Cisco Umbrella Cloud Security v2

Cisco Umbrella is a cloud security platform providing the first line of defense against internet threats. It uses DNS-layer security to block malicious requests before a connection is established, offering protection against malware, ransomware, phishing, and more. It offers real-time reporting, integrates with other Cisco solutions for layered security, and uses machine learning to uncover and predict threats.
This integration was tested with version 2 of Cisco Umbrella Cloud Security

Configure Cisco Umbrella Cloud Security v2 in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

umbrella-destinations-list

Get destinations within a destination list. A destination is a URL, IP or fully qualified domain name.

Base Command

umbrella-destinations-list

Input

Context Output

Command example

!umbrella-destinations-list destination_list_id=17425859 limit=3

Context Example

{
    "Umbrella": {
        "Destinations": [
            {
                "comment": "Added from XSOAR",
                "createdAt": "2023-07-19 18:21:11",
                "destination": "www.facebook.com",
                "id": "154",
                "type": "domain"
            },
            {
                "comment": "Lior",
                "createdAt": "2023-07-06 04:42:55",
                "destination": "cisco.com",
                "id": "30058",
                "type": "domain"
            },
            {
                "comment": "Sabri",
                "createdAt": "2023-07-06 04:42:55",
                "destination": "www.pokemon.com",
                "id": "138036",
                "type": "domain"
            }
        ]
    }
}

Human Readable Output

Destination(s)

Id	Destination	Type	Comment	Created At
154	www.facebook.com	domain	Added from XSOAR	2023-07-19 18:21:11
30058	cisco.com	domain	Pikachu	2023-07-06 04:42:55
138036	www.pokemon.com	domain	Choose	2023-07-06 04:42:55

umbrella-destination-add

Add a destination to a destination list. A destination is a URL, IPv4, CIDR or fully qualified domain name. Accepted types for destination list with the access “allow” are: DOMAIN, IPv4 and CIDR. Accepted types for destination list with the access “block” are: URL and DOMAIN.

Base Command

umbrella-destination-add

Input

Context Output

Base Command

umbrella-destination-add

Input

Context Output

Command example

!umbrella-destination-add destination_list_id=17463731 destinations="www.LiorSabri.com,1.1.1.1"

Human Readable Output

The destination(s) “[‘www.LiorSabri.com’, ‘1.1.1.1’]” were successfully added to the destination list “17463731”

umbrella-destination-delete

Remove a destination from a destination list. A destination is a URL, IP or fully qualified domain name.

Base Command

umbrella-destination-delete

Input

Context Output

Command example

!umbrella-destination-delete destination_list_id=17463733 destination_ids=25826

Human Readable Output

The destination(s) “[25826]” were successfully removed from the destination list “17463733”

umbrella-destination-lists-list

Get destination lists. A list of destinations (for example, domain name or URL) to which you can block or allow access.

Base Command

umbrella-destination-lists-list

Input

Context Output

Command example

!umbrella-destination-lists-list limit=3

Context Example

{
    "Umbrella": {
        "DestinationLists": [
            {
                "access": "allow",
                "bundleTypeId": 1,
                "createdAt": 1690184121,
                "id": 17463749,
                "isGlobal": false,
                "isMspDefault": false,
                "markedForDeletion": false,
                "meta": {
                    "applicationCount": 0,
                    "destinationCount": 1,
                    "domainCount": 0,
                    "ipv4Count": 1,
                    "urlCount": 0
                },
                "modifiedAt": 1690184121,
                "name": "Lior",
                "organizationId": 123456,
                "thirdpartyCategoryId": null
            },
            {
                "access": "allow",
                "bundleTypeId": 1,
                "createdAt": 1690184234,
                "id": 17463756,
                "isGlobal": false,
                "isMspDefault": false,
                "markedForDeletion": false,
                "meta": {
                    "applicationCount": 0,
                    "destinationCount": 8,
                    "domainCount": 4,
                    "ipv4Count": 4,
                    "urlCount": 0
                },
                "modifiedAt": 1690184435,
                "name": "LiorSB",
                "organizationId": 123456,
                "thirdpartyCategoryId": null
            },
            {
                "access": "allow",
                "bundleTypeId": 1,
                "createdAt": 1638798710,
                "id": 15609454,
                "isGlobal": true,
                "isMspDefault": false,
                "markedForDeletion": false,
                "meta": {
                    "applicationCount": 0,
                    "destinationCount": 14,
                    "domainCount": 10,
                    "ipv4Count": 4,
                    "urlCount": 0
                },
                "modifiedAt": 1690183660,
                "name": "Global Allow List",
                "organizationId": 123456,
                "thirdpartyCategoryId": null
            }
        ]
    }
}

Human Readable Output

Destination List

Id	Name	Access	Is Global	Destination Count
17463749	Lior	allow	false	1
17463756	LiorSB	allow	false	8
15609454	Global Allow List	allow	true	14

umbrella-destination-list-create

Create a destination list. A list of destinations (for example, domain name or URL) to which you can block or allow access. Accepted types for destination list with the access “allow” are: DOMAIN, IPv4 and CIDR. Accepted types for destination list with the access “block” are: URL and DOMAIN.

