Cisco Security

Cisco Umbrella SIG User Guide

Cisco Umbrella SIG User Guide
- Welcome to Cisco Umbrella
  - Start Protecting Your Systems
  - Find Your Organization ID
  - Determine Your Current Package
  - Umbrella Policies Overview
    - Traffic Flow Through Umbrella
    - How Umbrella Applies Policies
    - DNS Policy
    - Firewall Policy (CDFW)
    - Web Policy (SWG)
    - Data Loss Prevention (DLP) Policy
  - SWG Data Centers
  - Reserved IP
    - Deployment
    - Reporting
    - Configuration
    - Remote Browser Isolation
    - Reserved IP Surrender
    - Port Exhaustion
    - Maximum Sessions
    - Troubleshooting
    - Region of Data Centers
  - Reserved IP Supplemental Terms
  - Reserved IP Supplemental Terms - Archived
  - View Cloud Security Service Status
    - Cloud Security Platforms
      - Service Status Types
      - Cisco Umbrella
      - Cisco Secure Connect
      - Cisco Cloudlock
    - Scheduled Maintenance
    - Past Incidents
  - Contact Cisco Umbrella Support
  - Password Policy FAQs
- Get Started
  - Set Up DNS-Layer Security
    - Step 1: Add a Network Identity
    - Step 2: Configure Your DNS Settings
    - Step 3: Set Up Clients, Network Devices, and Virtual Appliances (Optional)
      - Set Up an Umbrella Roaming Client or AnyConnect Roaming Security Module
      - Set Up an Umbrella Mobile Client App
      - Set Up a Network Device
      - Set Up a Chromebook Client
      - Set Up a Virtual Appliance
    - Step 4: Add a DNS Policy
    - Step 5: Test Your DNS Policies
  - Point Your DNS to Cisco Umbrella
    - Anycast IP Addresses
      - Step 1 – Find out where your public DNS server addresses are configured
      - Step 2 – Log into the server or router where DNS is configured
      - Step 3 – Change your DNS server addresses
      - Step 4 – Test Your New DNS Settings
  - Set Up Web Security
    - Step 1: Add a Network Identity (Optional)
    - Step 2: Set Up an IPsec Tunnel (Recommended)
    - Step 3: Set Up a PAC File, Proxy Chaining, or Roaming Computers
      - Set Up a PAC File
      - Set Up Proxy Chaining
      - Set Up AnyConnect Umbrella Roaming Security Module (Recommended)
    - Step 4: Add DNS, Web, and Firewall Policies
    - Step 5: Test Your DNS and Web Policies
  - Configure the Secure Web Gateway
    - Umbrella Intelligent Proxy
    - Umbrella Secure Web Gateway
    - Web Security Best Practices
  - Uninstalling Umbrella
- Umbrella Integration with Secure Web Appliance
  - Known Limitations
  - Known Behavior
  - Add an API Key and Key Secret
  - Register Secure Web Appliance with Umbrella
  - Hybrid Policy
  - Hybrid Reporting
  - Configure Web Policies and Destination Lists
    - Configure Ruleset Identities of Web Policy
    - Configure Web Policy Rules
    - Configure Destination Lists
    - Configure Application Settings
    - Configure HTTPS Inspection Policies
    - Configure Active Directory (AD) Users and Groups
    - Configure Microsoft 365 Compatibility
  - Policy Features
- Limitations and Range Limits
  - Data Retention
  - Average Bandwidth
- Manage Identities
  - Add a Network Identity
    - Prerequisites
    - Procedure
      - Step 1 – Select the Appropriate Network
      - Step 2 – Set up the Network Identity
        
        Dynamic IP Address—IPv4 Only
      - Step 3 – Change the DNS Settings on Your Relevant Network Device
      - Step 4 – Test Your Network
  - Delete a Network Identity
    - Prerequisites
    - Procedure
  - Identity and SIG Deployment
  - Add a Network Device
    - Prerequisites
    - Procedure
      - Step 1: Create a Network Devices API Key
      - Step 2: Register a Network Device
      - Step 3: Add Network Device to a DNS Policy
      - Step 4: Test Your Network Device Integration
  - Delete a Network Device
    - Prerequisites
    - Procedure
  - Find the Total Number of Identities in Your Organization
    - Prerequisites
    - Find the Total Number of Networks
    - Find the Total Number of Roaming Clients
    - Find the Total Number of Other Identity Types
- Manage Domains
  - Add Internal Domains
    - Prerequisites
    - Procedure
  - Add External Domains and IPs
    - Prerequisites
    - Procedure
  - Bulk Upload External Domains and IPs
  - Wildcards and Domain Management
    - Known Limitations
- Manage DNS Policies
  - Add a DNS Policy
    - Prerequisites
    - Part One—Set up the Policy Wizard
    - Part Two — Configure the Policy
      - 1. Configure Security Settings
      - 2. Configure Content Category Settings
      - 3. Configure Application Settings
      - 4. Configure Destination Lists
  - Test a DNS Policy
    - Prerequisites
    - Procedure
  - DNS Policy Settings
    - Umbrella DNS Policy Settings
  - DNS Policy Precedence
    - Match an Identity and Destination to a Policy
      - Identities without Active Directory Integration
      - Identities with Active Directory Integration
      - DNS Policy without Virtual Appliance
      - DNS Policy with Virtual Appliance
    - Configure Policy Order
    - Identity Combinations
    - Policies and Block Page Bypass Settings
  - Best Practices for DNS Policies
  - Enable SafeSearch for DNS Policies
    - Test Google, Youtube, and Bing
    - Test Through a Lookup From the Command Line
  - Group Roaming Computers with Tags
    - Prerequisites
    - Procedure
      - DNS Policies
- Manage the Web Policy
  - Add a Ruleset to the Web Policy
    - Prerequisites
    - Procedure
  - Add Rules to a Ruleset
  - Test the Web Policy
    - Before You Start
    - Procedure
      - Results
  - Web Policy Precedence
    - Web Policy Rulesets
      - Add Identities to a Ruleset
      - Configure Security Settings
      - Set Up Rulesets
      - Match an Identity to a Ruleset
      - Active Directory User Identity Source
    - Web Policy Rules
      - Add Destinations
      - Define Actions
      - Apply Web Policy Rule
  - Best Practices for the Web Policy and Rulesets
  - Manage Global Settings
    - Certificate Error Handling
    - Microsoft 365 Compatibility
      - Tenant Controls
      - Limitations
      - Procedure
    - Protected Files Bypass
      - How Protected Files Bypass is Enabled and Disabled
      - Procedure
    - PAC Files
      - Prerequisites
      - Procedure
        
