Order of Fields in DNS Log Record

Login

Cisco Umbrella for Government SIG User Guide

Cisco Umbrella for Government SIG User Guide
- Welcome to Cisco Umbrella for Government
  - Start Protecting Your Systems
  - Find Your Organization ID
  - Determine Your Current Package
  - Umbrella Policies Overview
  - Contact Cisco Umbrella Support
- Get Started
  - Set Up DNS-Layer Security
    - Step 1: Add a Network Identity
    - Step 2: Configure Your DNS Settings
    - Step 3: Set Up Clients and Virtual Appliances (Optional)
      - Set Up an Umbrella Roaming Client or AnyConnect Roaming Security Module
      - Set Up an Umbrella Mobile Client App
      - Set Up a Chromebook Client
      - Set Up a Virtual Appliance
    - Step 4: Add a DNS Policy
    - Step 5: Test Your DNS Policies
  - Point Your DNS to Cisco Umbrella
    - Anycast IP Addresses
      - Step 1 – Find out where your public DNS server addresses are configured
      - Step 2 – Log into the server or router where DNS is configured
      - Step 3 – Change your DNS server addresses
  - Set Up Web Security
    - Step 1: Add a Network Identity (Optional)
    - Step 2: Set Up an IPsec Tunnel (Recommended)
    - Step 3: Set Up a PAC File, Proxy Chaining, or Roaming Computers
      - Set Up a PAC File
      - Set Up Proxy Chaining
      - Set Up AnyConnect Umbrella Roaming Security Module (Recommended)
    - Step 4: Add DNS, Web, and Firewall Policies
    - Step 5: Test Your DNS and Web Policies
  - Configure the Secure Web Gateway
- Limitations and Range Limits
  - Data Retention
  - Average Bandwidth
- Manage Identities
  - Add a Network Identity
    - Step 1 – Select the Appropriate Network
    - Step 2 – Set up the Network Identity
      - Dynamic IP Address—IPv4 Only
    - Step 3 – Change the DNS Settings on Your Relevant Network Device
    - Step 4 – Test Your Network
  - Delete a Network Identity
  - Identity and SIG Deployment
  - Find the Total Number of Identities in Your Organization
- Manage Domains
  - Add Internal Domains
    - Prerequisites
    - Procedure
  - Add External Domains and IPs
    - Prerequisites
    - Procedure
  - Bulk Upload External Domains and IPs
  - Wildcards and Domain Management
    - Known Limitations
- Manage DNS Policies
  - Add a DNS Policy
    - Prerequisites
    - Part One — Set up the Policy Wizard
    - Part Two — Configure the Policy
      - 1. Configure Security Settings
      - 2.Configure Content Category Settings
      - 3. Configure Application Setting
      - 4. Configure Destination Lists
      - 5. Configure Block Page Settings
      - 6. Save Your DNS Policy
  - Test a DNS Policy
    - Prerequisites
    - Procedure
  - DNS Policy Settings
    - Umbrella DNS Policy Settings
  - DNS Policy Precedence
    - Match an Identity and Destination to a Policy
      - Identities without Active Directory Integration
      - Identities with Active Directory Integration
      - DNS Policy without Virtual Appliance
      - DNS Policy with Virtual Appliance
    - Configure Policy Order
    - Identity Combinations
  - Best Practices for DNS Policies
  - Enable SafeSearch for DNS Policies
    - Test Google, Youtube, and Bin
    - Test Through a Lookup From the Command Line
  - Group Roaming Computers with Tags
    - Prerequisites
    - Procedure
      - DNS Policies
- Manage the Web Policy
  - Add a Ruleset to the Web Policy
    - Prerequisites
    - Procedure
  - Add Rules to a Ruleset
  - Test the Web Policy
    - Before You Start
    - Procedure
      - Results
  - Web Policy Precedence
    - Web Policy Rulesets
      - Add Identities to a Ruleset
      - Configure Security Settings
      - Set Up Rulesets
      - Match an Identity to a Ruleset
      - Active Directory User Identity Source
    - Web Policy Rules
      - Add Destinations
      - Define Actions
      - Apply Web Policy Rule
  - Best Practices for the Web Policy and Rulesets
  - Manage Global Settings
    - Microsoft 365 Compatibility
      - Tenant Controls
      - Limitations
      - Procedure
    - Protected Files Bypass
      - How Protected Files Bypass is Enabled and Disabled
      - Procedure
  - Confirm SafeSearch for a Web Policy Ruleset
    - Google
    - YouTube
    - Yahoo
    - Bing
  - Understand Isolated Destinations
    - Prerequisites
      - Umbrella Prerequisites
      - Browser Prerequisites
    - Umbrella Package RBI Add-Ons
    - Limitations of Isolation
    - Expired or Downgraded Add-Ons
  - Monitor Bandwidth Usage in the App Discovery Report
    - Prerequisites
    - Procedure
- Manage the Data Loss Prevention Policy