Base Command

umbrella-destination-list-create

Input

Context Output

Command example

!umbrella-destination-list-create access=allow is_global=False name=LiorSBList bundle_type=WEB destinations="https://pokemon.com"

Context Example

{
    "Umbrella": {
        "DestinationLists": {
            "access": "allow",
            "bundleTypeId": 1,
            "createdAt": 1690208665,
            "id": 17464621,
            "isGlobal": false,
            "isMspDefault": false,
            "markedForDeletion": false,
            "meta": {
                "destinationCount": 1
            },
            "modifiedAt": 1690208665,
            "name": "LiorSBList",
            "organizationId": 123456,
            "thirdpartyCategoryId": null
        }
    }
}

Human Readable Output

Destination List

Id	Name	Access	Is Global	Destination Count
17464621	LiorSBList	allow	false	1

umbrella-destination-list-update

Edit a destination list. A list of destinations (for example, domain name or URL) to which you can block or allow access.

Base Command

umbrella-destination-list-update

Input

Context Output

Command example

!umbrella-destination-list-update destination_list_id=17463733 name=LiorUpdated

Context Example

{
    "Umbrella": {
        "DestinationLists": {
            "access": "allow",
            "bundleTypeId": 1,
            "createdAt": 1690183414,
            "id": 17463733,
            "isGlobal": false,
            "isMspDefault": false,
            "markedForDeletion": false,
            "meta": {
                "destinationCount": 0
            },
            "modifiedAt": 1690208670,
            "name": "LiorUpdated",
            "organizationId": 123456,
            "thirdpartyCategoryId": null
        }
    }
}

Human Readable Output

Destination List

Id	Name	Access	Is Global	Destination Count
17463733	LiorUpdated	allow	false	0

umbrella-destination-list-delete

Delete a destination list. A list of destinations (for example, domain name or URL) to which you can block or allow access.

Base Command

umbrella-destination-list-delete

Input

Context Output

There is no context output for this command.

Command example

!umbrella-destination-list-delete destination_list_id=17463733

Human Readable Output

The destination list “17463733” was successfully deleted

Breaking changes from the previous version of this integration - Cisco Umbrella Cloud Security v2

The following sections list the changes in this version.

Commands

The following commands were removed in this version

• umbrella-get-destination-lists - this command was replaced by umbrella-destination-lists-list.
• umbrella-add-domain - this command was replaced by umbrella-destination-add.
• umbrella-remove-domain - this command was replaced by umbrella-destination-delete.
• umbrella-get-destination-domain - this command was replaced by umbrella-destinations-list.
• umbrella-get-destination-domains - this command was replaced by umbrella-destinations-list.
• umbrella-search-destination-domains - this command was replaced by umbrella-destinations-list.

Arguments

The following arguments were removed in this version

In the umbrella-get-destination-lists command:

• orgId - this argument was removed.
  In the umbrella-add-domain command:
• orgId - this argument was removed.
  In the umbrella-remove-domain command:
• orgId - this argument was removed.
  In the umbrella-get-destination-domain command:
• orgId - this argument was removed.
  In the umbrella-get-destination-domains command:
• orgId - this argument was removed.
  In the umbrella-search-destination-domains command:
• orgId - this argument was removed.

The behavior of the following arguments was changed

In the umbrella-add-domain command:

• destId - this argument was replaced by destination_list_id.
• domains - this argument was replaced by destinations.
  In the umbrella-remove-domain command:
• destId - this argument was replaced by destination_list_id.
• domainIds - this argument was replaced by destination_ids.
  In the umbrella-get-destination-domain command:
• destId - this argument was replaced by destination_list_id.
  In the umbrella-get-destination-domains command:
• destId - this argument was replaced by destination_list_id.
  In the umbrella-search-destination-domains command:
• destId - this argument was replaced by destination_list_id.
• domains - this argument was replaced by destinations.