        Copy the Umbrella PAC File
        
        Download the Umbrella PAC File
        
        Edit the PAC File
  - Confirm SafeSearch for a Web Policy Ruleset
    - Google
    - YouTube
    - Yahoo
    - Bing
  - Understand Isolated Destinations
    - Prerequisites
      - Umbrella Prerequisites
      - Browser Prerequisites
    - Umbrella Package RBI Add-Ons
    - Limitations of Isolation
    - Expired or Downgraded Add-Ons
  - Monitor Bandwidth Usage in the App Discovery Report
    - Prerequisites
    - Procedure
- Manage the Data Loss Prevention Policy
  - Add a Real Time Rule to the Data Loss Prevention Policy
    - Prerequisites
    - Procedure
  - Understand Exclusions in a Real Time Rule
  - Supported Applications
  - Add a SaaS API Rule to the Data Loss Prevention Policy
  - Discovery Scan
    - Prerequisites
    - Initiate a Discovery Scan
    - Cancel a Discovery Scan
  - Edit a Data Loss Prevention Rule
    - Prerequisites
    - Procedure
  - Delete a Data Loss Prevention Rule
    - Prerequisite
    - Procedure
  - Enable or Disable a Data Loss Prevention Rule
    - Prerequisites
    - Disable a Rule
    - Enable a Rule
  - Supported File and Form Types
- Manage the Firewall Policy
  - Add a Firewall Rule
    - Prerequisites
    - Procedure
    - Network Tunnel Identity
    - Firewall Rule Settings
  - Add an FQDN List to a Firewall Rule
    - Prerequisites
    - Limitations
    - Procedure
  - Delete a Firewall Rule
    - Prerequisites
    - Procedure
  - Configure IPS Settings for Firewall Policy
    - Prerequisites
    - Procedure
  - Change a Firewall Priority
    - Prerequisites
    - Procedure
  - Monitor Hit Count
    - Prerequisites
    - Procedure
  - Edit Hit Count
    - Prerequisites
    - Reset or Refresh the Hit Count
    - Configure the Hit Count Interval for a Firewall Policy
  - Review Firewall Logs in Reports
    - View Firewall Logs in Activity Search
    - View CDFW Events in the App Discovery Report
  - Check Protocol of Firewall Traffic
    - Prerequisites
    - Check Protocol in the Activity Search Report
    - Check Protocol in the Firewall Logs
- Manage IPS
  - How IPS Works
    - Hit Counts
    - Default IPS Signature Lists
  - Configure IPS
- Manage Security Settings
  - Add a DNS Security Setting
    - Prerequisites
    - Procedure
  - Add a Web Security Setting
    - Prerequisites
    - Procedure
  - Dispute a Security Categorization
    - Prerequisites
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - DNS Security Categories
    - Security Categories
    - Integrations Sub-Category
  - Web Security Categories
  - Third-party Security Integrations
  - Set Up Custom Integrations
    - Prerequisites
      - Additional Prerequisites for Cisco AMP Threat Grid
    - Create a Custom Integration URL
    - Enable Third-Party Platform Integration
    - Verify Custom Integration
      - View Threat Events In Umbrella
      - View Threat Events Through the Umbrella Enforcement API
      - View Admin Audit Log
    - Logging and Reports
      - View Reports
      - Access Logs in S3
  - Custom Integration Best Practices
    - Known Domains and Destination Lists
    - Benefits of Custom Destination Allow List
    - Add a Destination List
    - Delete a Domain from Custom Destination Block List
- Manage Content Categories
  - Add a DNS Content Category Setting
    - Prerequisites
    - Procedure
  - Legacy DNS Content Category Definitions
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Categories Definitions
  - DNS Content Categories
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Categories Definitions
  - DNS Content Category Changes
    - Legacy Content Category Changes
    - New Content Categories
  - Add a Web Content Category Setting
    - Prerequisites
    - Procedure
  - Web Content Categories
  - Web Content Category Name Changes
    - Web Content Category Name Changes
    - New Web Categories
  - Migrate Content Categories
    - Prerequisites
    - Procedure
  - Dispute a Content Categorization
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - View Content Categories in Reports
    - Prerequisites
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
    - View Content Categories in Top Identities Report
- Manage Data Classifications
  - Create a Data Classification
    - Built-In Identifiers
    - Machine Learning Identifiers
    - Custom Identifiers
    - Exact Data Match Identifiers
    - Indexed Document Match Identifiers
    - Prerequisites
    - Procedure
  - Copy and Customize a Built-In Data Classification
    - PII Data Classification
    - PCI Data Classification
    - GDPR Data Classification
    - HIPAA Data Classification
    - Prerequisites
    - Procedure
  - Delete or Edit a Classification
    - Prerequisites
    - Delete a Classification
    - Edit a Classification
  - Create an Exact Data Match Identifier
    - Prerequisites
    - Procedure
  - Index Data for an EDM
    - Prerequisites
    - Run the DLP Indexer to Create an EDM Identifier
    - Update the Indexed Data Set Periodically
    - Troubleshooting
  - Exact Data Match Field Types
    - Supported EDM Types
  - Create an Indexed Document Match Identifier
    - Prerequisites
    - Limitations
    - Create an Indexed Document Match Identifier
    - Monitor the Indexed Data Set and Re-Index as Needed
    - Troubleshooting
  - Built-In Data Classifications
- Built-In Data Identifiers
  - Tolerances
- Manage Application Settings
  - Add a DNS Application Setting
    - Prerequisites
    - Procedure
  - Add a Web Application Setting
    - Prerequisites
    - Procedure
  - Delete an Application Setting
    - Prerequisites
    - Procedure
  - Application Categories
    - Category Descriptions
  - Manage Advanced App Controls
    - Prerequisites
    - Control Apps in the Policy Application Settings
    - Control Apps in a Web Policy Rule
    - Apps with Advanced App Controls
    - Troubleshooting
- Manage Tenant Controls
  - Control Cloud Access to Microsoft 365
    - Prerequisites
    - Procedure
  - Control Cloud Access to Google G Suite
    - Prerequisites
    - Limitations
    - Procedure
