Order of Fields in the IPS Log

Login

Cisco Umbrella SIG User Guide

Cisco Umbrella SIG User Guide
- Welcome to Cisco Umbrella
  - Start Protecting Your Systems
  - Find Your Organization ID
  - Determine Your Current Package
  - Umbrella Policies Overview
    - Traffic Flow Through Umbrella
    - How Umbrella Applies Policies
    - DNS Policy
    - Firewall Policy (CDFW)
    - Web Policy (SWG)
    - Data Loss Prevention (DLP) Policy
  - SWG Data Centers
  - Reserved IP
    - Deployment
    - Reporting
    - Configuration
    - Remote Browser Isolation
    - Reserved IP Surrender
    - Port Exhaustion
    - Maximum Sessions
    - Troubleshooting
    - Region of Data Centers
  - Reserved IP Supplemental Terms
  - Reserved IP Supplemental Terms - Archived
  - View Cloud Security Service Status
    - Cloud Security Platforms
      - Service Status Types
      - Cisco Umbrella
      - Cisco Secure Connect
      - Cisco Cloudlock
    - Scheduled Maintenance
    - Past Incidents
  - Contact Cisco Umbrella Support
  - Password Policy FAQs
- Get Started
  - Set Up DNS-Layer Security
    - Step 1: Add a Network Identity
    - Step 2: Configure Your DNS Settings
    - Step 3: Set Up Clients, Network Devices, and Virtual Appliances (Optional)
      - Set Up an Umbrella Roaming Client or AnyConnect Roaming Security Module
      - Set Up an Umbrella Mobile Client App
      - Set Up a Network Device
      - Set Up a Chromebook Client
      - Set Up a Virtual Appliance
    - Step 4: Add a DNS Policy
    - Step 5: Test Your DNS Policies
  - Point Your DNS to Cisco Umbrella
    - Anycast IP Addresses
      - Step 1 – Find out where your public DNS server addresses are configured
      - Step 2 – Log into the server or router where DNS is configured
      - Step 3 – Change your DNS server addresses
      - Step 4 – Test Your New DNS Settings
  - Set Up Web Security
    - Step 1: Add a Network Identity (Optional)
    - Step 2: Set Up an IPsec Tunnel (Recommended)
    - Step 3: Set Up a PAC File, Proxy Chaining, or Roaming Computers
      - Set Up a PAC File
      - Set Up Proxy Chaining
      - Set Up AnyConnect Umbrella Roaming Security Module (Recommended)
    - Step 4: Add DNS, Web, and Firewall Policies
    - Step 5: Test Your DNS and Web Policies
  - Configure the Secure Web Gateway
    - Umbrella Intelligent Proxy
    - Umbrella Secure Web Gateway
    - Web Security Best Practices
  - Uninstalling Umbrella
- Umbrella Integration with Secure Web Appliance
  - Known Limitations
  - Known Behavior
  - Add an API Key and Key Secret
  - Register Secure Web Appliance with Umbrella
  - Hybrid Policy
  - Hybrid Reporting
  - Configure Web Policies and Destination Lists
    - Configure Ruleset Identities of Web Policy
    - Configure Web Policy Rules
    - Configure Destination Lists
    - Configure Application Settings
    - Configure HTTPS Inspection Policies
    - Configure Active Directory (AD) Users and Groups
    - Configure Microsoft 365 Compatibility
  - Policy Features
- Limitations and Range Limits
  - Data Retention
  - Average Bandwidth
- Manage Identities
  - Add a Network Identity
    - Prerequisites
    - Procedure
      - Step 1 – Select the Appropriate Network
      - Step 2 – Set up the Network Identity
        
        Dynamic IP Address—IPv4 Only
      - Step 3 – Change the DNS Settings on Your Relevant Network Device
      - Step 4 – Test Your Network
  - Delete a Network Identity
    - Prerequisites
    - Procedure
  - Identity and SIG Deployment
  - Add a Network Device
    - Prerequisites
    - Procedure
      - Step 1: Create a Network Devices API Key
      - Step 2: Register a Network Device
      - Step 3: Add Network Device to a DNS Policy
      - Step 4: Test Your Network Device Integration
  - Delete a Network Device
    - Prerequisites
    - Procedure
  - Find the Total Number of Identities in Your Organization
    - Prerequisites
    - Find the Total Number of Networks
    - Find the Total Number of Roaming Clients
    - Find the Total Number of Other Identity Types
- Manage Domains
  - Add Internal Domains
    - Prerequisites
    - Procedure
  - Add External Domains and IPs
    - Prerequisites
    - Procedure
  - Bulk Upload External Domains and IPs
  - Wildcards and Domain Management
    - Known Limitations
- Manage DNS Policies
  - Add a DNS Policy
    - Prerequisites
    - Part One—Set up the Policy Wizard
    - Part Two — Configure the Policy
      - 1. Configure Security Settings
      - 2. Configure Content Category Settings
      - 3. Configure Application Settings
      - 4. Configure Destination Lists
  - Test a DNS Policy
    - Prerequisites
    - Procedure
  - DNS Policy Settings
    - Umbrella DNS Policy Settings
  - DNS Policy Precedence
    - Match an Identity and Destination to a Policy
      - Identities without Active Directory Integration
      - Identities with Active Directory Integration
      - DNS Policy without Virtual Appliance
      - DNS Policy with Virtual Appliance
    - Configure Policy Order
    - Identity Combinations
    - Policies and Block Page Bypass Settings
  - Best Practices for DNS Policies
  - Enable SafeSearch for DNS Policies
    - Test Google, Youtube, and Bing
    - Test Through a Lookup From the Command Line
  - Group Roaming Computers with Tags
    - Prerequisites
    - Procedure
      - DNS Policies
- Manage the Web Policy
  - Add a Ruleset to the Web Policy
    - Prerequisites
    - Procedure
  - Add Rules to a Ruleset
  - Test the Web Policy
    - Before You Start
    - Procedure
      - Results
  - Web Policy Precedence
    - Web Policy Rulesets
      - Add Identities to a Ruleset
      - Configure Security Settings
      - Set Up Rulesets
      - Match an Identity to a Ruleset
      - Active Directory User Identity Source
    - Web Policy Rules
      - Add Destinations
      - Define Actions
      - Apply Web Policy Rule
  - Best Practices for the Web Policy and Rulesets
  - Manage Global Settings
    - Certificate Error Handling
    - Microsoft 365 Compatibility
      - Tenant Controls
      - Limitations
      - Procedure
    - Protected Files Bypass
      - How Protected Files Bypass is Enabled and Disabled
      - Procedure
    - PAC Files
      - Prerequisites
      - Procedure
        