  - Limitations
  - Add a Real Time Rule to the Data Loss Prevention Policy
    - Prerequisites
    - Procedure
  - Understand Exclusions in a Real Time Rule
  - Supported Applications
  - Add a SaaS API Rule to the Data Loss Prevention Policy
  - Discovery Scan
    - Initiate a Discovery Scan
    - Cancel a Discovery Scan
  - Edit a Data Loss Prevention Rule
    - Prerequisites
    - Procedure
  - Delete a Data Loss Prevention Rule
    - Prerequisite
    - Procedure
  - Enable or Disable a Data Loss Prevention Rule
    - Prerequisites
    - Disable a Rule
    - Enable a Rule
  - Supported File and Form Types
- Manage the Firewall Policy
  - Add a Firewall Rule
    - Prerequisites
    - Procedure
    - Network Tunnel Identity
    - Firewall Rule Settings
  - Delete a Firewall Rule
    - Prerequisites
    - Procedure
  - Configure IPS Settings for Firewall Policy
    - Prerequisites
    - Procedure
  - Change a Firewall Priority
    - Prerequisites
    - Procedure
  - Monitor Hit Count
    - Prerequisites
    - Procedure
  - Edit Hit Count
    - Prerequisites
    - Reset or Refresh the Hit Count
    - Configure the Hit Count Interval for a Firewall Policy
  - Review Firewall Logs in Reports
    - Prerequisites
    - View Firewall Logs in Activity Search
    - Advanced Search Firewall Logs in Activity Search Report
    - View CDFW Events in the App Discovery Report
  - Check Protocol of Web Traffic
    - Prerequisites
    - Check Protocol in the Activity Search Report
    - Check Protocol in the Firewall Logs
- Manage IPS
  - Add a Custom Signature List
    - Reset a Signature's Action
  - Delete a Custom Signature List
  - Reset a Signature's Action
- Manage Security Settings
  - Add a DNS Security Setting
  - Add a Web Security Setting
  - DNS Security Categories
  - Web Security Categories
- Manage Content Categories
  - Add a DNS Content Category Setting
  - DNS Content Categories
    - Content Categories Definitions
  - DNS Content Category Changes
  - Add a Web Content Category Setting
  - Web Content Categories
  - Web Content Category Name Changes
  - View Content Categories in Reports
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
    - View Content Categories in Top Identities Report
- Manage Data Classifications
  - Create a Data Classification
    - Built-In Identifiers
    - Machine Learning Identifiers
    - Custom Identifiers
    - Exact Data Match Identifiers
    - Indexed Document Match Identifiers
    - Prerequisites
    - Procedure
  - Copy and Customize a Built-In Data Classification
    - HIPAA Data Classification
    - Prerequisites
    - Procedure
  - Delete or Edit a Classification
    - Prerequisites
    - Delete a Classification
    - Edit a Classification
  - Create an Exact Data Match Identifier
    - Prerequisites
    - Procedure
  - Index Data for an EDM
    - Prerequisites
    - Run the DLP Indexer to Create an EDM Identifier
    - Update the Indexed Data Set Periodically
    - Troubleshooting
  - Exact Data Match Field Types
    - Supported EDM Types
  - Built-In Data Classifications
- Built-In Data Identifiers
  - Copy and Customize a Data Identifier
  - Create a Custom Identifier
  - Custom Regular Expression Patterns
    - Limitations
  - Individual Data Identifiers
- Manage Application Settings
  - Add a DNS Application Setting
    - Prerequisites
    - Procedure
  - Add a Web Application Setting
    - Prerequisites
    - Procedure
  - Delete an Application Setting
    - Prerequisites
    - Procedure
  - Application Categories
    - Category Descriptions
  - Manage Advanced App Controls
    - Prerequisites
    - Control Apps in the Policy Application Settings
    - Control Apps in a Web Policy Rule
    - Apps with Advanced App Controls
    - Troubleshooting
- Manage Tenant Controls
  - Add a Tenant Controls Setting
    - Prerequisites
    - Procedure
  - Control Cloud Access to Microsoft 365
    - Prerequisites
    - Procedure
  - Control Cloud Access to Google G Suite
    - Prerequisites
    - Procedure
  - Control Cloud Access to Slack
    - Prerequisites
    - Procedure
  - Control Cloud Access to Dropbox
    - Prerequisites
    - Procedure
  - Review Tenant Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Destination Lists
  - If a Destination List Entry Does not Fully Unblock or Allow a Page
  - Add a DNS Destination List
    - Prerequisites
    - Procedure
  - Add a Web Destination List
    - Prerequisites
    - Procedure
  - Edit a Destination List
    - Prerequisites
    - Procedure
  - Add Destinations in Bulk
    - Prerequisites