  - Control Cloud Access to Slack
    - Prerequisites
    - Procedure
  - Control Cloud Access to Dropbox
    - Prerequisites
    - Procedure
  - Review Tenant Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Destination Lists
  - Add a DNS Destination List
  - Add a Web Destination List
  - Add a SAML Bypass Destination List
    - Prerequisites
    - Procedure
  - Edit a Destination List
    - Prerequisites
    - Procedure
  - Add Destinations in Bulk
    - Prerequisites
    - Procedure
  - Download Destinations to a CSV File
    - Prerequisites
    - Procedure
  - Control Access to Custom URLs
    - Prerequisites
      - Enable the Intelligent Proxy—DNS Policy Only
      - Install a Root Certificate
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Top-Level Domains To Destination Lists
    - Prerequisites
    - Procedure
  - Add Punycode Domain Name to Destination List
    - What is Punycode?
    - Examples of Unicode and Punycode Encoded Strings
  - Test Your Destinations
  - Search for a Destination List
  - Troubleshoot DNS Destination Lists
    - DNS Destination Lists and Common Error Conditions
- Manage File Analysis
  - File Inspection—DNS and Web Policies
    - Cisco Advanced Malware Protection (AMP)
    - Umbrella Antivirus
  - Secure Malware Analytics (Threat Grid)—Web Policy Only
    - Secure Malware Analytics (Threat Grid)
- Manage File Type Control
  - Enable File Type Control
    - Prerequisites
    - Procedure
      - File Type Control Outcomes Through Rule Actions
  - File Types to Block
  - Review File Type Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Selective Decryption
  - Add a Web Selective Decryption List
    - Prerequisites
    - Procedure
  - Enable Certificate Error Handling
    - Prerequisites
    - Procedure
      - Step 1: Enable the Certificate Error Handling button
      - Step 2: Add a Domain
- Manage Schedule Settings for the Web Policy
  - Add a New Schedule Setting for the Web Policy
    - Prerequisites
    - Procedure
- Manage Certificates
  - Certificate Installation Methods
- Manage the Intelligent Proxy
  - How the Intelligent Proxy Works
  - Advantages of Using the Intelligent Proxy
  - Sites That are Not Proxied by the Intelligent Proxy
  - Best Practices
  - SSL Decryption Requirements and Implementation
  - Selective Decryption
- Manage Umbrella's PAC File
  - Requirements for Downloading PAC Files to User Devices
  - Supported Versions of the Secure Client for PAC Files
  - Managing PAC File Deployments
- Manage Proxy Chaining
  - Forwarded-For (XFF) Configuration
    - On-Premise X-Forwarded-For Header Configuration (No Plug-In)
    - Browser Plugin X-Forwarded-For Header Configuration (No Proxy Chaining)
- Customize Block and Warn Pages
  - Create a Custom Block Page
    - Prerequisites
    - Procedure
  - Create a Custom Warn Page
    - Prerequisites
    - Procedure
  - Allow Users to Contact an Administrator
    - Prerequisites
    - Procedure
  - Add a Custom Logo
    - Prerequisites
    - Procedure
  - Redirect to a Custom Block Page
    - Prerequisites
    - Procedure
  - Block Page IP Addresses
  - Set Up a Block Page Bypass User
    - Prerequisites
    - Procedure
      - Set up Block Page Bypass for an Existing User
      - Set Up Block Page Bypass for a New User
  - Create a Block Page Bypass Code
    - Prerequisites
    - Procedure
    - Delete a Block Page Bypass Code
  - Enable Block Page Bypass in a Policy
    - Prerequisites
    - Procedure
- Manage Tunnels
  - Check Device Compatibility
    - IPsec Tunnel Requirements
    - Supported Devices for Setting Up IPsec Tunnels
    - Unsupported Network Devices for Setting Up IPsec Tunnels
  - Add Network Tunnel Identity
    - Prerequisites
    - Procedure
    - Configure Network Tunnel
    - Verify Tunnel Traffic in Umbrella
    - Add Tunnel to Umbrella Policies
  - Supported IPsec Parameters
    - Supported IPsec Parameters
  - Connect to Cisco Umbrella Through Tunnel
    - Data Centers with Automatic IPsec Failover
    - Data Centers without Automatic IPsec Failover
    - Tertiary/Disaster Recovery Data Centers
  - Monitor Network Tunnel Status
    - Prerequisites
    - Monitor Tunnel Status from Deployments
    - View Number of Active Network Tunnels from Overview Report
    - Cisco Catalyst SD-WAN Layer 7 Health Check
- Network Tunnel Configuration
  - Prerequisites
  - Establish a Tunnel
    - Maximum Transmission Unit (MTU) Size
    - Tunnel Size
    - Client Reachable Prefixes
    - Throughput and Multiple Tunnels
  - Network Tunnel and Secure Web Gateway
    - Transparent Mode
    - Explicit Mode
  - Configuration Guides
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Delete an Account
    - Prerequisites
    - Procedure
  - Change Account Settings
    - Prerequisites
    - Procedure
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-identification
    - Disable De-identification
    - Limitations
- Manage User Roles
  - Add a New User
    - Prerequisites
    - Procedure
  - Add a Custom User Role
    - Prerequisites
    - Procedure
- Manage API Keys
  - Add Umbrella API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Add Umbrella Legacy API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Add Static API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Add KeyAdmin API Keys
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Manage Your Logs
  - Where are Logs Stored?
    - Logging to Umbrella's Data Warehouse
    - Logging to Amazon S3
    - Advantages and Disadvantages to Configuring a Cisco-Managed Bucket
- Manage Authentication
  - Enable Two-Step Verification
    - Prerequisites
    - Procedure
  - Disable Two-Step Verification
    - Prerequisites
    - Procedure
  - Enable Cisco Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Disable Cisco Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Get Started with Single Sign-On
    - Prerequisites
    - How SSO Changes Logging In
  - Enable SSO with Duo
    - Prerequisites
    - Procedure
  - Enable SSO with PingID
    - Prerequisites
    - Procedure
      - Download the PingID XML metadata file:
  - Enable SSO with Okta