        Copy the Umbrella PAC File
        
        Download the Umbrella PAC File
        
        Edit the PAC File
  - Confirm SafeSearch for a Web Policy Ruleset
    - Google
    - YouTube
    - Yahoo
    - Bing
  - Understand Isolated Destinations
    - Prerequisites
      - Umbrella Prerequisites
      - Browser Prerequisites
    - Umbrella Package RBI Add-Ons
    - Limitations of Isolation
    - Expired or Downgraded Add-Ons
  - Monitor Bandwidth Usage in the App Discovery Report
    - Prerequisites
    - Procedure
- Manage the Data Loss Prevention Policy
  - Add a Real Time Rule to the Data Loss Prevention Policy
    - Prerequisites
    - Procedure
  - Understand Exclusions in a Real Time Rule
  - Supported Applications
  - Add a SaaS API Rule to the Data Loss Prevention Policy
  - Discovery Scan
    - Prerequisites
    - Initiate a Discovery Scan
    - Cancel a Discovery Scan
  - Edit a Data Loss Prevention Rule
    - Prerequisites
    - Procedure
  - Delete a Data Loss Prevention Rule
    - Prerequisite
    - Procedure
  - Enable or Disable a Data Loss Prevention Rule
    - Prerequisites
    - Disable a Rule
    - Enable a Rule
  - Supported File and Form Types
- Manage the Firewall Policy
  - Add a Firewall Rule
    - Prerequisites
    - Procedure
    - Network Tunnel Identity
    - Firewall Rule Settings
  - Add an FQDN List to a Firewall Rule
    - Prerequisites
    - Limitations
    - Procedure
  - Delete a Firewall Rule
    - Prerequisites
    - Procedure
  - Configure IPS Settings for Firewall Policy
    - Prerequisites
    - Procedure
  - Change a Firewall Priority
    - Prerequisites
    - Procedure
  - Monitor Hit Count
    - Prerequisites
    - Procedure
  - Edit Hit Count
    - Prerequisites
    - Reset or Refresh the Hit Count
    - Configure the Hit Count Interval for a Firewall Policy
  - Review Firewall Logs in Reports
    - View Firewall Logs in Activity Search
    - View CDFW Events in the App Discovery Report
  - Check Protocol of Firewall Traffic
    - Prerequisites
    - Check Protocol in the Activity Search Report
    - Check Protocol in the Firewall Logs
- Manage IPS
  - Add a Custom Signature List
    - Prerequisites
    - Procedure
    - Reset a Signature's Action
  - Delete a Custom Signature List
    - Prerequisites
    - Procedure
  - Reset a Signature's Action
    - Prerequisites
    - Procedure
- Manage Security Settings
  - Add a DNS Security Setting
    - Prerequisites
    - Procedure
  - Add a Web Security Setting
    - Prerequisites
    - Procedure
  - Dispute a Security Categorization
    - Prerequisites
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - DNS Security Categories
    - Security Categories
    - Integrations Sub-Category
  - Web Security Categories
  - Third-party Security Integrations
  - Set Up Custom Integrations
    - Prerequisites
      - Additional Prerequisites for Cisco AMP Threat Grid
    - Create a Custom Integration URL
    - Enable Third-Party Platform Integration
    - Verify Custom Integration
      - View Threat Events In Umbrella
      - View Threat Events Through the Umbrella Enforcement API
      - View Admin Audit Log
    - Logging and Reports
      - View Reports
      - Access Logs in S3
  - Custom Integration Best Practices
    - Known Domains and Destination Lists
    - Benefits of Custom Destination Allow List
    - Add a Destination List
    - Delete a Domain from Custom Destination Block List
- Manage Content Categories
  - Add a DNS Content Category Setting
    - Prerequisites
    - Procedure
  - Legacy DNS Content Category Definitions
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Categories Definitions
  - DNS Content Categories
    - Levels of Categorization
      - High, Moderate, and Low Category Levels
      - Custom Category Level
    - Content Categories Definitions
  - DNS Content Category Changes
    - Legacy Content Category Changes
    - New Content Categories
  - Add a Web Content Category Setting
    - Prerequisites
    - Procedure
  - Web Content Categories
  - Web Content Category Name Changes
    - Web Content Category Name Changes
    - New Web Categories
  - Migrate Content Categories
    - Prerequisites
    - Procedure
  - Dispute a Content Categorization
    - Submit Categorization Request Through Cisco Talos
    - Submit Categorization Request Through Umbrella
  - View Content Categories in Reports
    - Prerequisites
    - View Content Categories in Activity Search Report
    - View Content Categories in Top Threats Report
    - View Content Categories in Total Requests Report
    - View Content Categories in Activity Volume Report
    - View Content Categories in Top Destinations Report
    - View Content Categories in Top Categories Report
    - View Content Categories in Top Identities Report
- Manage Data Classifications
  - Create a Data Classification
    - Built-In Identifiers
    - Machine Learning Identifiers
    - Custom Identifiers
    - Exact Data Match Identifiers
    - Indexed Document Match Identifiers
    - Prerequisites
    - Procedure
  - Copy and Customize a Built-In Data Classification
    - PII Data Classification
    - PCI Data Classification
    - GDPR Data Classification
    - HIPAA Data Classification
    - Prerequisites
    - Procedure
  - Delete or Edit a Classification
    - Prerequisites
    - Delete a Classification
    - Edit a Classification
  - Create an Exact Data Match Identifier
    - Prerequisites
    - Procedure
  - Index Data for an EDM
    - Prerequisites
    - Run the DLP Indexer to Create an EDM Identifier
    - Update the Indexed Data Set Periodically
    - Troubleshooting
  - Exact Data Match Field Types
    - Supported EDM Types
  - Create an Indexed Document Match Identifier
    - Prerequisites
    - Limitations
    - Create an Indexed Document Match Identifier
    - Monitor the Indexed Data Set and Re-Index as Needed
    - Troubleshooting
  - Built-In Data Classifications
- Built-In Data Identifiers
  - Copy and Customize a Data Identifier
    - Prerequisites
    - Procedure
  - Create a Custom Dictionary
  - Create a Custom Identifier
    - Prerequisites
    - Procedure
  - Custom Regular Expression Patterns
    - Limitations
      - General
      - Regex Syntax
      - Regex Breadth
      - Word Boundary
  - Individual Data Identifiers
    - Drug Name
    - Health Condition
    - ICD-10 Code
    - US Person Name
- Manage Application Settings
  - Add a DNS Application Setting
    - Prerequisites
    - Procedure
  - Add a Web Application Setting
    - Prerequisites
    - Procedure
  - Delete an Application Setting
    - Prerequisites
    - Procedure
  - Application Categories
    - Category Descriptions
  - Manage Advanced App Controls
    - Prerequisites
    - Control Apps in the Policy Application Settings
    - Control Apps in a Web Policy Rule
    - Apps with Advanced App Controls
    - Troubleshooting
- Manage Tenant Controls
  - Control Cloud Access to Microsoft 365
    - Prerequisites
    - Procedure
  - Control Cloud Access to Google G Suite
    - Prerequisites
    - Limitations
    - Procedure
  - Control Cloud Access to Slack
    - Prerequisites
    - Procedure
  - Control Cloud Access to Dropbox
    - Prerequisites
    - Procedure
  - Control Access to ChatGPT
  - Review Tenant Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Destination Lists
  - Add a DNS Destination List
  - Add a Web Destination List
  - Add a SAML Bypass Destination List
    - Prerequisites
    - Procedure
  - Edit a Destination List
    - Prerequisites
    - Procedure
  - Add Destinations in Bulk
    - Prerequisites
    - Procedure
  - Download Destinations to a CSV File
    - Prerequisites
    - Procedure
  - Control Access to Custom URLs
    - Prerequisites
      - Enable the Intelligent Proxy—DNS Policy Only
      - Install a Root Certificate
    - Block a URL
      - URL Normalization
      - URL Normalization for Destination Lists
      - Troubleshooting Unblocked URLs
      - Reporting for Blocked URLs
    - Examples
    - Contact Support
  - Wildcards and Destination Lists
  - Add Top-Level Domains To Destination Lists
    - Prerequisites
    - Procedure
  - Add Punycode Domain Name to Destination List
    - What is Punycode?
    - Examples of Unicode and Punycode Encoded Strings
  - Test Your Destinations
  - Search for a Destination List
  - Troubleshoot DNS Destination Lists
    - DNS Destination Lists and Common Error Conditions
- Manage File Analysis
  - Enable File Inspection for DNS Policies
    - Prerequisites
    - Procedure
  - Enable File Inspection for the Web Policy
    - Prerequisites
    - Procedure
  - Enable Cisco Secure Malware Analytics (Threat Grid)
    - Umbrella's Secure Malware Analytics (Threat Grid) Integration
      - Monitor and Review Secure Malware Analytics (Threat Grid) Malware Analysis
      - Supported Files
    - Secure Malware Analytics (Threat Grid) Sandbox
    - Prerequisites
    - Procedure
  - Test File Inspection
    - Prerequisites
    - Procedure
      - Block Page Diagnostic Information
  - Troubleshoot File Inspection
    - Help
- Manage File Type Control
  - Enable File Type Control
    - Prerequisites
    - Procedure
      - File Type Control Outcomes Through Rule Actions
  - File Types to Block
  - Review File Type Controls Through Reports
    - Prerequisites
    - Procedure
- Manage Selective Decryption
  - Add a Web Selective Decryption List
    - Prerequisites
    - Procedure
  - Enable Certificate Error Handling
    - Prerequisites
    - Procedure
      - Step 1: Enable the Certificate Error Handling button
      - Step 2: Add a Domain
- Manage Schedule Settings for the Web Policy
  - Add a New Schedule Setting for the Web Policy
    - Prerequisites
    - Procedure
- Manage Certificates
  - Install the Cisco Umbrella Root Certificate
    - Prerequisites
    - Automatically Install the Cisco Umbrella Root Certificate (For an Active Directory Network)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Microsoft Management Console (MMC)
      - Install the Cisco Umbrella Root Certificate with Group Policy Using the Group Policy Management Console (GPMC)
      - Install the Cisco Umbrella Root Certificate in Firefox Using Group Policy
      - Install the Cisco Umbrella Root Certificate on Chromebooks Using the Google Admin Console
    - Manually Install the Cisco Umbrella Root Certificate (Single Computer)
      - Install the Cisco Umbrella Root Certificate in Edge or Chrome on Windows
      - Install the Cisco Umbrella Root Certificate in Firefox on Windows
      - Install the Cisco Umbrella Root Certificate in All Browsers on Mac OS X
      - Install the Cisco Umbrella Root Certificate on Mac OS X Through the Command Line
      - Install the Cisco Umbrella Root Certificate in Chromium or Chrome on Linux
  - Add Customer CA Signed Root Certificate
    - Web Policies
    - DNS Policies
    - Prerequisites
      - Certificate Requirements
    - Install Root Certificate in Browsers
    - Procedure
  - Delete Customer CA Signed Root Certificate
    - Prerequisites
    - Procedure
  - View Cisco Trusted Root Store
    - Prerequisites
    - Before You Begin
    - Extract the Certificates
      - Step 1: Extract the Signing Certificate
      - Step 2: Extract Certificate Bundle as Message
      - Step 3: Extract PEM-Formatted Certificates From Bundle
      - Step 4: Generate Individual Certificate Files
        