    - Procedure
  - Download Destinations to a CSV File
    - Prerequisites
    - Procedure
  - Control Access to Custom URLs
    - Prerequisites
      - Install a Root Certificate
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Top-Level Domains To Destination Lists
    - Prerequisites
    - Procedure
  - Add Punycode Domain Name to Destination List
    - What is Punycode?
    - Examples of Unicode and Punycode Encoded Strings
  - Test Your Destinations
  - Troubleshoot DNS Destination Lists
    - DNS Destination Lists and Common Error Conditions
- Manage File Type Control
  - Enable File Type Control
    - Prerequisites
    - Procedure
      - File Type Control Outcomes Through Rule Actions
  - File Types to Block
  - Review File Type Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Selective Decryption
  - Add a Web Selective Decryption List
    - Prerequisites
    - Procedure
- Manage Schedule Settings for the Web Policy
  - Add a New Schedule Setting for the Web Policy
    - Prerequisites
    - Procedure
- Manage Certificates
  - Certificate Installation Methods
  - Install the Cisco Umbrella Root Certificate
    - Prerequisites
    - Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
      - Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy
      - Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console
    - Manually Install the Cisco Umbrella Root Certificate (Single Computer)
      - Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows
      - Install the Cisco Umbrella Root Certificate in Firefox on Windows
      - Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X
      - Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line
      - Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux
  - Add Customer CA Signed Root Certificate
    - Web Policies
    - DNS Policies
    - Prerequisites
      - Certificate Requirements
    - Install Root Certificate in Browsers
    - Procedure
  - Delete Customer CA Signed Root Certificate
  - View Cisco Trusted Root Store
    - Extract the Certificates
    - View an Individual Certificate File
- Manage Umbrella's PAC File
  - Deploy Umbrella's PAC File for Windows
    - Prerequisites
    - Deploy Umbrella PAC File URL for Chrome and Edge Browsers
    - Deploy Umbrella PAC File URL for Firefox
  - Deploy Umbrella's PAC File for Mac
    - Prerequisites
    - Deploy Umbrella PAC File URL to Chrome
    - Deploy Umbrella PAC File URL to Firefox
    - Deploy Umbrella PAC File URL to Safari
  - Customize Umbrella's PAC File
    - Prerequisites
    - Procedure
- Manage Proxy Chaining
  - Forwarded-For (XFF) Configuration
    - On-Premise X-Forwarded-For Header Configuration (No Plug-In)
    - Browser PluginX-Forwarded-For Header Configuration (No Proxy Chaining)
- Customize Block and Warn Pages
  - Create a Custom Block Page
    - Prerequisites
    - Procedure
  - Create a Custom Warn Page
    - Prerequisites
    - Procedure
  - Allow Users to Contact an Administrator
    - Prerequisites
    - Procedure
    - Link a Custom Block Page Appearance to a Policy
  - Add a Custom Logo
    - Prerequisites
    - Procedure
  - Redirect to a Custom Block Page
    - Prerequisites
    - Procedure
  - Block Page IP Addresses
- Network Tunnel Group Configuration
  - Prerequisites
  - Establish a Tunnel
    - Maximum Transmission Unit (MTU) Size
    - Tunnel Size
    - Client Reachable Prefixes
    - Throughput and Multiple Tunnels
  - Network Tunnel Group and Secure Web Gateway
    - Transparent Mode
    - Explicit Mode
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Delete an Account
    - Prerequisites
    - Procedure
  - Change Account Settings
    - Prerequisites
    - Procedure
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-identification
    - Disable De-identification
    - Limitations
- Manage User Roles
  - Add a New User
    - Prerequisites
    - Procedure
  - Add a Custom User Role
    - Prerequisites
    - Procedure
- Manage API Keys
  - Add Umbrella API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Add Static API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Add KeyAdmin API Keys
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Manage Your Logs
  - Storing the Logs
  - Upgrade Reports
    - Procedure
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites
      - JSON Bucket Policy
    - Procedure
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
      - Prerequisites
  - Stop Logging
    - Procedure
  - Log Formats and Versioning
    - File Name Format
      - Subfolders
        
