - Policies
- Migration Scenarios
- Prerequisites
- Limitations
- Google Workspace Identity Service
- Integrate Google Workspace Identities
  - Known Limitations
  - Prerequisites
  - Procedure
- Deploy the Chromebook Client
  - DNS Layer Protection
  - Deploy Cisco Security for Chromebook Client
    - Umbrella Dashboard
    - Google Admin Console
      - Configure Default Template
      - Configure Managed Guest Session Template
  - Bypass Internal Domains from DNS-over-HTTPS (DoH)
    - Procedure
      - Verification
  - Enable Reporting for Private IP Address of Chromebook Device
    - Prerequisites
    - Procedure
  - Export Device Data to CSV
    - Procedure
  - Verify and Debug
    - Verification Steps
    - Debugging Steps
- Protection Status
  - Umbrella Security for Chromebook Client States
- Chromebook-specific DNS Policy
  - Prerequisites
  - Procedure
- Chromebook Client FAQs
- Google Workspace Identity Service FAQs
Hardware Integration
- Integration for ISR 4K and ISR 1100 – Security Configuration Guide
  - Create a Legacy Network Devices API Token
    - Prerequisites
    - Create a Legacy Network Devices API Token
- Wireless LAN Controller Integration
  - Prerequisites
  - Terminology
  - Wireless LAN Controller Setup and DNS Request Flow
  - Configure the Wireless LAN Controller Integration
  - Sample Wireless LAN Controller Deployments
    - Scenario 1: Configure Local Policies for Cisco Umbrella
      - Setup
    - Scenario 2: Configure WLAN or AP Group for Cisco Umbrella
      - Setup
    - OpenDNS WLAN configuration modes
  - Cisco Umbrella Activity Reporting
  - Cisco Umbrella Support
  - Cisco Umbrella Limitations
- Meraki Cloud-Managed Networks and Umbrella DNS
  - Integrate Meraki with Cisco Umbrella
  - Configure Meraki to Use Cisco Umbrella
  - Set Up Umbrella for a Meraki Network
    - Prerequisites
    - Configure Umbrella for Clients
    - Configure Meraki Network to Proxy DNS to Umbrella
  - Configure DNS Forwarder for Umbrella
    - Prerequisites
    - Windows Server 2003 and 2003 R2
    - Windows Server 2008 and 2008 R2
    - Windows Server 2012 and 2012 R2
    - Configure BIND to use Umbrella DNS
      - Shell or SSH Instructions
      - Webmin Instructions
- Mobility Express Integration
  - Prerequisites
  - Deploy the Integration
  - Configure Mobility Express for Umbrella
    - Prerequisites
    - Configure a Role-Based Local Policy
    - Configure an Umbrella Policy
    - Apply a Cisco Umbrella Profile to a WLAN and AP Group
- Cisco SD-WAN Powered by Catalyst SD-WAN and Umbrella
  - Prerequisites
  - Limitations
  - Configure Umbrella and Cisco Catalyst SD-WAN
    - Authorization: Cisco Catalyst SD-WAN (vManage) Version 19.2/IOS-XE 16.12 and Earlier
    - Authorization: vManage Version 20.1 and Later
    - Insert Authorization Data
- Integration for RV-series Routers
  - Prerequisites
  - Integration
  - Limitations and Restrictions of the Cisco Umbrella Integration
- Cisco Catalyst 9200 and Catalyst 9300 Switches
  - Prerequisites
    - For Active Directory integration on the Catalyst 9200 and 9300 switch:
- Cisco DNA Center
- Cisco Secure Firewall
  - Prerequisites
  - Limitations
  - Configure the Umbrella Connection
  - Create and Manage Umbrella DNS Policies
Cisco Adaptive Security Appliances (ASA)
- Integration for ASA Overview
  - Prerequisites
    - Licensing
    - Hardware and Software
    - Network Access
- Import the Digicert Certificate Authority
  - Prerequisites
  - Procedure
- Configure the Umbrella Connector
  - Prerequisites:
  - Obtain Your API Token
  - Configure Umbrella Global Settings
  - Enable Umbrella in the DNS Inspection Policy
  - Verify Operation
    - Prerequisites
    - Verify on the ASA
    - Verify in the Umbrella Dashboard
- Monitor the Umbrella Connector
  - Monitor Umbrella Syslog Messages
- Delete an ASA
  - Prerequisites
  - Delete the Umbrella Configuration
  - Remove the ASA From the Dashboard
    - Ensure that the ASA is Removed
Multi-Org
- Cisco Umbrella Multi-org Console Overview
  - Centralized Reports
    - Multi-org Message Center
  - Centralized Settings
  - Org Management
  - Console Settings
  - Add a New Organization
  - Manage Existing Organizations
    - Procedure
  - Delete an Organization
  - Acquire Umbrella Roaming Client Parameters
- Manage Centralized Settings
  - Access Centralized Settings and the Overview Page
- Manage Centralized Reports
  - Data Warehouse Locations
  - Overview Report
    - Notifications
    - Deployment and Health Statuses
      - Organization Health
      - Total Deployment Health
    - Total Requests
    - Security Activity
  - Deployment Status Report
    - Deployment and Health Statuses
      - Organization Health
      - Total Deployment Health
    - Organizations
  - Security Summary Report
    - Understand the Security Summary Report
      - Organizations
      - Categories
      - Destinations
    - Download the Security Summary Report
  - App Discovery Report
    - Understand the App Discovery Report
      - Notifications
      - Search Orgs
      - Overview
      - Individual Organization Summary
        