        Linux
        
        macOS
    - View an Individual Certificate File
- Manage the Intelligent Proxy
  - Enable the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test the Intelligent Proxy
    - Prerequisites
    - Procedure
  - Test Selective Decryption
    - Prerequisites
    - Procedure
  - Review the Intelligent Proxy Through Reports
    - Prerequisites
    - Procedure
  - Enable SSL Decryption
    - Root Certificate Requirement
    - Prerequisites
    - Procedure
  - Test SSL Decryption
    - Prerequisites
    - Procedure
- Manage Umbrella's PAC File
  - Deploy Umbrella's PAC File for Windows
    - Prerequisites
    - Copy Default PAC File or Custom PAC File
      - Copy URL for Default Umbrella PAC File
      - Copy URL for Custom PAC File
    - Deploy Umbrella PAC File URL for Chrome and Edge Browsers
    - Deploy Umbrella PAC File URL for Firefox
  - Deploy Umbrella's PAC File for Mac
    - Prerequisites
    - Copy Default PAC File or Custom PAC File
      - Copy URL for Default Umbrella PAC File
      - Copy URL for Custom PAC File
    - Deploy Umbrella PAC File URL to Chrome
    - Deploy Umbrella PAC File URL to Firefox
    - Deploy Umbrella PAC File URL to Safari
  - Upload Custom PAC Files to Umbrella
    - Prerequisites
    - Requirements for Uploading Custom PAC Files in Umbrella
    - Procedure
      - Upload Custom PAC File with Invalid Filename
    - Manage Uploaded Custom PAC Files
      - View Custom PAC Files in Umbrella
      - Copy URL for Custom PAC File
      - Rename Custom PAC File
      - Replace Custom PAC File
- Manage Proxy Chaining
  - Forwarded-For (XFF) Configuration
    - On-Premise X-Forwarded-For Header Configuration (No Plug-In)
    - Browser Plugin X-Forwarded-For Header Configuration (No Proxy Chaining)
- Customize Block and Warn Pages
  - Create a Custom Block Page
    - Prerequisites
    - Procedure
  - Create a Custom Warn Page
    - Prerequisites
    - Procedure
  - Allow Users to Contact an Administrator
    - Prerequisites
    - Procedure
  - Add a Custom Logo
    - Prerequisites
    - Procedure
  - Redirect to a Custom Block Page
    - Prerequisites
    - Procedure
  - Block Page IP Addresses
  - Set Up a Block Page Bypass User
    - Prerequisites
    - Procedure
      - Set up Block Page Bypass for an Existing User
      - Set Up Block Page Bypass for a New User
  - Create a Block Page Bypass Code
    - Prerequisites
    - Procedure
    - Delete a Block Page Bypass Code
  - Enable Block Page Bypass in a Policy
    - Prerequisites
    - Procedure
- Manage Tunnels
  - Check Device Compatibility
    - IPsec Tunnel Requirements
    - Supported Devices for Setting Up IPsec Tunnels
    - Unsupported Network Devices for Setting Up IPsec Tunnels
  - Add Network Tunnel Identity
    - Prerequisites
    - Procedure
    - Configure Network Tunnel
    - Verify Tunnel Traffic in Umbrella
    - Add Tunnel to Umbrella Policies
  - Supported IPsec Parameters
    - Supported IPsec Parameters
  - Connect to Cisco Umbrella Through Tunnel
    - Data Centers with Automatic IPsec Failover
    - Data Centers without Automatic IPsec Failover
    - Tertiary/Disaster Recovery Data Centers
  - Monitor Network Tunnel Status
    - Prerequisites
    - Monitor Tunnel Status from Deployments
    - View Number of Active Network Tunnels from Overview Report
    - Cisco Catalyst SD-WAN Layer 7 Health Check
- Network Tunnel Configuration
  - Prerequisites
  - Establish a Tunnel
    - Maximum Transmission Unit (MTU) Size
    - Tunnel Size
    - Client Reachable Prefixes
    - Throughput and Multiple Tunnels
  - Network Tunnel and Secure Web Gateway
    - Transparent Mode
    - Explicit Mode
  - Configuration Guides
  - Configure Tunnels with Catalyst SD-WAN cEdge and vEdge
    - Prerequisites
    - Configure Tunnel in Umbrella
    - Configure Cisco Catalyst SD-WAN Templates
      - Define the Feature Template
      - Add the IPsec Interface Template
    - Configure Static Routes
    - Verify Tunnel Status
  - Configure Tunnels Automatically with Catalyst SD-WAN cEdge and vEdge
    - Prerequisites
    - Procedure
      - Step 1: Configure the Outside Interface NAT
      - Step 2: Configure a Loopback Interface
      - Step 3: Add an Umbrella SIG Credentials Feature Template
      - Step 4: Add an Umbrella SIG Tunnel Feature Template
      - Step 5: Configure a Device Template
      - Step 6: Route Traffic to Umbrella SIG
    - Troubleshooting
  - Configure Tunnels with Meraki MX
    - Prerequisites
    - Step 1: Add a Network Tunnel Identity
    - Step 2: Configure Tunnel in Meraki MX
    - Optional Configurations
    - Verification and Troubleshooting
  - Configure Tunnels with Cisco Adaptive Security Appliance (ASA)
    - Prerequisites
      - Licensing and Hardware
      - Network Access
    - Configure Tunnels in Umbrella
    - Configure ASA
    - Test and Verify
  - Configure Tunnels with Cisco ISR
    - Configure Tunnels in Umbrella
    - Configure ISR (G2, 4K) or CSR
    - Test Your Configuration
  - Configure IKEv2 IPsec Tunnel with Umbrella
    - Prerequisites
    - Image Download Links
    - Supported Platforms
    - Configuration
      - Configure Tunnels in Umbrella
      - Configure IKEv2 Proposal
      - Configure IKEv2 Policy
      - Configure IKEv2 Keyring
      - Configure IKEv2 Profile
      - Configure IPsec Transform Set
      - Configure IPsec Profile
      - Configure the Tunnel Interface
      - Send Traffic to the Tunnel
    - Verification
      - Show IKEv2 session
      - Show IPsec Sa
      - Create Umbrella Web Policy
      - Test from a Host behind Vlan 101
    - Other Resources
  - Configure Tunnels Automatically with Cisco ASA and CDO
    - Prerequisites
    - Onboard an Umbrella Organization
    - View Tunnels from Umbrella to CDO
  - Configure Tunnels with Cisco Secure Firewall
    - Configure Firepower Policy-based VPN
      - Configure Tunnels in Umbrella
      - Add Network Object
      - Add Traffic Selector ACL
      - Configure Site-to-Site VPN
      - Configure NAT Policy
      - Configure Access Policy
    - Configure Firepower VTI, PBR, and Per Tunnel Identity
      - Configure Tunnels in Umbrella
      - Configure Site-to-Site VPN
      - Configure Policy-based Routing
      - Configure Access Policy
    - Troubleshooting
      - Enable Logging for Debugging
  - Configure Tunnels with Palo Alto IPsec
    - Palo Alto IPsec Functionality
    - Prerequisites
    - Configure Tunnels in Umbrella
    - Configure Palo Alto IPsec EC VPN
      - Create a New Tunnel Interface
    - Configure Palo Alto IKE Profile
    - Configure Palo Alto IPsec SEC Crypto Profile
      - Create a New IPsec Profile
    - Configure Palo Alto VPN Tunnel
      - Define the IKE Gateway
    - Apply Palo Alto IKE Gateway and IPsec Crypto Profile to Umbrella IPsec Tunnel
      - Set Up Key Exchange
    - Palo Alto VPN Static Routing
  - Configure Tunnels with Alibaba Cloud IPsec
    - Configure Tunnels in Umbrella
    - Configure Alibaba Cloud IPsec VPN
      - Prerequisites
    - Procedure
      - Create a Customer Gateway
      - Create an IPsec-VPN Connection
        
        Before You Configure
    - View Logs
  - Configure Tunnels with Palo Alto Prisma SDWAN
    - Configure Tunnels in Umbrella
    - Configure Palo Alto Prisma
      - Configure the Prisma IPsec Profile
      - Configure the Prisma Service Endpoint Group
      - Configure the IPsec Tunnel
      - Configure the Prisma Path Policy
    - Verify the Configuration
    - Troubleshoot the Configuration
  - Configure Tunnels with Cisco Router in AWS
    - Multiple Isolated AWS VPCs
      - Set up the VPC with a Cloud Services Router (CSR)
      - Deploy and Configure the Cisco CSR Instance
      - Test the Cisco CSR Deployment
    - Multiple AWS VPCs with Transit Gateway
      - Limitations
      - Set Up the VPCs
      - Deploy and Configure the Transit Gateway
      - Test the Transit Gateway Deployment
    - Other Resources
  - Configure Tunnels with Azure IPsec
    - Azure Virtual Network Gateway
      - Deploy Virtual Network Gateway (VNG)
      - Configure Azure VNG IPsec VPN
      - Configure Azure VNG with Umbrella
      - Troubleshoot Azure VPN
    - Cisco Cloud Services Router (CSR) 1000V
      - Deploy CSR1000V
      - CSR1000V Single Tunnel
      - CSR1000V Multiple Tunnels Load Sharing
      - Azure Virtual Network Routing to CSR1000V
      - CSR1000V Umbrella Configuration
      - Troubleshoot the CSR1000V VPN
    - Other Resources
  - Configure Tunnels with Oracle Cloud IPsec
    - Configure Oracle Cloud Interface Tunnels with Umbrella
      - Configure the Customer-Premises Equipment
      - Configure Site-to-site VPN
      - Configure Umbrella Network Tunnels
      - Configure Routes
        