    - Prerequisites
    - Procedure
      - Download the Okta XML metadata file:
  - Enable SSO with OneLogin
    - Prerequisites
    - Procedure
      - Download the OneLogin XML metadata file:
  - Enable SSO with Azure
    - Prerequisites
    - Procedure
  - Enable SSO with Other IDPs
- Manage Secure ICAP
  - Prerequisites
  - Secure ICAP Integration
  - Modify an ICAP Server Connection
  - Disconnect from an ICAP Server
- Requirements for Salesforce Tenants for Cloud Malware and SaaS API DLP
  - Salesforce sObjects Supported for SaaS API DLP
  - Install or Update Node.js
  - Install the Salesforce CLI
  - Deploy the Salesforce Quarantine Package to your Salesforce Tenant
  - Log In to Your Salesforce Org
  - Set Permissions in Salesforce
- Manage Cloud Malware Protection
  - Enable Cloud Malware Protection
  - Revoke Authorization for a Platform
  - Enable Cloud Malware Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable Cloud Malware Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable Cloud Malware Protection for Box Tenants
    - Prerequisites
    - Limitations
    - Verify Box Application Settings
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Dropbox Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Google Drive Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Microsoft 365 Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Salesforce Tenants
  - Edit a Salesforce Cloud Malware Tenant
  - Enable Cloud Malware Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable Cloud Malware Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Webex Teams Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
- Manage SaaS API Data Loss Prevention
  - Enable SaaS API Data Loss Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Box Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Dropbox Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Google Drive Tenants
    - Prerequisites
    - Validation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Microsoft 365 Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Salesforce Tenants
  - Enable SaaS API Data Loss Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable SaaS API Data Loss Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Webex Teams Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
Identity Integrations
- Introduction
  - Configure Identity Providers or Manually Import Users and Groups
- Configure SAML Integrations
  - Prerequisites
  - SAML Certificate Renewal Options
    - Automatic Configuration Through the Umbrella Fixed Metadata URL
      - Prerequisites
    - Manual Import of the Umbrella Signing Certificate
  - Configure Azure AD for SAML
    - Prerequisites
      - Bypass Domains from HTTPS Decryption
    - Configure Azure AD
    - Configure Azure for SAML with Azure's Metadata Upload
    - Configure Azure for SAML Manually
  - Configure Okta for SAML
    - Prerequisites
    - Configure Okta for SAML with Metadata Upload
    - Configure Okta for SAML Manually
  - Configure AD FS for SAML
    - Prerequisites
    - Configure ADFS
    - Configure AD FS for SAML in Umbrella with Metadata Upload
    - Configure AD FS for SAML in Umbrella Manually
  - Configure Duo Security for Cisco Umbrella SAML
    - Prerequisites
    - Configure Cisco Duo Single Sign On (SSO) Application
    - Configure Cisco Umbrella for SAML with Metadata Upload
  - Configure PingID for SAML
    - Prerequisites
    - Configure PingID for SAML with Metadata Upload
    - Configure PingID for SAML Manually
  - Configure OpenAM for SAML
    - Prerequisites
    - Configure OpenAM for SAML with Metadata Upload
    - Configure OpenAM for SAML Manually
  - Configure Other IdPs for SAML
    - Prerequisites
    - Configure Your SAML IdP with Metadata Upload
    - Configure Your SAML IdP Manually
  - Enable IP Surrogates for SAML
    - Prerequisites
      - HTTPS Inspection
    - Map Tunnels to Sites
    - Enable IP Surrogates
    - Add a New IP Surrogate Bypass
    - Delete an IP Surrogate Bypass
    - View Identities in Activity Search
  - Configure SAML for Multiple EntityIDs
    - Prerequisites
    - Configure SAML for Multiple EntityIDs with Metadata Upload
    - Configure SAML for Multiple EntityIDs Manually
- Provision Identities from Active Directory
  - Prerequisites for AD Connectors
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Configure Authentication for AD Connectors and VAs
    - How to Set Up Your API Credentials
    - Prerequisites
    - Procedure
      - Step 1 – Create the Key Admin API Key Credentials
      - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
  - Configure Updates on AD Connector
    - Prerequisites
    - Procedure
  - Connect Active Directory to Umbrella
    - How to Configure the Setup of the AD Connector
    - Prerequisites
    - Register a Domain Controller or Domain in the Umbrella Dashboard
      - Register a Domain Controller
      - Register a Domain
    - Specify AD Groups of Interest (Optional)
      - Rename Selective Sync File After Upgrading to AD Connector v1.14.4
      - Create AD Groups in a Selective Sync File
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Deploy LDIF Files for AD Connector
    - Best Practices for LDIF Source Deployments
    - Requirements
    - Known Limitations
    - Prerequisites
    - Procedure
      - Step 1 – Download the Cisco AD Connector
      - Step 2 – Install the Cisco AD Connector
      - Step 3 – Deploy the LDIF Source Files
    - Verify the Connector Syncs with Umbrella
    - Troubleshooting
      - Scenario 1
      - Scenario 2
      - Scenario 3
      - Scenario 4
      - Analyze Logs
  - View AD Components in Umbrella
    - Prerequisites
    - Procedure
  - Connect Multiple Active Directory Domains to Umbrella
  - Change the Connector Account Password
    - Prerequisites
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
- Provision Identities Through Manual Import
  - Prerequisites
    - CSV File Structure
    - CSV File Fields
  - Procedure
- Provision Identities from Microsoft Entra ID
  - Prerequisites
  - Limitations
  - Procedure
  - Configure Cisco User Management Connector App in Microsoft Entra ID