        Find Your Log Schema Version
        
        Prerequisites
        
        Log Schema Versions
        
        Procedure
        
        Log File Fields
        
        DNS Logs
        
        Order of Fields in DNS Log Record
        
        Web Logs
        
        Order of Fields in Web Log Record
        
        Cloud Firewall Logs
        
        Order of Fields in Cloud Firewall Log Record
        
        Admin Audit Logs
        
        Order of Fields in Admin Audit Log Record
        
        Order of Fields in IPS Log Record
        
        DLP Logs
        
        Order of Fields in DLP Log Record
        
        Activity Search Logs
        
        Fields in the Activity Search Log
        
        Top Categories Log
        
        Fields in the Top Categories Log
        
        Top Destinations Log
        
        Fields in the Top Destinations Log
        
        Top Identities Log
        
        Fields in the Top Identities Log
        
        Estimate the Size of Your Logs
- Manage Authentication
  - Enable Two-Step Verification
  - Disable Two-Step Verification
  - Enable Cisco Security Cloud Sign On
  - Disable Cisco Security Cloud Sign On
  - Get Started with Single Sign-On
    - How SSO Changes Logging In
  - Enable SSO with Duo
  - Enable SSO with PingID
  - Enable SSO with Okta
  - Enable SSO with OneLogin
  - Enable SSO with Azure
  - Enable SSO with Other IDPs
- Manage Cloud Malware Protection
  - Enable Cloud Malware Protection
    - Prerequisites
    - Limitation
    - Procedure
  - Revoke Authorization for a Platform
    - Prerequisites
    - Procedure
  - Enable Cloud Malware Protection for Dropbox Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Box Tenants
    - Prerequisites
    - Limitation
    - Verify Box Application Settings
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Microsoft 365 Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Webex Teams Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Google Drive
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
- Manage SaaS API Data Loss Prevention
  - Enable SaaS API Data Loss Protection for Box Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Dropbox Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Google Drive Tenants
    - Prerequisites
    - Validation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Webex Teams Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Microsoft 365 Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
Identity Integrations
- Introduction
  - Configure Identity Providers or Manually Import Users and Groups
- Configure SAML Integrations
  - SAML Identities and the Web Policy
    - SAML Data Flow
  - Prerequisites
  - SAML Certificate Renewal Options
    - Automatic Configuration Through the Umbrella Fixed Metadata URL
      - Prerequisites
    - Manual Import of the Umbrella Signing Certificate
  - Configure Azure AD for SAML
    - Prerequisites
      - Bypass Domains from HTTPS Decryption
    - Configure Azure AD
    - Configure Azure for SAML with Azure's Metadata Upload
    - Configure Azure for SAML Manually
  - Configure Okta for SAML
    - Prerequisites
    - Configure Okta for SAML with Metadata Upload
    - Configure Okta for SAML Manually
  - Configure AD FS for SAML
    - Prerequisites
    - Configure ADFS
    - Configure AD FS for SAML in Umbrella with Metadata Upload
    - Configure AD FS for SAML in Umbrella Manually
  - Configure Duo Security for Cisco Umbrella SAML
    - Prerequisites
    - Configure Cisco Duo Single Sign On (SSO) Application