        Configure Customer Routes
        
        Configure Umbrella Routes
      - Verify the Configuration
    - Configure Multiple Isolated OCI VPNs
      - Deploy the Cisco ASAv
      - Configure Umbrella Network Tunnels
      - Configure the Cisco ASAv
      - Route Traffic through the ASAv
      - Verify the Configuration
    - Configure Multiple OCI VPNs with Local Peering Gateway
      - Configure the Transit VCN
      - Route Rules for VPN Traffic to Umbrella Data Center
      - Connect the Local Peering Gateway
      - Route Rules through Local Peering Gateway for Other VCNs
      - Verify the Configuration
  - Configure Tunnels with Google Cloud Platform IPsec
    - Google Cloud Platform (GCP) VPN
      - Configure GCP
      - Route Traffic to the Google Cloud VPN Tunnel
      - Add the GCP Cloud VPN Gateway to Umbrella
      - Acquire GCP VPN Logs
    - Cisco Cloud Services Router (CSR) 1000V
      - Deploy the Cisco Cloud Services Router (CSR) 1000V
      - Route Traffic to the CSR1000V Tunnel
      - Configure CSR1000V as a Single Tunnel
      - Use Multiple Tunnels with CSR1000V
      - Configure CSR1000V with Umbrella
      - Troubleshoot CSR1000V VPN
    - Other Resources
  - Configure Tunnels with Sophos XG IPsec
    - Configure Tunnels in Umbrella
    - Configure Sophos XG – IPsec Policy
    - Configure IPsec Connections
    - Tunnel Interface and Gateway
    - SD-WAN Policy Routing
    - Test the Configuration
    - Other Resources
  - Configure Tunnels with Silver Peak
    - Configure Tunnels in Umbrella
      - Configure ADFS for SAML
    - Configure Silver Peak EdgeConnect
      - Business Intent Overlay
        
        Configure the IPsec Tunnel
        
        Create the Business Intent Overlay (BIO)
      - Route Mapping
        
        Configure the IPsec Tunnel
        
        Create an Access List for Interesting Traffic
        
        Create a Route Map
    - Test the Configuration
    - Other Resources
  - Configure Tunnels with Fortinet IPsec
    - Configure Umbrella
    - Configure Fortinet
      - Configure the Primary IPsec Tunnel
      - Configure the Secondary IPSec Tunnel
      - Create Policy and Objects
    - Verify the Tunnel Status
    - Create a Static Route
    - Test the Configuration
    - Other Resources
  - Configure Tunnels with Checkpoint GAiA
    - Prerequisites
    - Configure Tunnels in Umbrella
    - Configure Checkpoint Gateway Firewall
      - Add Interoperable Device
      - Configure Network Group Object for Interesting Traffic
      - Create VPN Community
      - Configure Security Policies
      - Configure VPN Tunnel Interface
      - Configure Policy Based Routing
      - Provide IKE Identity
      - Verify Tunnel Status
  - Configure Tunnels with NEC IX2000/3000 Series Router
    - Configure a Cisco Umbrella Tunnel
    - Prerequisites for Configuring a Cisco Umbrella Tunnel
    - Configure a Tunnel in Cisco Umbrella
    - Configure an NEC IX2000/3000 Series Router IPSec Tunnel
      - Verify the IPSec Status
      - Other Resources
- Manage Accounts
  - Add a New Account
    - Prerequisites
    - Procedure
  - Delete an Account
    - Prerequisites
    - Procedure
  - Change Account Settings
    - Prerequisites
    - Procedure
  - Hide Identities with De-identification
    - Prerequisites
    - Identity Types
    - Enable De-identification
    - Disable De-identification
    - Limitations
- Manage User Roles
  - Add a New User
    - Prerequisites
    - Procedure
  - Add a Custom User Role
    - Prerequisites
    - Procedure
- Manage API Keys
  - Add Umbrella API Keys
    - Prerequisites
    - Add API Key
    - Refresh API Key
    - Update API Key
    - Delete API Key
  - Add Umbrella Legacy API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Add Static API Keys
    - Prerequisites
    - Generate Token
    - Refresh Token
    - Delete Token
  - Add KeyAdmin API Keys
    - Prerequisites
    - Add KeyAdmin API Key
    - Refresh KeyAdmin API Key
    - Update KeyAdmin API Key
    - Delete KeyAdmin API Key
- Manage Your Logs
  - Where are Logs Stored?
    - Logging to Umbrella's Data Warehouse
    - Logging to Amazon S3
    - Advantages and Disadvantages to Configuring a Cisco-Managed Bucket
  - Upgrade Reports
    - Prerequisites
    - Procedure
  - Enable Logging to Your Own S3 Bucket
    - Prerequisites
      - JSON Bucket Policy
    - Procedure
    - Enable Logging HTTPS Query Parameters
    - S3 Bucket Data Path
    - Download Files From the S3 Bucket Locally
      - Prerequisites
  - Enable Logging to a Cisco-managed S3 Bucket
    - Best Practices for Rotating an S3 Bucket Key
      - About the Notifications for the IAM Key
    - Prerequisites
    - Procedure
      - Configure a Cisco-Managed S3 Bucket
      - Rotate Keys on a Cisco-Managed S3 Bucket
      - Get the S3 Bucket Data Path
    - Enable Logging of HTTPS Query Parameters
    - Verify Your Access to an S3 Bucket
      - Download Files From the S3 Bucket Locally
        
        Sample Command
        
        Best Practices: Download Files From the S3 Bucket
  - Change the Location of Event Data Logs
    - Implications When You Change Data Warehouse Locations
    - Log Retention
    - Prerequisites
    - Procedure
  - Stop Logging
    - Prerequisites
    - Procedure
  - Delete Logs
    - Prerequisites
    - Procedure
  - Log Formats and Versioning
    - Prerequisites
    - File Name Format
      - Subfolders
        
        Find Your Log Schema Version
        
        Log Schema Versions
        
        View Your Log Schema Version and Last Sync Time
        
        View Your Headers
        
        View Your Headers in S3 log management
        
        Log File Fields
        
        Estimate the Size of Your Logs
        
        Estimate the Size of an Exported Report
    - Reports and CSV Formats
      - Activity Search Report
        
        Fields in the Activity Search Report
      - Top Categories Report
        
        Fields in the Top Categories Report
      - Top Destinations Report
        
        Fields in the Top Destinations Report
      - Top Identities Report
        
        Fields in the Top Identities Report
    - Admin Audit Log Formats
      - Examples
      - Order of Fields in the Admin Audit Log
        
        Optional V13 Log Header Format
    - Cloud Firewall Log Formats
      - Examples
      - Order of Fields in the Cloud Firewall Log
        
        Optional V13 Log Header Format
    - Data Loss Prevention (DLP) Log Formats
      - Examples
      - Order of Fields in the DLP Log
        
        Optional V13 Log Header Format
    - DNS Log Formats
      - Examples
      - Order of Fields in the DNS Log
        
        Optional V13 Log Header Format
    - IPS Log Formats
      - Examples
      - Order of Fields in the IPS Log
        
        Optional V13 Log Header Format
    - Web Log Formats
      - Examples
      - Order of Fields in the Web Log
        