    - Supported Attributes for Users
    - Supported Attributes for Groups
  - Configure Guest Users
  - View Users and Groups in Umbrella
- Provision Identities from Okta
  - Prerequisites
  - Limitations
  - Supported Features
  - Import the ObjectGUID Attribute from Okta
  - Configure the Cisco User Management Connector App
  - Troubleshooting
- Active Directory Integration with Virtual Appliances
  - Network Diagram for VA Deployments
Reports
- Get Started with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
    - Prerequisites
    - Procedure
  - Report Retention
    - Admin Audit Log Retention
- Schedule Reports
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Unsubscribe From a Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Overview Report
  - Message Center
  - Deployment Health
  - Network Request Breakdown
    - DNS Requests
    - Total Web Requests
  - Firewall Breakdown
  - Security Categories
  - App Discovery and Control
  - Security Requests
  - File Retrospective
- Security Activity Report
  - View Activity and Details by Filters
    - Prerequisites
    - Procedure
  - View Activity and Details by Event Type or Security Category
    - Prerequisites
    - Procedure
      - Group Security Categories
  - View an Event's Details
    - Prerequisites
    - Procedure
  - Search for Security Activity
    - Prerequisites
    - Procedure
      - Advanced Search
- Activity Search Report
  - Prerequisites
  - Limitations
  - View the Activity Search Report
    - Configure Columns to Display
  - View Actions
    - See Full Details
    - Filter Views
    - Investigate View
  - Save Activity Search Report Columns and Filters for Future Use
  - Schedule an Activity Search Report
- App Discovery Report
  - Prerequisites
  - View the Dashboard
- Top Threats Report
  - Threat Type Details
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Total Requests Report
  - Prerequisites
  - View Trends in the Total Requests Report
- Activity Volume Report
  - Prerequisites
  - View Requests by Volume of Activity
  - View Activity Volume by Security Categories
    - Prevent
    - Contain
    - Integrations
  - View Activity Volume by Policy Traffic
  - View Trends
- Top Destinations Report
  - Prerequisites
  - View the Top Destinations Report
    - Report Fields
  - View Further Details
- Top Categories Report
  - Prerequisites
  - Top Categories Quick View
  - View the Top Categories Report
    - Report Fields
    - Sort by Traffic
    - Ascending or Descending Order
  - View Category in Other Reports
- Top Identities Report
  - Prerequisites
  - View the Top Identities Report
    - Report Fields
  - View Identity in Other Reports
- Admin Audit Log Report
  - Prerequisites
  - Generate Admin Audit Log Report
- Cloud Malware Report
  - View the Cloud Malware Report
  - Use the Cloud Malware Report
    - View Detailed Information About a File
    - Quarantine a Malicious File
    - Restore a Quarantined File
    - Delete a Malicious File
    - Dismiss an Item from the Report
- Data Loss Prevention Report
  - View Events
    - View Details
    - Delete File
    - Quarantine File
    - Restore File from Quarantine
    - Use Advanced Search
  - Discovery
    - Prerequisite
    - View a Discovery Scan
- Third-Party Apps Report
  - Prerequisites
  - View the Third-Party Apps Report
  - Use Search
  - Use Advanced Search
  - Export the Third-Party Apps Report
Manage Roaming Client
- Introduction
  - How the Roaming Client Works
  - Benefits of the Umbrella Roaming Client
  - VPN Support
  - Antivirus and Endpoint Security Software Support
  - Prerequisites
    - Operating System
    - Transport Layer Security Protocol
    - Network Access
    - Software
    - Internal Domains
- Download and Install the Roaming Client
  - Single Machine or Manual Installation
  - Distributed or Automated Installation
- Configure DNS Policies for Roaming Computers
  - Step 1: Create an On-network Policy
  - Step 2: Create an Off-network Policy
  - Step 3: Order your Policies Correctly
- Identity Support for the Roaming Client
  - Prerequisites
  - On-Premises Identity
  - Procedure
  - Prerequisites for AD Integration
  - Configure Identities on macOS
  - LAN IP Address Reporting Only—No AD integration
  - Enhanced Roaming Client UI
  - AnyConnect Umbrella Roaming Security Module UI
  - Identity Support in Umbrella Policies
  - Identity Support in Umbrella Reports
    - View Traffic in Umbrella
  - What Information is Sent to Cisco Umbrella and When
    - AD Directory Structure
    - AD User ID
    - User Group
    - LAN IP Address
    - Device ID
- Status, States, and Functionality
  - Status in the Umbrella Dashboard
  - Roaming Computer Information
    - Tray Icon Status
      - Status Indicators
    - Probes
      - Encrypted Probe
      - Unencrypted Probe
      - Virtual Appliance + Protected Network Probe
    - Advanced: Network Access per Service
    - Advanced: How the Umbrella Roaming Client Changes States
- Virtual Appliances
  - Behavior
- Troubleshooting
  - Scenarios
    - Did the Umbrella Roaming Client not Install?
    - Unable to Resolve Internal Resources
    - Installations Failures
    - Unregistered Umbrella Roaming Clients
    - Unprotected/Unencrypted
    - Switching States or Statuses Frequently (Flapping)
  - Logs
  - Diagnostic Tool
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DHCP/Static DNS Servers
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computers Settings
  - Prerequisites
  - Procedure
    - General Settings
    - Client Settings
      - Secure Client Settings
      - Umbrella Roaming Client Settings
    - Backoff Settings
      - DNS Backoff Settings
      - Secure Web Gateway Backoff Settings
- Encryption and Authentication
  - Concepts
  - DNSCrypt
  - DNSCrypt Versus DNSSEC
  - Encryption and Authentication
  - Encrypted State
  - Unencrypted State
- Command-line and Customization for Installation
  - Prerequisites and Instructions
  - Parameters
    - Windows
      - Required Parameters
      - Optional Parameters
    - macOS
      - Optional Parameters
        