        Flagged Categories
        
        Flagged Apps
- Manage Console Settings
  - Add a New Administrator
    - Delegated Administration
    - Procedure
  - Invite an Administrator from Another Organization
  - Create a Global Read Only Administrator
  - Update Billing Contact
- Manage Logs
  - Logging to Umbrella's Data Warehouse
  - Logging to Amazon S3
  - Advantages and Disadvantages to Configuring a Cisco-Managed Bucket
  - Estimate the Size of Your Logs
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites
    - Enable Logging
  - Set up an Amazon S3 Bucket
    - JSON Bucket Policy
  - Enable Logging to a Cisco-managed S3 Bucket
    - Prerequisites
    - Download Files From the S3 Bucket Locally
  - Change the Location of Event Data Logs
    - Implications When You Change Data Warehouse Locations
    - Log Retention
    - Prerequisites
    - Change Data Warehouse Locations
  - Stop Logging
    - Prerequisites
    - Stop Logging
  - Delete Logs
    - Prerequisites
    - Delete Logs
Investigate
- Manage Umbrella Investigate
  - Getting Started with Investigate
    - Smart Search
    - Smart Search Best Practices
    - Pattern Search
  - Conduct a Pattern Search
    - About Pattern Search
      - RegEx Examples
  - Manage the Investigate Only User Role
    - Prerequisites
    - Add an Investigate Only User
  - About Passive DNS
  - About Investigate View Types
  - Create Investigate API Keys
    - Prerequisites
    - (Recommended) Create API Keys
    - (Legacy) Create Investigate API Tokens
    - (Legacy) Delete an Investigate API Token
  - About the Investigate Domain Summary
    - Domain Summary Details
    - Investigate Domain Risk Score
    - Sub-Component Scores
      - Keyword Score
      - Lexical Score
      - TLD Score
      - Geo Popularity
    - Dispute a Content Categorization
      - Submit Categorization Request Through Cisco Talos
      - Submit Categorization Request Through Investigate
    - Dispute a Security Categorization
      - Submit Categorization Request Through Cisco Talos
      - Submit Categorization Request Through Investigate
    - About Investigate Passive DNS Timeline
      - DNS Query Volume
      - Event History
    - About DNS Resolution in Investigate
      - IP Addresses
      - Nameserver (NS)
      - DNS (Others)
    - About Associated Samples in Investigate
    - About the Subdomains Tab in Investigate
    - About Related Domains in Investigate
    - About the Geographic Distribution View in Investigate
    - About the Sample View in Investigate
      - Prerequisites
      - Get Started With Sample View
      - Sample View Details
        
        Components of a Threat Sample
      - Behavioral Indicators
      - Network Connections
      - Associated Samples
      - Associated Artifacts (Secure Malware Analytics Integration)
    - About the IP Address View in Investigate
      - Summary
      - DNS Resolution
      - Autonomous Systems
      - Associated Samples
      - Recent Detections
  - About WHOIS Record Information
    - WHOIS Record Is Unavailable
    - WHOIS Record Contact Information
    - WHOIS Record Domain Availability
    - WHOIS Record Email Addresses
    - WHOIS Record Nameservers
    - WHOIS Record Show More Data
    - About the WHOIS Nameserver View
      - Prerequisites
      - Research WHOIS Nameserver From Domain View
      - WHOIS Nameserver View
    - WHOIS Data – FAQ
  - About the ASN View
    - Prerequisites
    - Current Information
    - Current Routes
    - Research AS From IP Address View

Cisco Umbrella DNS User Guide Manage Your Logs Log Formats and Versioning

Last updated: May 07, 2026

Previous topic Procedure Next topic File Name Format