        Optional V13 Log Header Format
- Manage Authentication
  - Enable Two-Step Verification
    - Prerequisites
    - Procedure
  - Disable Two-Step Verification
    - Prerequisites
    - Procedure
  - Enable Cisco Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Disable Cisco Security Cloud Sign On
    - Prerequisites
    - Procedure
  - Get Started with Single Sign-On
    - Prerequisites
    - How SSO Changes Logging In
  - Enable SSO with Duo
    - Prerequisites
    - Procedure
  - Enable SSO with PingID
    - Prerequisites
    - Procedure
      - Download the PingID XML metadata file:
  - Enable SSO with Okta
    - Prerequisites
    - Procedure
      - Download the Okta XML metadata file:
  - Enable SSO with OneLogin
    - Prerequisites
    - Procedure
      - Download the OneLogin XML metadata file:
  - Enable SSO with Azure
    - Prerequisites
    - Procedure
  - Enable SSO with Other IDPs
- Manage Secure ICAP
  - Prerequisites
  - Secure ICAP Integration
  - Modify an ICAP Server Connection
  - Disconnect from an ICAP Server
- Requirements for Salesforce Tenants for Cloud Malware and SaaS API DLP
  - Salesforce sObjects Supported for SaaS API DLP
  - Install or Update Node.js
  - Install the Salesforce CLI
  - Deploy the Salesforce Quarantine Package to your Salesforce Tenant
  - Log In to Your Salesforce Org
  - Set Permissions in Salesforce
- Manage Cloud Malware Protection
  - Enable Cloud Malware Protection
  - Revoke Authorization for a Platform
  - Enable Cloud Malware Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable Cloud Malware Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable Cloud Malware Protection for Box Tenants
    - Prerequisites
    - Limitations
    - Verify Box Application Settings
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Dropbox Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Google Drive Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Access Security Broker Features for Microsoft 365 Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Salesforce Tenants
  - Edit a Salesforce Cloud Malware Tenant
  - Enable Cloud Malware Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable Cloud Malware Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
  - Enable Cloud Malware Protection for Webex Teams Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Edit a Tenant
    - Revoke Authorization
- Manage SaaS API Data Loss Prevention
  - Enable SaaS API Data Loss Protection for AWS Tenants
    - Prerequisites
    - Limitation
    - Enable CloudTrail Event Logging for S3 Buckets and Objects
    - Obtain Your AWS Account ID
    - Authorize an AWS Tenant
    - Create an AWS Stack
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Azure Tenants
    - Prerequisites
    - Limitation
    - Authorize an Azure Tenant
    - Run an Azure PowerShell Script to Obtain Account Information
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Box Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Dropbox Tenants
    - Prerequisites
    - Limitation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Google Drive Tenants
    - Prerequisites
    - Validation
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Microsoft 365 Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Prevention for Salesforce Tenants
  - Enable SaaS API Data Loss Protection for ServiceNow Tenants
    - Prerequisites
    - Limitation
    - Find the Instance Name for your ServiceNow admin Account
    - Assign the oauth_user role to the ServiceNow admin Account
    - Add an OAuth Client to Your ServiceNow Deployment
    - Authorize a Tenant
    - Revoke Authorization
    - View the Cisco Quarantine Table in Service Now
  - Enable SaaS API Data Loss Protection for Slack Tenants
    - Prerequisites
    - Limitations
    - Authorize a Tenant
    - Revoke Authorization
  - Enable SaaS API Data Loss Protection for Webex Teams Tenants
    - Prerequisites
    - Authorize a Tenant
    - Revoke Authorization
Identity Integrations
- Introduction
  - Configure Identity Providers or Manually Import Users and Groups
- Configure SAML Integrations
  - Prerequisites
  - SAML Certificate Renewal Options
    - Automatic Configuration Through the Umbrella Fixed Metadata URL
      - Prerequisites
    - Manual Import of the Umbrella Signing Certificate
  - Configure Azure AD for SAML
    - Prerequisites
      - Bypass Domains from HTTPS Decryption
    - Configure Azure AD
    - Configure Azure for SAML with Azure's Metadata Upload
    - Configure Azure for SAML Manually
  - Configure Okta for SAML
    - Prerequisites
    - Configure Okta for SAML with Metadata Upload
    - Configure Okta for SAML Manually
  - Configure AD FS for SAML
    - Prerequisites
    - Configure ADFS
    - Configure AD FS for SAML in Umbrella with Metadata Upload
    - Configure AD FS for SAML in Umbrella Manually
  - Configure Duo Security for Cisco Umbrella SAML
    - Prerequisites
    - Configure Cisco Duo Single Sign On (SSO) Application
    - Configure Cisco Umbrella for SAML with Metadata Upload
  - Configure PingID for SAML
    - Prerequisites
    - Configure PingID for SAML with Metadata Upload
    - Configure PingID for SAML Manually
  - Configure OpenAM for SAML
    - Prerequisites
    - Configure OpenAM for SAML with Metadata Upload
    - Configure OpenAM for SAML Manually
  - Configure Other IdPs for SAML
    - Prerequisites
    - Configure Your SAML IdP with Metadata Upload
    - Configure Your SAML IdP Manually
  - Enable IP Surrogates for SAML
    - Prerequisites
      - HTTPS Inspection
    - Map Tunnels to Sites
    - Enable IP Surrogates
    - Add a New IP Surrogate Bypass
    - Delete an IP Surrogate Bypass
    - View Identities in Activity Search
  - Configure SAML for Multiple EntityIDs
    - Prerequisites
    - Configure SAML for Multiple EntityIDs with Metadata Upload
    - Configure SAML for Multiple EntityIDs Manually
- Provision Identities from Active Directory
  - Prerequisites for AD Connectors
    - Connector Server
    - Outbound Network Access to Cisco Umbrella
    - Connector Account
  - Configure Authentication for AD Connectors and VAs
    - How to Set Up Your API Credentials
    - Prerequisites
    - Procedure
      - Step 1 – Create the Key Admin API Key Credentials
      - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
  - Configure Updates on AD Connector
    - Prerequisites
    - Procedure
  - Connect Active Directory to Umbrella
    - How to Configure the Setup of the AD Connector
    - Prerequisites
    - Register a Domain Controller or Domain in the Umbrella Dashboard
      - Register a Domain Controller
      - Register a Domain
    - Specify AD Groups of Interest (Optional)
      - Rename Selective Sync File After Upgrading to AD Connector v1.14.4
      - Create AD Groups in a Selective Sync File
    - Install the Connector
    - Verify That the Connector Syncs with the Umbrella Dashboard
  - Deploy LDIF Files for AD Connector
    - Best Practices for LDIF Source Deployments
    - Requirements
    - Known Limitations
    - Prerequisites
    - Procedure
      - Step 1 – Download the Cisco AD Connector
      - Step 2 – Install the Cisco AD Connector
      - Step 3 – Deploy the LDIF Source Files
    - Verify the Connector Syncs with Umbrella
    - Troubleshooting
      - Scenario 1
      - Scenario 2
      - Scenario 3
      - Scenario 4
      - Analyze Logs
  - View AD Components in Umbrella
    - Prerequisites
    - Procedure
  - Connect Multiple Active Directory Domains to Umbrella
  - Change the Connector Account Password
    - Prerequisites
    - Procedure
  - Communication Flow and Troubleshooting
    - Communication Flow
    - Troubleshooting
- Provision Identities Through Manual Import
  - Prerequisites
    - CSV File Structure
    - CSV File Fields
  - Procedure
- Provision Identities from Microsoft Entra ID
  - Prerequisites
  - Limitations
  - Procedure
  - Configure Cisco User Management Connector App in Microsoft Entra ID
    - Supported Attributes for Users
    - Supported Attributes for Groups
  - Configure Guest Users
  - View Users and Groups in Umbrella
- Provision Identities from Okta
  - Prerequisites
  - Limitations
  - Supported Features
  - Import the ObjectGUID Attribute from Okta
  - Configure the Cisco User Management Connector App
  - Troubleshooting
- Active Directory Integration with Virtual Appliances
  - Network Diagram for VA Deployments
- Prerequisites for AD Integration with VAs
  - Connector Server
  - Outbound Network Access to Umbrella
  - Connector Account
- Configure Active Directory User Exceptions
  - Prerequisites
  - Set Up Active Directory User Exceptions
  - Set Up Active Directory Group Exceptions
  - Set Up Active Directory IP Address Exceptions
- Prepare Your Active Directory Environment
  - Prerequisites
  - AD Integration with Domain Controllers
    - Verify That Auditing of Logon Events is Enabled on the Domain Controllers
    - Run the Configuration Script on the Domain Controllers
      - Register a Domain Controller in the Umbrella Dashboard
      - Verify the Domain Controller Registration in the Umbrella Dashboard
      - Multi-AD domain and Multi-Forest Support
    - AD Integration with a Centralized Windows Event Log Collector
      - Step 1 – Additional Prerequisites
      - Step 2 – Register the Windows Event Log Collector with Umbrella
      - Step 3 – Register the AD Domains with Umbrella
- Connect Active Directory to Umbrella VAs
  - How to Configure the Setup of the AD Connector
  - Prerequisites
  - (Optional) Specify AD Groups of Interest
    - Rename Selective Sync File After Upgrading to AD Connector v1.14.4
    - Create AD Groups in a Selective Sync File
  - Install the Connector
  - Verify That the Connector Syncs with Umbrella
- Multiple Active Directory and Umbrella Sites
  - Prerequisites
  - Active Directory Sites and Umbrella Sites
    - Active Directory Sites and Services
    - Umbrella Sites
      - When You Want to Use Umbrella Sites
    - Caveats
  - Use Umbrella Sites
    - Assign a Site to a Component
- Change the Connector Account Password
  - Prerequisites
  - Procedure
- Communication Flow and Troubleshooting
  - Communication Flow
  - Troubleshooting
Reports
- Get Started with Reports
  - Export Report Data to CSV
  - Bookmark and Share Reports
    - Prerequisites
    - Procedure
  - Report Retention
    - Admin Audit Log Retention
- Schedule Reports
  - Schedule a Report
    - Prerequisites
    - Procedure
      - Unsubscribe From a Report
  - Update a Scheduled Report
    - Prerequisites
    - Procedure
- Overview Report
  - Message Center
  - Deployment Health
  - Network Request Breakdown
    - DNS Requests
    - Total Web Requests
  - Firewall Breakdown
  - Security Categories
  - App Discovery and Control
  - Security Requests
  - File Retrospective
- File Retrospective Events and Cisco Secure Malware Analytics (Threat Grid)
  - File Retrospective Details
    - Activity Search
    - Full Data from Secure Malware Analytics (Threat Grid)
- Security Activity Report
  - View Activity and Details by Filters
    - Prerequisites
    - Procedure
  - View Activity and Details by Event Type or Security Category
    - Prerequisites
    - Procedure
      - Group Security Categories
  - View an Event's Details
    - Prerequisites
    - Procedure
  - Search for Security Activity
    - Prerequisites
    - Procedure
      - Advanced Search
- Activity Search Report
  - Prerequisites
  - Limitations
  - View the Activity Search Report
    - Configure Columns to Display
  - View Actions
    - See Full Details
    - Filter Views
    - Investigate View
  - Save Activity Search Report Columns and Filters for Future Use
  - Schedule an Activity Search Report
- Use Search and Advanced Search
  - Search
  - Wildcards
    - Domains
    - URLs
    - File Names
  - Advanced Search
  - Reserved IP Reporting
  - Customize and Manage Saved Searches
- App Discovery Report
  - View the Highest Risk Apps
    - Prerequisites
    - Procedure
  - Review Apps in the Apps Grid
    - Prerequisites
    - Procedure
    - Configure Columns to Display
  - View App Details
    - Prerequisites
    - Procedure
  - Change App Details
    - Prerequisites
    - Change the Risk Score for an App
    - Change the Label of an App
  - Control Apps
    - Prerequisites
    - Procedure
    - Configure Application Settings for a Policy
  - Advanced App Controls
    - Prerequisites
    - Procedure
    - Configure Advanced Controls in Application Settings for Web Policy
  - View Traffic Data Through SWG
    - Prerequisites
    - View Traffic in the App Discovery Dashboard
    - View Traffic in the Apps Grid
    - View Traffic in the App Details
  - View CDFW Events
    - Prerequisites
    - View CDFW Events by App Risk
    - View CDFW Events in the Apps Grid
    - View CDFW Events in an App's Details
    - View a CDFW Protocol Details
- Top Threats Report
  - Threat Type Details
    - View a Threat's Details
    - View a Threat Type's Requests
    - View the Threat Type's Impact on Your Environment
    - View More Details in Activity Search
  - Threat Type Definitions
- Total Requests Report
  - Prerequisites
  - View Trends in the Total Requests Report
- Activity Volume Report
  - Prerequisites
  - View Requests by Volume of Activity
  - View Activity Volume by Security Categories
    - Prevent
    - Contain
    - Integrations
  - View Activity Volume by Policy Traffic
  - View Trends
- Top Destinations Report
  - Prerequisites
  - View the Top Destinations Report
    - Report Fields
  - View Further Details
  - Destination Details
    - Prerequisites
    - View the Destination Details
    - View the Request Traffic
      - View Requests by Blocked or Allowed
      - View Requests Through Global Traffic %
      - View Details in Investigate
    - View the Access & Policy Details
    - View Recent Activity
    - View the Most Visited URL Paths
- Top Categories Report
  - Prerequisites
  - Top Categories Quick View
  - View the Top Categories Report
    - Report Fields
    - Sort by Traffic
    - Ascending or Descending Order
  - View Category in Other Reports
- Top Identities Report
  - Prerequisites
  - View the Top Identities Report
    - Report Fields
  - View Identity in Other Reports
  - Identity Details
    - Prerequisites
    - View an Identity Report
- Admin Audit Log Report
  - Generate Admin Audit Log Report
  - Export Admin Audit Log Report to an S3 Bucket
- Cloud Malware Report
  - View the Cloud Malware Report
  - Use the Cloud Malware Report
    - View Detailed Information About a File
    - Quarantine a Malicious File
    - Restore a Quarantined File
    - Delete a Malicious File
    - Dismiss an Item from the Report
- Data Loss Prevention Report
  - View Events
    - View Details
    - Delete File
    - Quarantine File
    - Restore File from Quarantine
    - Use Advanced Search
  - Discovery
    - Prerequisite
    - View a Discovery Scan
- Third-Party Apps Report
  - Prerequisites
  - View the Third-Party Apps Report
  - Use Search
  - Use Advanced Search
  - Export the Third-Party Apps Report
  - View App Details
    - Prerequisites
    - Procedure
Manage Roaming Client
- Introduction
  - How the Roaming Client Works
  - Benefits of the Umbrella Roaming Client
  - VPN Support
  - Antivirus and Endpoint Security Software Support
  - Prerequisites
    - Operating System
    - Transport Layer Security Protocol
    - Network Access
    - Software
    - Internal Domains
- Download and Install the Roaming Client
  - Single Machine or Manual Installation
  - Distributed or Automated Installation
- Verify Roaming Client Operation
  - Verify on the Target Computer
  - Verify in the Umbrella Dashboard
    - Admin Audit Log
    - Roaming Computers Page
    - Did the Umbrella Roaming Client Not Install?
- Configure DNS Policies for Roaming Computers
  - Step 1: Create an On-network Policy
  - Step 2: Create an Off-network Policy
  - Step 3: Order your Policies Correctly
- Identity Support for the Roaming Client
  - Prerequisites
  - On-Premises Identity
  - Procedure
  - Prerequisites for AD Integration
  - Configure Identities on macOS
  - LAN IP Address Reporting Only—No AD integration
  - Enhanced Roaming Client UI
  - AnyConnect Umbrella Roaming Security Module UI
  - Identity Support in Umbrella Policies
  - Identity Support in Umbrella Reports
    - View Traffic in Umbrella
  - What Information is Sent to Cisco Umbrella and When
    - AD Directory Structure
    - AD User ID
    - User Group
    - LAN IP Address
    - Device ID
- Status, States, and Functionality
  - Status in the Umbrella Dashboard
  - Roaming Computer Information
    - Tray Icon Status
      - Status Indicators
    - Probes
      - Encrypted Probe
      - Unencrypted Probe
      - Virtual Appliance + Protected Network Probe
    - Advanced: Network Access per Service
    - Advanced: How the Umbrella Roaming Client Changes States
- Virtual Appliances
  - Behavior
- Troubleshooting
  - Scenarios
    - Did the Umbrella Roaming Client not Install?
    - Unable to Resolve Internal Resources
    - Installations Failures
    - Unregistered Umbrella Roaming Clients
    - Unprotected/Unencrypted
    - Switching States or Statuses Frequently (Flapping)
  - Logs
  - Diagnostic Tool
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DHCP/Static DNS Servers
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computers Settings
  - Prerequisites
  - Procedure
    - General Settings
    - Client Settings
      - Secure Client Settings
      - Umbrella Roaming Client Settings
    - Backoff Settings
      - DNS Backoff Settings
      - Secure Web Gateway Backoff Settings
- Encryption and Authentication
  - Concepts
  - DNSCrypt
  - DNSCrypt Versus DNSSEC
  - Encryption and Authentication
  - Encrypted State
  - Unencrypted State
- Command-line and Customization for Installation
  - Prerequisites and Instructions
  - Parameters
    - Windows
      - Required Parameters
      - Optional Parameters
    - macOS
      - Optional Parameters
        