        Deploy Through the Command Line
        
        Windows
        
        macOS
- Remote Logging and Diagnostics
  - Objective
  - Privacy
  - Logs
  - The Diagnostic Tool
- macOS Mobile Device Management
  - Prerequisites
  - Register to an Organization
  - Change Organizations
  - Add a User Identity
Umbrella Roaming Security: Cisco Secure Client
- Introduction
- Umbrella Roaming Security: Cisco Secure Client (formerly AnyConnect)
  - Prerequisites
    - System Requirements
      - Unsupported Operating Systems
    - Network Requirements
    - Roaming Client Prerequisites
  - Deploy Umbrella module in Cisco Secure Client
    - Manual Installation of Cisco Secure Client (Windows and macOS)
    - Mass Deployment Overview
    - Contents
    - Remote Installation
      - Profile Installation
      - Customization Options
    - Mass Deployment (Windows)
    - (Optional) Package Customization
      - Add Umbrella Profile
    - Automated Installation (Windows)
      - Install Cisco Secure Client
      - Install the Umbrella Profile
      - (Optional) Disable VPN Functionality (Post installation)
    - Customize Windows Installation of Cisco Secure Client
      - Procedure
        
        Deploy the Cisco Secure Client VPN Module
        
        Deploy the Cisco Secure Client Umbrella Roaming Security Module
        
        (Optional) Deploy Cisco Secure Client DART
        
        Hide Cisco Secure Client Modules from Add/Remove Programs List
      - Optional OrgInfo.json Parameter Configurations
    - Mass Deployment (macOS)
    - Contents
      - (Optional) Package Customization
        
        Add Umbrella Profile
        
        (Optional) Disable VPN Functionality
        
        Save the .dmg image
      - Automated Installation (macOS)
        
        Installation (Pre-Deployment Package)
        
        Installation (Web Deployment Package)
        
        Install Umbrella Profile
        
        (Optional) Disable VPN Functionality (Post-Installation)
        
        Allow Secure Client System Extensions
    - Customize macOS Installation of Cisco Secure Client
      - Procedure
      - Step 1 – Make the .dmg Package Writeable
      - Step 2 – Generate the Module Installation Configuration File
      - Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
      - Step 4 – (Optional) Hide the VPN Module
      - Step 5 – Customize the Cisco Secure Client Installation Modules
        
