category: Network Security
provider: Cisco Systems
sectionorder:
- Connect
- Collect
commonfields:
  id: Cisco Umbrella Enforcement
  version: -1
configuration:
- defaultvalue: https://s-platform.api.opendns.com
  display: Server URL (e.g., https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  name: api_key
  type: 4
  section: Connect
  hidden: true
  required: false
- name: cred_api_key
  type: 9
  section: Connect
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: Add and remove domains in Cisco OpenDNS.
display: Cisco Umbrella Enforcement
name: Cisco Umbrella Enforcement
script:
  commands:
  - arguments:
    - description: Alert time of the new event in datetime format, e.g., 2013-02-08T09:30:26.0Z.
      name: alert_time
      required: true
    - description: Device ID of the new event.
      name: device_id
      required: true
    - description: Destination domain of the new event.
      name: destination_domain
      required: true
    - description: Destination URL of the new event.
      name: destination_url
      required: true
    - description: Device version for the new event.
      name: device_version
      required: true
    - description: The destination IP address of the domain, specified in IPv4 dotted-decimal notation e.g., '8.8.8.8'.
      name: destination_ip
    - description: 'The partner threat level or rating, e.g., severe, bad, high, and so on.'
      name: event_severity
    - description: Common name or classification of the threat.
      name: event_type
    - description: Variant or other descriptor of the event type.
      name: event_description
    - description: Path to the file exhibiting malicious behavior.
      name: file_name
    - description: SHA-1 of file reported by the appliance.
      name: file_hash
    - description: IP/Host of the infected computer/device that was patient 0 for the event.
      name: source
    description: Posts a malware event to the API for processing and optionally adding to a customer's domain lists.
    name: umbrella-domain-event-add
    compliantpolicies:
    - Domain Blockage
  - arguments:
    - description: Number of page to return. Default is "1".
      name: page
    - defaultValue: '50'
      description: The maximum number of queries per page. Default is "50".
      name: limit
    description: List of domains.
    name: umbrella-domains-list
    outputs:
    - contextPath: UmbrellaEnforcement.Domains.name
      description: Name of the domains.
      type: String
    - contextPath: UmbrellaEnforcement.Domains.id
      description: ID of the domains.
      type: Number
    - contextPath: UmbrellaEnforcement.Domains.IsDeleted
      description: True if the domain has been deleted from list.
      type: Boolean
  - arguments:
    - description: ID of the domain.
      name: id
    - description: Name of the domain.
      name: name
    description: Delete domain.
    name: umbrella-domain-delete
    compliantpolicies:
      - Domain Blockage
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: true
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests (auto formatted)