        Deploy Through the Command Line
        
        Windows
        
        macOS
- Remote Logging and Diagnostics
  - Objective
  - Privacy
  - Logs
  - The Diagnostic Tool
- macOS Mobile Device Management
  - Prerequisites
  - Register to an Organization
  - Change Organizations
  - Add a User Identity
Umbrella Roaming Security: Cisco Secure Client
- Introduction
- Umbrella Roaming Security: Cisco Secure Client (formerly AnyConnect)
  - Prerequisites
    - System Requirements
      - Unsupported Operating Systems
    - Network Requirements
    - Roaming Client Prerequisites
  - Deploy Umbrella module in Cisco Secure Client
    - Manual Installation of Cisco Secure Client (Windows and macOS)
    - Mass Deployment Overview
    - Contents
    - Remote Installation
      - Profile Installation
      - Customization Options
    - Mass Deployment (Windows)
    - (Optional) Package Customization
      - Add Umbrella Profile
    - Automated Installation (Windows)
      - Install Cisco Secure Client
      - Install the Umbrella Profile
      - (Optional) Disable VPN Functionality (Post installation)
    - Customize Windows Installation of Cisco Secure Client
      - Procedure
        
        Deploy the Cisco Secure Client VPN Module
        
        Deploy the Cisco Secure Client Umbrella Roaming Security Module
        
        (Optional) Deploy Cisco Secure Client DART
        
        Hide Cisco Secure Client Modules from Add/Remove Programs List
      - Optional OrgInfo.json Parameter Configurations
    - Mass Deployment (macOS)
    - Contents
      - (Optional) Package Customization
        
        Add Umbrella Profile
        
        (Optional) Disable VPN Functionality
        
        Save the .dmg image
      - Automated Installation (macOS)
        
        Installation (Pre-Deployment Package)
        
        Installation (Web Deployment Package)
        
        Install Umbrella Profile
        
        (Optional) Disable VPN Functionality (Post-Installation)
        
        Allow Secure Client System Extensions
    - Customize macOS Installation of Cisco Secure Client
      - Procedure
      - Step 1 – Make the .dmg Package Writeable
      - Step 2 – Generate the Module Installation Configuration File
      - Step 3 – Copy OrgInfo.json to Cisco Secure Client Installation Directory
      - Step 4 – (Optional) Hide the VPN Module
      - Step 5 – Customize the Cisco Secure Client Installation Modules
        
        Sample Customization
      - Step 6 – Set Up the Correct Extension Permission Settings
      - Step 7 – Install Secure Client with Selected Modules
      - Optional OrgInfo.json Parameter Configurations
    - VPN Headend Deployment
    - Secure Firewall Management Center and Secure Firewall Threat Defense
      - Prerequisites to provision the Umbrella Module
      - Procedure to enable Secure Client Umbrella Module in Management Center and Threat Defense
      - (OPTIONAL) VPN Local Authentication (Management Center 7.0 or later required)
    - Migration from Umbrella Roaming Client
    - Install the Root Certificate
    - Automatic Updates
    - Cloud Management
      - Contents
      - Overview
      - Deploying Cisco Secure Client
      - Profiles
      - Uploading the Orginfo.json profile
      - Create a Deployment
      - Post Deployment
        