    - Configure Cisco Umbrella for SAML with Metadata Upload
  - Configure PingID for SAML
    - Prerequisites
    - Configure PingID for SAML with Metadata Upload
    - Configure PingID for SAML Manually
  - Configure OpenAM for SAML
    - Prerequisites
    - Configure OpenAM for SAML with Metadata Upload
    - Configure OpenAM for SAML Manually
  - Configure Other IdPs for SAML
    - Prerequisites
    - Configure Your SAML IdP with Metadata Upload
    - Configure Your SAML IdP Manually
  - Enable IP Surrogates for SAML
    - Prerequisites
      - HTTPS Inspection
    - Map Tunnels to Sites
    - Enable IP Surrogates
    - Add a New IP Surrogate Bypass
    - Delete an IP Surrogate Bypass
    - View Identities in Activity Search
  - Configure SAML for Multiple EntityIDs
    - Prerequisites
    - Configure SAML for Multiple EntityIDs with Metadata Upload
    - Configure SAML for Multiple EntityIDs Manually
- Provision Identities from Active Directory
  - Prerequisites
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Connect Multiple Active Directory Domains to Umbrella
  - Connect Active Directory to Umbrella to Provision Users and Groups
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Register a Domain Controller or Domain in the Umbrella Dashboard
      - Register a Domain Controller
      - Register a Domain
    - Specify AD Groups of Interest
    - Install the Connector
    - Verify That the Connector Syncs with Umbrella
  - Change the Connector Account Password
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
- Provision Identities Through Manual Import
  - Prerequisites
    - CSV File Structure
    - CSV File Fields
  - Procedure
- Provision Identities from Azure AD
  - Prerequisites
  - Limitations
  - Procedure
  - Configure Cisco User Management Connector Gov App in Azure AD Portal
  - View Users and Groups in Umbrella
- Provision Identities from Okta
  - Prerequisites
  - Limitations
  - Supported Features
  - Import the ObjectGUID Attribute from Okta
  - Configure the Cisco User Management Connector Gov App
  - Troubleshooting
- Active Directory Integration with Virtual Appliances
  - Network Diagram for VA Deployments
  - Prerequisites
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Active Directory User Exceptions
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Set Up Active Directory User Exceptions
    - Set Up Active Directory Group Exceptions
    - Set Up Active Directory IP Address Exceptions
  - Prepare Your Active Directory Environment
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - AD Integration with Domain Controllers
      - Verify That Auditing of Logon Events is Enabled on the Domain Controllers
      - Run the Configuration Script on the Domain Controllers
        
        Register a Domain Controller in the Umbrella Dashboard
        
        Verify the Domain Controller Registration in the Umbrella Dashboard
        
        Multi AD domain and multi-forest support
      - AD Integration with a Centralized Windows Event Log Collector
        
        1. Additional Prerequisites
        
        2. Register the Windows Event Log Collector with Umbrella
        
        3. Register the AD Domains with Umbrella
  - Connect Active Directory to Umbrella VAs
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Specify AD Groups of Interest
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Multiple Active Directory and Umbrella Sites
    - Active Directory Sites and Umbrella Sites
      - Active Directory Sites and Services
      - Umbrella Sites
        