        Sample Customization
      - Step 6 – Set Up the Correct Extension Permission Settings
      - Step 7 – Install Secure Client with Selected Modules
      - Optional OrgInfo.json Parameter Configurations
    - VPN Headend Deployment
    - Secure Firewall Management Center and Secure Firewall Threat Defense
      - Prerequisites to provision the Umbrella Module
      - Procedure to enable Secure Client Umbrella Module in Management Center and Threat Defense
      - (OPTIONAL) VPN Local Authentication (Management Center 7.0 or later required)
    - Migration from Umbrella Roaming Client
    - Install the Root Certificate
    - Automatic Updates
    - Cloud Management
      - Contents
      - Overview
      - Deploying Cisco Secure Client
      - Profiles
      - Uploading the Orginfo.json profile
      - Create a Deployment
      - Post Deployment
        
        Additional Reference
      - Additional References
      - Remote Monitoring and Management Deployment Tutorials
  - Meraki Systems Manager (SM) Deployment
  - Enable the Umbrella SWG Agent
  - DNS Protection Status
    - Prerequisites
    - Procedure
    - DNS Protection Status Descriptions
  - SWG Protection Status
    - Prerequisites
    - Procedure
    - Secure Web Gateway Status Descriptions
  - Interpret Diagnostics
- Active Directory Policy Enforcement and Identities
  - Procedure
  - macOS User Identity
- Virtual Appliances
  - Behavior
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computer Settings
  - Procedure
  - General Settings
  - Client Settings
    - Secure Client Settings
      - Umbrella Roaming Client Settings
  - Backoff Settings
    - DNS Backoff Settings
    - Secure Web Gateway Backoff Settings
Manage Virtual Appliance
- Introduction
  - How Umbrella Virtual Appliances Work
  - Benefits of Virtual Appliances
- Deploy Virtual Appliances
  - Configure Authentication for Virtual Appliances
    - How to Set Up Your API Credentials
    - Prerequisites
    - Procedure
      - Step 1 – Create the Key Admin API Key Credentials
      - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
      - Recreate API Key Credentials for Authentication
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - 1. Download and Extract the Hyper-V Installer
    - 2. Import the Virtual Appliance
    - 3. Copy and Rename Image Files
    - 4. Select Network Adapter
    - 5. Select Hard Drive
    - 6. Power on the Virtual Machine
    - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Step 1: Download OVF Template
    - Step 2: Deploy OVF Template
    - Step 3: Deploy a Second Virtual Appliance
    - Step 4: Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
    - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - 1. Prepare the Virtual Appliance Amazon Machine Image
    - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - Prepare the Virtual Appliance Instance Template on GCP
    - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
      - 1. Create the qcow2 files for KVM
      - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
  - Deploy VAs in Alibaba Cloud
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Download and Extract the Hyper-V Installer
    - Alibaba Cloud Setup
      - Procedural Overview
      - Create an Alibaba Virtual Private Cloud (VPC)
      - Create a Bucket for the Umbrella VAs
      - Configure a ZIP Package Decompression Rule
      - Upload the Umbrella VHD Images to the OSS Bucket
    - Create a Custom Image
    - Deploy the Umbrella VAs from the Imported Custom Image
      - What to do Next
    - First-time Login to Umbrella VA
      - Related Topics
      - Dual-NIC Support on the VA
      - IP Addressing
        
        General Guidelines
        
        Support for IPv6 Addressing
      - Anycast Configuration Support
      - DNS Performance on Alibaba ECS Instances
      - Extensions on Alibaba ECS Instances
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Prerequisites
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is an Umbrella Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Umbrella Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Umbrella Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Support Tunnel From the VA
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on Azure Platforms
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on non-Azure Platforms
  - Troubleshoot DNS Resolution in Configuration Mode
  - Troubleshoot DNS Resolution Failures Behind a Firewall
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure Umbrella Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Anycast
        