        Additional Reference
      - Additional References
      - Remote Monitoring and Management Deployment Tutorials
  - Meraki Systems Manager (SM) Deployment
  - Enable the Umbrella SWG Agent
  - DNS Protection Status
    - Prerequisites
    - Procedure
    - DNS Protection Status Descriptions
  - SWG Protection Status
    - Prerequisites
    - Procedure
    - Secure Web Gateway Status Descriptions
  - Interpret Diagnostics
- Active Directory Policy Enforcement and Identities
  - Procedure
  - macOS User Identity
- Virtual Appliances
  - Behavior
- Domain Management
  - Domain Management
  - DNS Suffixes
  - Operational Flowchart
    - 1. Internal Domains
    - 2. External Queries
    - 3. Internal Queries
  - Advanced Topics
    - Unencrypted
    - Virtual Appliances
    - DNS Suffixes (Continued)
- Configure Protected Networks for Roaming Computers
  - Roaming Computers on a Protected Network
  - Roaming Computers Off-Network
  - Prerequisites
  - Before You Begin
  - Configure Your DNS for Local Network
    - Test Your Configured DNS
  - Add Policies
    - Step 1: Add Networks to On-Network Policies
    - Step 2: Add Roaming Computers to Off-Network Policies
    - Step 3: Order Your Policies
  - Procedure
- Roaming Computer Settings
  - Procedure
  - General Settings
  - Client Settings
    - Secure Client Settings
      - Umbrella Roaming Client Settings
  - Backoff Settings
    - DNS Backoff Settings
    - Secure Web Gateway Backoff Settings
Manage Virtual Appliance
- Introduction
  - How Umbrella Virtual Appliances Work
  - Benefits of Virtual Appliances
  - Prerequisites
    - Virtual Appliance Requirements
      - VMware Requirements
      - Microsoft Hyper-V Requirements
      - Cloud Platform Requirements
      - KVM Requirements
      - Nutanix Requirements
    - Networking Requirements
      - SSH Support Tunnel
      - Networking: Additional Considerations
      - DNSCrypt
  - Deployment Guidelines
    - Virtual Appliance Deployment Best Practices
      - Redundancy
      - Multiple DNS Egresses
      - Single DNS Egress
      - Double NAT
  - Importance of Running Two VAs
    - Benefits of Two VAs
- Deploy Virtual Appliances
  - Configure Authentication for Virtual Appliances
    - How to Set Up Your API Credentials
    - Prerequisites
    - Procedure
      - Step 1 – Create the Key Admin API Key Credentials
      - Step 2 – Add the Key Admin API Key Credentials to Sites and Active Directory
    - Refresh API Key Credentials
    - Delete API Keys
      - Recreate API Key Credentials for Authentication
  - Deploy VAs in Hyper-V for Windows 2012 or Higher
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - 1. Download and Extract the Hyper-V Installer
    - 2. Import the Virtual Appliance
    - 3. Copy and Rename Image Files
    - 4. Select Network Adapter
    - 5. Select Hard Drive
    - 6. Power on the Virtual Machine
    - 7. Repeat for the Second Virtual Appliance
  - Deploy VAs in VMware
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Step 1: Download OVF Template
    - Step 2: Deploy OVF Template
    - Step 3: Deploy a Second Virtual Appliance
    - Step 4: Power on the Virtual Machines
  - Deploy VAs in Microsoft Azure
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Before You Begin
    - Procedure
    - Step 1: Prepare the Virtual Appliance Image on Azure
    - Step 2: Launch the Virtual Appliance on Azure
  - Deploy VAs in Amazon Web Services
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - 1. Prepare the Virtual Appliance Amazon Machine Image
    - 2. Launch the Virtual Appliance on Amazon Web Services
  - Deploy VAs in Google Cloud Platform
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
    - Prepare the Virtual Appliance Instance Template on GCP
    - Launch the Virtual Appliance on Google Cloud Platform
  - Deploy VAs in KVM
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedural Overview
      - 1. Download and Extract the KVM Installer
      - 2. Launch the Virtual Appliance on KVM
  - Deploy VAs in Nutanix
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
  - Deploy VAs in Alibaba Cloud
    - Prerequisites
      - Configure Authentication for the Virtual Appliances
    - Procedure
    - Download and Extract the Hyper-V Installer
    - Alibaba Cloud Setup
      - Procedural Overview
      - Create an Alibaba Virtual Private Cloud (VPC)
      - Create a Bucket for the Umbrella VAs
      - Configure a ZIP Package Decompression Rule
      - Upload the Umbrella VHD Images to the OSS Bucket
    - Create a Custom Image
    - Deploy the Umbrella VAs from the Imported Custom Image
      - What to do Next
    - First-time Login to Umbrella VA
      - Related Topics
      - Dual-NIC Support on the VA
      - IP Addressing
        
        General Guidelines
        
        Support for IPv6 Addressing
      - Anycast Configuration Support
      - DNS Performance on Alibaba ECS Instances
      - Extensions on Alibaba ECS Instances
- Configure Virtual Appliances
  - Prerequisites
  - Enter Configuration Mode on a VA Deployed on VMware, Hyper-V, or KVM
  - Enter Configuration Mode on a VA Deployed in Azure, AWS, or Google Cloud Platform
  - Configure the VA Through Configuration Mode
  - Add a Second VA
- Local DNS Forwarding
  - Manage Domains in the VA
    - What format does the internal domains list accept?
    - Which domains should be added?
    - (Optional) Add A & PTR Records for the VAs
  - Configure Local DNS Servers on the VA
    - Examples
- Reroute DNS
  - Test VAs
  - Test with Endpoints
  - Transition Production Traffic
- Update Virtual Appliances
  - Prerequisites
  - Update Your Virtual Appliance
  - Configure Automatic Update of Virtual Appliances
  - Manual Update of a Virtual Appliance
  - Configure Automatic Update Postponement
- Virtual Appliance Sizing Guide
  - Network Prerequisites
  - What is an Umbrella Virtual Appliance?
  - Connector Sizing Guidelines
  - Deployment Considerations
    - Overall Latency
    - Number of Umbrella Sites
    - Number of Users per VA
- SNMP Monitoring
  - Enable SNMP Monitoring
    - SNMPv2.x
    - SNMPv3
    - Privacy Password
    - Configure SNMP in Umbrella Virtual Appliance
    - SNMP Command Syntax
  - About SNMP Monitoring
  - Standard OIDs Supported by the Virtual Appliance
  - Extended OIDs Supported by the Virtual Appliance
- Troubleshoot Virtual Appliances
  - Reset a Virtual Appliance's Password
  - Use Configuration Mode to Troubleshoot
  - Establish a Support Tunnel From the VA
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on Azure Platforms
  - Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on non-Azure Platforms
  - Troubleshoot DNS Resolution in Configuration Mode
  - Troubleshoot DNS Resolution Failures Behind a Firewall
- Other Configurations
  - Configure Rate Limiting
  - Configure NTP Servers
    - Configure Umbrella Resolvers
    - Configure DNSSEC Support
    - Configure Logging to Remote Syslog Server
      - Turn Off the Logging
      - Configure Dual-NIC Support on the VA
        