        When You Want to Use Umbrella Sites
      - Caveats
    - Use Umbrella Sites
      - Assign a Site to a Component
  - Change the Connector Account Password
    - Prerequisites
      - Connector Server
      - Outbound Network Access to Cisco Umbrella
      - Connector Account
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
Reports
- Get Started with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
  - Report Retention
- Schedule Reports
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Unsubscribe From a Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Overview Report
  - Message Center
  - Deployment Health
  - Network Request Breakdown
  - Firewall Breakdown
  - Security Categories
  - App Discovery and Control
  - Security Requests
- Security Activity Report
  - View Activity and Details by Filters
    - Prerequisites
    - Procedure
  - View Activity and Details by Event Type or Security Category
    - Prerequisites
    - Procedure
      - Group Security Categories
  - View an Event's Details
    - Prerequisites
    - Procedure
  - Search for Security Activity
    - Prerequisites
    - Procedure
      - Advanced Search
- Activity Search Report
  - Prerequisites
  - View the Activity Search Report
    - Configure Columns to Display
  - View Actions
    - See Full Details
    - Filter Views
  - Schedule an Activity Search Report
  - Use Search and Advanced Search
    - Search
    - Wildcards
      - Domains
      - URLs
      - File Names
    - Advanced Search
- App Discovery Report
  - View the Dashboard
  - View the Highest Risk Apps
  - Review Apps in the Apps Grid
  - View App Details
  - Control Apps
    - Configure Application Settings for a Policy
  - Advanced App Controls
  - View Traffic Data Through SWG
    - View Traffic in the App Discovery Dashboard
    - View Traffic in the Apps Grid
    - View Traffic in the App Details
  - View CDFW Events
    - View CDFW Events by App Risk
    - View CDFW Events in the Apps Grid
    - View CDFW Events in an App's Details
    - View a CDFW Protocol Details
- Top Threats Report
  - View the Top Threats Report
  - View Top Threat Types in the Threat Activity Breakdown
  - View How Threats Impact Your Environment
  - Search for Threats in Activity Search
  - Threat Type Details
    - Prerequisites
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Total Requests Report
  - Prerequisites
  - View Trends in the Total Requests Report
- Activity Volume Report
  - Prerequisites
  - View Requests by Volume of Activity
  - View Activity Volume by Security Categories
    - Prevent
    - Contain
  - View Activity Volume by Policy Traffic
  - View Trends
- Top Destinations Report
  - Destination Details
    - Prerequisites
    - View the Destination Details
    - View the Request Traffic
      - View Requests by Blocked or Allowed
      - View Requests Through Global Traffic %
    - View the Access & Policy Details
    - View Recent Activity
    - View the Most Visited URL Paths
- Top Categories Report
  - Prerequisites
  - Top Categories Quick View
  - View Category in Other Reports
  - Category Details
    - Prerequisites
    - View a Category's Details Overview
    - View a Category's Traffic
      - View the Activity Breakdown
      - View the Traffic Bandwidth
    - View a Category's Identities
    - View the Category's Top Domains
- Top Identities Report
  - View Identity in Other Reports
  - Identity Details
- Admin Audit Log Report
  - Export Admin Audit Log Report to an S3 Bucket
- Cloud Malware Report
  - View the Cloud Malware Report
  - Use the Cloud Malware Report
    - View Detailed Information About a File
    - Quarantine a Malicious File
    - Restore a Quarantined File
    - Delete a Malicious File
    - Dismiss an Item from the Report
    - Export a Cloud Malware Report
- Data Loss Prevention Report
  - View Events
    - Delete File
    - Quarantine File
    - Restore File from Quarantine
    - Use Advanced Search
  - Discovery
Umbrella Roaming Security: Cisco Secure Client
- Introduction
- Frequently Asked Questions
- Secure Umbrella Roaming: Cisco Secure Client (Formerly AnyConnect)
  - Quick Start Guide
    - Prerequisites
    - Deploy the OrgInfo.json File
  - Prerequisites
    - System Requirements
    - Network Requirements
  - Before You Begin
    - Obtain an Umbrella Account