        Configure Anycast over BGP on the VA
        
        Configure Load Balancing
        
        Configure Identity Association Timeouts
        
        Configure API Key Credentials for Authentication
        
        Configure the Client ID and Client Secret
Sites and Internal Networks
- Internal Networks Setup Guide
  - Set Up Internal Networks
- Provision a Subnet for Your Virtual Appliance
  - Prerequisites
  - Procedure
  - Add an Internal Network and Sites
- Manage Sites
  - Prerequisites
  - Before You Begin
  - Procedure
- Manage Internal Networks
  - Prerequisites
  - Before You Begin
  - Internal Network Associations
  - Procedure
  - Apply Policies to Internal Network
- Assign a DNS Policy to Your Site
Managed iOS Device
- Cisco Security Connector: Umbrella Setup Guide
  - Requirements
    - Optionally
  - Getting Started
- Meraki Registration
  - Prerequisites
  - Procedure
  - Verify Push of Profile Config
  - Anonymize Your Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
  - Verify Umbrella with Meraki
  - Meraki Documentation
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS device
  - Install Umbrella Root Certificate
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Register an iOS Device Through a Generic MDM System
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Apply a DNS Policy to Your Mobile Device
  - Prerequisites
  - Procedure
    - Policy > Security Settings
    - Policy > Passive Reporting Mode
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Anonymize Devices
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Prerequisites
  - Generate Diagnostics and Email the Umbrella Reports
  - Generate Diagnostics and Share the Umbrella Reports
- Push the Umbrella Certificate to Managed Devices
  - Prerequisites
  - Procedure
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Install Umbrella Root Certificate
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access User Identities on the Umbrella Dashboard
    - Configure DNS Policy
    - Monitor User Activity
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Is this a VPN to Umbrella?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Unmanaged Mobile Device Protection
- Umbrella Unmanaged Mobile Device Protection
- Administrator Actions
  - Prerequisites
  - Procedure
- End-User Actions
  - Android
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment
    - Enrollment by QR code
    - Enrollment without Camera Access
    - Registration and Activation
  - iOS
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment by Link
    - Enrollment by QR code
    - Registration and Activation
Cisco Security for Chromebook Client
- Get Started
  - Policies
- Migration Scenarios
- Prerequisites
- Limitations
- Google Workspace Identity Service
- Integrate Google Workspace Identities
- Deploy the Chromebook Client
  - DNS Layer Protection
  - SWG Layer Protection
  - Deploy Cisco Security for Chromebook Client
    - Umbrella Dashboard
    - Google Admin Console
      - Configure Default Template
      - Configure Managed Guest Session Template
- Protection Status
  - Umbrella Security for Chromebook Client States
- Chromebook-Specific DNS Policy
  - Prerequisites
  - Procedure
- Chromebook-Specific Web Policy
  - Prerequisites
  - Procedure
- Chromebook Client - FAQs
- Google Workspace Identity Service FAQs
Hardware Integration
- Integration for ISR 4K and ISR 1100 – Security Configuration Guide
  - Create a Legacy Network Devices API Token
- Wireless LAN Controller Integration
  - Prerequisites
  - Terminology
  - Wireless LAN Controller Setup and DNS Request Flow
  - Configure the Wireless LAN Controller Integration
  - Sample Wireless LAN Controller Deployments
    - Scenario 1: Configure Local Policies for Cisco Umbrella
      - Setup
    - Scenario 2: Configure WLAN or AP Group for Cisco Umbrella
      - Setup
    - OpenDNS WLAN configuration modes
  - Cisco Umbrella Activity Reporting
  - Cisco Umbrella Support
  - Cisco Umbrella Limitations
- Meraki Cloud-Managed Networks and Umbrella DNS
  - Integrate Meraki with Cisco Umbrella
  - Configure Meraki to Use Cisco Umbrella
- Mobility Express Integration
  - Prerequisites
  - Deploy the Integration
- Cisco SD-WAN Powered by Catalyst SD-WAN and Umbrella
  - Prerequisites
  - Limitations
  - Configure Umbrella and Cisco Catalyst SD-WAN
    - Authorization: Cisco Catalyst SD-WAN (vManage) Version 19.2/IOS-XE 16.12 and Earlier
    - Authorization: vManage Version 20.1 and Later
    - Insert Authorization Data
- Integration for RV-series Routers
  - Prerequisites
  - Integration
  - Limitations and Restrictions of the Cisco Umbrella Integration
- Cisco Catalyst 9200 and Catalyst 9300 Switches
  - Prerequisites
    - For Active Directory integration on the Catalyst 9200 and 9300 switch:
- Cisco DNA Center
- Cisco Secure Firewall
  - Prerequisites
  - Limitations
  - Configure the Umbrella Connection
  - Create and Manage Umbrella DNS Policies
Cisco Adaptive Security Appliances (ASA)
- Integration for ASA Overview
  - Prerequisites
    - Licensing
    - Hardware and Software
    - Network Access
- Import the Digicert Certificate Authority
  - Prerequisites
  - Procedure
- Configure the Umbrella Connector
  - Prerequisites
  - Obtain Your API Token
  - Configure Umbrella Global Settings
  - Enable Umbrella in the DNS Inspection Policy
- Monitor the Umbrella Connector
  - Monitor Umbrella Syslog Messages
- Delete an ASA
  - Prerequisites
  - Delete the Umbrella Configuration
  - Remove the ASA From the Dashboard
    - Ensure that the ASA is Removed
Investigate
- Manage Umbrella Investigate
  - Getting Started with Investigate
  - Conduct a Pattern Search
  - Manage the Investigate Only User Role
  - About Passive DNS
  - About Investigate View Types
  - Create Investigate API Keys
  - About the Investigate Domain Summary
    - About Investigate Passive DNS Timeline
      - DNS Query Volume
      - Event History
    - Dispute a Content Categorization
      - Submit Categorization Request Through Cisco Talos
      - Submit Categorization Request Through Investigate
    - About DNS Resolution in Investigate
      - IP Addresses
      - Nameserver (NS)
      - DNS (Others)
    - About Associated Samples in Investigate
    - About the Subdomains Tab in Investigate
    - About Related Domains in Investigate
    - About the Geographic Distribution View in Investigate
    - About the Sample View in Investigate
      - Prerequisites
      - Get Started With Sample View
      - Sample View Details
        
        Components of a Threat Sample
      - Behavioral Indicators
      - Network Connections
      - Associated Samples
      - Associated Artifacts (Secure Malware Analytics Integration)
    - About the IP Address View in Investigate
      - Summary
      - DNS Resolution
      - Autonomous Systems
      - Associated Samples
      - Recent Detections
  - About WHOIS Record Information
    - About the WHOIS Nameserver View
    - WHOIS Data – FAQ
  - About the ASN View
    - Prerequisites
    - Current Information
    - Current Routes
    - Research AS From IP Address View

Cisco Umbrella SIG User Guide Manage IPS

Last updated: Dec 07, 2025

Previous topic Check Protocol in the Firewall Logs Next topic How IPS Works