        Configure an Existing VA to Support Dual-NIC
        
        Deploy a New VA to Support Dual-NIC DMZ Mode
      - Configure Anycast
        
        Configure Anycast over BGP on the VA
        
        Configure Load Balancing
        
        Configure Identity Association Timeouts
        
        Configure API Key Credentials for Authentication
        
        Configure the Client ID and Client Secret
Sites and Internal Networks
- Internal Networks Setup Guide
  - Set Up Internal Networks
- Provision a Subnet for Your Virtual Appliance
  - Prerequisites
  - Procedure
  - Add an Internal Network and Sites
- Manage Sites
  - Prerequisites
  - Before You Begin
  - Procedure
- Manage Internal Networks
  - Prerequisites
  - Before You Begin
  - Internal Network Associations
  - Procedure
  - Apply Policies to Internal Network
- Assign a DNS Policy to Your Site
Managed iOS Device
- Cisco Security Connector: Umbrella Setup Guide
  - Requirements
    - Optionally
  - Getting Started
- Quick Start
  - Prerequisites
  - Procedure
    - Step 1: Install the Cisco Security Connector App
    - Step 2: Add an Organization Administrator's Email Address
    - Step 3: Register Your iOS Device Through Your MDM to Umbrella
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Meraki Registration
  - Prerequisites
  - Procedure
  - Verify Push of Profile Config
  - Anonymize Your Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
  - Verify Umbrella with Meraki
  - Meraki Documentation
- IBM MaaS360 Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Intune Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Jamf Registration
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
    - Alternate Configuration
    - Anonymization
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobiConnect Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- MobileIron Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS device
  - Install Umbrella Root Certificate
- MobileIron Configuration
  - MobileIron Procedure
  - MobileIron Cloud Configuration
  - MobileIron On-Prem Configuration
- Workspace ONE Registration
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Register an iOS Device Through a Generic MDM System
  - Anonymization
  - Prerequisites
  - Procedure
    - Step 1: Add an Organization Administrator's Email Address
    - Step 2: Add a Mobile Device
  - Verify Umbrella on Your iOS Device
  - Install Umbrella Root Certificate
- Apply a DNS Policy to Your Mobile Device
  - Prerequisites
  - Procedure
    - Policy > Security Settings
    - Policy > Passive Reporting Mode
- Umbrella Reporting
  - Activity Search Report
  - Security Activity Report
  - App Discovery Report
  - Third-Party Apps Report
- Add User Identity for Cisco Security Connector
  - Prerequisites
  - Procedure
  - Test Integration of User Identity With Cisco Security Connector
- Anonymize Devices
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Prerequisites
  - Generate Diagnostics and Email the Umbrella Reports
  - Generate Diagnostics and Share the Umbrella Reports
- Push the Umbrella Certificate to Managed Devices
  - Prerequisites
  - Procedure
- Configure Cellular and Wifi Domains
  - Prerequisites
  - Procedure
Managed Android Device
- Cisco Secure Client (Android OS)
  - Device Security
  - Prerequisites
  - Known Issues
- Deploy the Android Client
  - Download Configuration
  - MDM Configurations
  - Install Umbrella Root Certificate
  - Android Configuration Download
    - Procedure
      - Fail Close/Open Scenario
  - Cisco Meraki MDM
    - Add App to Cisco Meraki
    - Add Configuration for App
    - Push the App to Devices
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - MobileIron MDM
    - Configure the App
    - Push the App
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - VMware Workspace ONE
    - Prerequisites for Deployment
    - Deployment Procedure
      - Create an Always On VPN Profile
    - Add and Publish the Cisco Secure Client Application
  - Microsoft Intune MDM
    - Publish the Umbrella AnyConnect App to Managed Android Devices
    - Configure Umbrella
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Samsung Knox MDM
    - Register with the Enterprise Mobile Manager (EMM)
    - Enroll Android Devices
    - Push the App
    - Set Managed Configuration
    - Create Profile in Knox Manage
    - Push User Identities
    - Push the Umbrella Certificate
    - Manage Pop-Ups and App Controls
  - Push the Umbrella Certificate to Managed Devices
    - Prerequisites
    - Procedure
  - Manage Pop-Ups and App Controls
    - App Settings and First-Time Launch
      - Benefits of Enabling Always-On VPN with Umbrella
    - Configure the App for Umbrella DNS and Remote VPN
      - Configure the App for Umbrella Without Remote VPN
      - Configure the App for Umbrella With Remote VPN
    - Add Android Restriction
    - Additional Notes
- Manage Identities
  - Cisco Meraki Systems Manager
  - Microsoft Intune
  - Samsung Knox
  - VMWare WorkspaceOne
  - Access User Identities on the Umbrella Dashboard
    - Configure DNS Policy
    - Monitor User Activity
- Export Device Data to CSV
  - Procedure
- Troubleshooting
  - Is this a VPN to Umbrella?
  - An Internal Site Isn't Loading
  - Configuration Issues
  - Check for VPN Connection and Policy
  - Check Block Page
  - Get the Android ID
  - Fail Close/Open Scenario
  - Check Device Registration
  - Missing CA Certificate
  - Org ID on Policy Page is 0
  - App Installation is Blocked
  - Offboarding Users
  - Known Issues
- Frequently Asked Questions
Unmanaged Mobile Device Protection
- Umbrella Unmanaged Mobile Device Protection
- Administrator Actions
  - Prerequisites
  - Procedure
- End-User Actions
  - Android
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment
    - Enrollment by QR code
    - Enrollment without Camera Access
    - Registration and Activation
  - iOS
    - Known Limitations
    - Prerequisites
    - Deployment
    - Enrollment by Link
    - Enrollment by QR code
    - Registration and Activation
Cisco Security for Chromebook Client
- Get Started
  - Policies
- Migration Scenarios
- Prerequisites
- Limitations
- Google Workspace Identity Service
- Integrate Google Workspace Identities
- Deploy the Chromebook Client
  - DNS Layer Protection
  - SWG Layer Protection
  - Deploy Cisco Security for Chromebook Client
    - Umbrella Dashboard
    - Google Admin Console
      - Configure Default Template
      - Configure Managed Guest Session Template
- Bypass Internal Domains from DNS-over-HTTPS (DoH)
  - Procedure
    - Verification
- Enable Reporting for Private IP Address of Chromebook Device
  - Prerequisites
  - Procedure
- Export Device Data to CSV
  - Procedure
- Verify and Debug
  - Verification
  - Debugging
- Protection Status
  - Umbrella Security for Chromebook Client States
- Chromebook-Specific DNS Policy
  - Prerequisites
  - Procedure
- Chromebook-Specific Web Policy
  - Prerequisites
  - Procedure
- Chromebook Client - FAQs
- Google Workspace Identity Service FAQs
Hardware Integration
- Integration for ISR 4K and ISR 1100 – Security Configuration Guide
  - Create a Legacy Network Devices API Token
- Wireless LAN Controller Integration
  - Prerequisites
  - Terminology
  - Wireless LAN Controller Setup and DNS Request Flow
  - Configure the Wireless LAN Controller Integration
  - Sample Wireless LAN Controller Deployments
    - Scenario 1: Configure Local Policies for Cisco Umbrella
      - Setup
    - Scenario 2: Configure WLAN or AP Group for Cisco Umbrella
      - Setup
    - OpenDNS WLAN configuration modes
  - Cisco Umbrella Activity Reporting
  - Cisco Umbrella Support
  - Cisco Umbrella Limitations
- Meraki Cloud-Managed Networks and Umbrella DNS
  - Integrate Meraki with Cisco Umbrella
  - Configure Meraki to Use Cisco Umbrella
- Set Up Umbrella for a Meraki Network
  - Prerequisites
  - Configure Umbrella for Clients
  - Configure Meraki Network to Proxy DNS to Umbrella
- Configure DNS Forwarder for Umbrella
  - Prerequisites
  - Windows Server 2003 and 2003 R2
  - Windows Server 2008 and 2008 R2
  - Windows Server 2012 and 2012 R2
  - Configure BIND to use Umbrella DNS
    - Shell or SSH Instructions
    - Webmin Instructions
- Mobility Express Integration
  - Prerequisites
  - Deploy the Integration
- Configure Mobility Express for Umbrella
  - Prerequisites
  - Configure a Role-Based Local Policy
  - Configure an Umbrella Policy
  - Apply a Cisco Umbrella Profile to a WLAN and AP Group
- Cisco SD-WAN Powered by Catalyst SD-WAN and Umbrella
  - Prerequisites
  - Limitations
  - Configure Umbrella and Cisco Catalyst SD-WAN
    - Authorization: Cisco Catalyst SD-WAN (vManage) Version 19.2/IOS-XE 16.12 and Earlier
    - Authorization: vManage Version 20.1 and Later
    - Insert Authorization Data
- Integration for RV-series Routers
  - Prerequisites
  - Integration
  - Limitations and Restrictions of the Cisco Umbrella Integration
- Cisco Catalyst 9200 and Catalyst 9300 Switches
  - Prerequisites
    - For Active Directory integration on the Catalyst 9200 and 9300 switch:
- Cisco DNA Center
- Cisco Secure Firewall
  - Prerequisites
  - Limitations
  - Configure the Umbrella Connection
  - Create and Manage Umbrella DNS Policies
Cisco Adaptive Security Appliances (ASA)
- Integration for ASA Overview
  - Prerequisites
    - Licensing
    - Hardware and Software
    - Network Access
- Import the Digicert Certificate Authority
  - Prerequisites
  - Procedure
- Configure the Umbrella Connector
  - Prerequisites
  - Obtain Your API Token
  - Configure Umbrella Global Settings
  - Enable Umbrella in the DNS Inspection Policy
- Verify Operation
  - Prerequisites
  - Verify on the ASA
  - Verify in the Umbrella Dashboard
- Monitor the Umbrella Connector
  - Monitor Umbrella Syslog Messages
- Delete an ASA
  - Prerequisites
  - Delete the Umbrella Configuration
  - Remove the ASA From the Dashboard
    - Ensure that the ASA is Removed
Investigate
- Manage Umbrella Investigate
  - Getting Started with Investigate
  - Conduct a Pattern Search
  - Manage the Investigate Only User Role
  - About Passive DNS
  - About Investigate View Types
  - Create Investigate API Keys
  - About the Investigate Domain Summary
    - About Investigate Passive DNS Timeline
      - DNS Query Volume
      - Event History
    - Dispute a Content Categorization
      - Submit Categorization Request Through Cisco Talos
      - Submit Categorization Request Through Investigate
    - About DNS Resolution in Investigate
      - IP Addresses
      - Nameserver (NS)
      - DNS (Others)
    - About Associated Samples in Investigate
    - About the Subdomains Tab in Investigate
    - About Related Domains in Investigate
    - About the Geographic Distribution View in Investigate
    - About the Sample View in Investigate
      - Prerequisites
      - Get Started With Sample View
      - Sample View Details
        
        Components of a Threat Sample
      - Behavioral Indicators
      - Network Connections
      - Associated Samples
      - Associated Artifacts (Secure Malware Analytics Integration)
    - About the IP Address View in Investigate
      - Summary
      - DNS Resolution
      - Autonomous Systems
      - Associated Samples
      - Recent Detections
  - About WHOIS Record Information
    - About the WHOIS Nameserver View
    - WHOIS Data – FAQ
  - About the ASN View
    - Prerequisites
    - Current Information
    - Current Routes
    - Research AS From IP Address View

Cisco Umbrella SIG User Guide Manage Your Logs Log Formats and Versioning IPS Log Formats Order of Fields in the IPS Log

Last updated: Jan 30, 2026

Previous topic Examples Next topic Optional V13 Log Header Format