    - Download Umbrella Roaming Security Profile
  - Deploy Umbrella for Cisco Secure Client
    - Standard Installation
      - Download
      - Deployment
      - Authentication
      - Manual Installation (Most Common for Evaluation)
      - Standard Installation (Most Common)
    - VPN Head-end Pushed Installation
  - Meraki Systems Manager (SM) Deployment
  - Enable the Umbrella SWG Agent
  - Install the Root Certificate
  - IPv4 DNS Protection Status
    - Cisco Secure Roaming Client module as of 4.8 MR2
    - DNS and IP Layer State Descriptions
  - Interpret Diagnostics
  - Customize Windows Installation of Cisco Secure Client
    - Requirements
    - Prerequisites
    - Procedure
      - Deploy the Cisco Secure Client VPN Module
      - Deploy the Cisco Secure Client Umbrella Roaming Security Module
      - (Optional) Deploy the Cisco Secure Client DART Module
      - Hide Cisco Secure Client from Add/Remove Programs List
    - Optional OrgInfo.json Configurations
  - Customize macOS Installation of Cisco Secure Client
    - Requirements
    - Prerequisites
    - Procedure
    - Step 1 – Make the DMG Package Writeable
    - Step 2 – Generate the Module Installation Configuration File
    - Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
    - Step 4 – (Optional) Hide the VPN Module
    - Step 5 – Customize the Cisco Secure Client Installation Modules
      - Example – Customize Cisco Secure Client Modules
    - Step 6 – Set Up the Correct Extension Permission Settings
    - Step 7 – Install Cisco Secure Client with Selected Modules
- Active Directory Policy Enforcement and Identities
  - Procedure
  - macOS User Identity
- Virtual Appliances
  - Behavior
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
Manage Virtual Appliance
- Introduction
  - How Umbrella Virtual Appliances Work
  - Benefits of Virtual Appliances
  - Prerequisites
    - Virtual Appliance Requirements
      - VMware Requirements
      - Microsoft Hyper-V Requirements
      - Cloud Platform Requirements
      - KVM Requirements
      - Nutanix Requirements
    - Networking Requirements
      - SSH Support Tunnel
      - Networking: Additional Considerations
    - DNSCrypt
  - Deployment Guidelines
    - Virtual Appliance Deployment Best Practices
      - Redundancy
      - Multiple DNS Egresses
      - Single DNS Egress
      - Double NAT
  - Importance of Running Two VAs
    - Benefits of Two VAs
- Deploy Virtual Appliances
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Procedure
    - 1. Download and Extract the Hyper-V Installer
    - 2. Import the Virtual Appliance
    - 3. Copy and Rename Image Files
    - 4. Select Network Adapter
    - 5. Select Hard Drive
    - 6. Power on the Virtual Machine
    - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Prerequisites
    - Procedure
    - Step 1: Download OVF Template
    - Step 2: Deploy OVF Template
    - Step 3: Deploy a Second Virtual Appliance
    - Step 4: Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
    - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
    - Procedural Overview
    - 1. Prepare the Virtual Appliance Amazon Machine Image
    - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
    - Procedural Overview
    - Prepare the Virtual Appliance Instance Template on GCP
    - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
    - Procedural Overview
    - 1. Create the qcow2 files for KVM
    - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
    - Procedure
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is an Umbrella Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Umbrella Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Umbrella Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Debug Session on the VA
    - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on Azure Platforms
    - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on non-Azure Platforms
    - Troubleshoot DNS Resolution in Configuration Mode
    - Troubleshoot DNS Resolution Failures Behind a Firewall
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure Umbrella for Government Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Load Balancing
      - Configure Identity Association Timeouts
Sites and Internal Networks
- Internal Networks Setup Guide
  - Set Up Internal Networks
- Provision a Subnet for Your Virtual Appliance
  - Prerequisites
  - Procedure
  - Add an Internal Network and Sites
- Manage Sites
  - Prerequisites
  - Before You Begin
  - Procedure
- Manage Internal Networks
  - Prerequisites
  - Before You Begin
  - Internal Network Associations
  - Procedure
  - Apply Policies to Internal Network
- Assign a DNS Policy to Your Site
Managed iOS Device
- Cisco Security Connector: Umbrella Setup Guide
  - Requirements
    - Optionally
  - Getting Started
  - Quick Start
    - Prerequisites
    - Procedure
      - Step 1: Install the Cisco Security Connector App
      - Step 2: Add an Organization Administrator's Email Address
      - Step 3: Register Your iOS Device Through Your MDM to Umbrella
    - Verify Umbrella on Your iOS Device
    - Install Umbrella Root Certificate
- Register an iOS Device Through Apple Configurator 2
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS device
  - Install Umbrella Root Certificate
  - MobileIron Configuration
    - MobileIron Procedure
    - MobileIron Cloud Configuration
    - MobileIron On-Prem Configuration
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Register an iOS Device Through a Generic MDM System
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Apply a DNS Policy to Your Mobile Device
  - Umbrella Reporting
    - Activity Search Report
    - Security Activity Report
    - App Discovery Report
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Anonymize Devices
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Before You Begin
  - Generate Diagnostics
- Push the Umbrella Certificate to Devices
  - Prerequisites
  - Procedure
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Install Umbrella Root Certificate
  - Android Configuration Download
    - Procedure
      - Fail Close/Open Scenario
  - Cisco Meraki MDM
    - Add App to Cisco Meraki
    - Add Configuration for App
    - Push the App to Multiple Devices
    - Push the App to a Single Device
    - Push the Umbrella Certificate
  - MobileIron MDM
    - Configure the App
    - Push the App
    - Push User Identities
    - Push the Umbrella Certificate
  - VMware Workspace ONE
    - Register in WorkspaceONE
    - Push the App to Devices
    - Push User Identities
    - Push the Umbrella Certificate
  - Microsoft Intune MDM
    - Publish the Umbrella AnyConnect App to Managed Android Devices
    - Configure Umbrella
    - Push User Identities
    - Push the Umbrella Certificate
  - Samsung Knox MDM
    - Register with the Enterprise Mobile Manager (EMM)
    - Enroll Android Devices
    - Push the App
    - Set Managed Configuration
    - Create Profile in Knox Manage
    - Push User Identities
    - Push the Umbrella Certificate
  - Push the Umbrella Certificate to Devices
    - Prerequisites
    - Procedure
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access User Identities on the Umbrella Dashboard
    - Configure DNS Policy
    - Monitor User Activity
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - First Launch of App
  - Is this a VPN to Umbrella?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Cisco Security for Chromebook Client
- Get Started
  - Policies
- Prerequisites
- Limitations
- Google Workspace Identity Service
- Integrate Google Workspace Identities
  - Limitations
  - Prerequisites
  - Procedure
- Deploy the Chromebook Client
  - DNS Layer Protection
  - SWG Layer Protection
  - Deploy Cisco Security for Chromebook Client
    - Umbrella Dashboard
    - Google Admin Console
      - Configure Default Template
      - Configure Managed Guest Session Template
  - Bypass Internal Domains from DNS-over-HTTPS (DoH)
    - Procedure
      - Verification
  - Enable Reporting for Private IP Address of Chromebook Device
    - Prerequisites
    - Procedure
  - Export Device Data to CSV
    - Procedure
  - Verify and Debug
    - Verification
    - Debugging
- Protection Status
  - Umbrella Security for Chromebook Client States
- Chromebook-Specific DNS Policy
  - Prerequisites
  - Procedure
- Chromebook-Specific Web Policy
  - Prerequisites
  - Procedure
- Chromebook Client - FAQs
- Google Workspace Identity Service FAQs

Cisco Umbrella for Government SIG User Guide Manage Your Logs Log Formats and Versioning File Name Format Subfolders DNS Logs Order of Fields in DNS Log Record

Last updated: Apr 27, 2026

Previous topic DNS Logs Next topic Web Logs