Cisco Umbrella

Uses the Cisco Umbrella Investigate API to get information about a list of domains. The input should be a JSON-formatted list of fully qualified domain names. This atomic requires read permission to the "Investigate / Bulk" API scope.

Target: HTTP Endpoint for "investigate.api.umbrella.com"

Account Key: None (uses an API token)

Steps:
[] Execute the API request
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/legacy-umbrella-apis-investigate-api-reference-api-domain-status-and-categorization-check-status-and-categorization-of-domains/

Cisco Umbrella - Investigate - Categorize Multiple Domains

prod-nam

prod-eu

prod-apjc

Uses the Cisco Umbrella Investigate API to get information about a domain. This atomic requires read permission to the "Investigate / Investigate" API scope.

Target: HTTP Endpoint for "investigate.api.umbrella.com"

Account Key: None (uses an API token)

Steps:
[] Execute the API request
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/legacy-umbrella-apis-investigate-api-reference-api-domain-status-and-categorization-get-domain-status-and-categorization/

Cisco Umbrella - Investigate - Categorize Single Domain

Adds a new domain or IP address to a destination list in Cisco Umbrella. This atomic requires read/write permission to the "Policies / Destinations" API scope.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Management API client ID and seceret

Steps:
[] Build the JSON payload to POST
[] Execute the API request to add the new destination
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list data (to make sure the response was what we expected)
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/create-destinations/

Cisco Umbrella - Management - Add Record to Destination List

Gets a list of destinations for a given destination list ID from Cisco Umbrella. This atomic requires read permission to the "Policies / Destinations" API scope.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Management API client ID and seceret

Steps:
[] Request the destination list from Umbrella
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list of records and set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-destinations/

Cisco Umbrella - Management - Get Destination List Entries

Gets a list of destination lists for a given organization ID from Cisco Umbrella. This atomic requires read permission to the "Policies / Destination Lists" API scope.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Management API client ID and seceret

Steps:
[] Request the destination lists from Umbrella
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list of records and set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/destination-lists-api-get-destination-lists/

Cisco Umbrella - Management - Get Destination Lists

Gets a list of organizations the current API client has access to in Cisco Umbrella. This atomic requires read permission to the "Admin / Organizations" API scope.

Note: This atomic returns the raw list of organizations as well as the name and ID of the first organization in the list.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Network and Devices API client ID and seceret

Steps:
[] Make the API request to get the organization list
[] Check if the API request succeeded:
[]> If it did, attempt to extract the first organization's details and set the workflow's output variables
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-organizations/

Cisco Umbrella - Management - Get Organizations

Removes a destination from a destination list by its ID in Cisco Umbrella. This atomic requires read/write permission to the "Policies / Destination Lists" API scope.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Management API client ID and seceret

Steps:
[] Execute the API request to remove the destination
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list data (to make sure the response was what we expected)
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/delete-destinations/

Cisco Umbrella - Management - Remove Record from Dest. List

Gets security activity report events from Umbrella. This atomic can only return up to the first 500 events within the timeframe provided.

Target: HTTP Endpoint for "reports.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Reporting API client ID and secret

Steps:
[] Convert the input times into Unix epochs
[] Execute the API request
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list data and set the output variables
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/#!reporting-v1-getting-started/security-activity

Cisco Umbrella - Reporting - Get Security Activity Report

Gets a list of activity entries from within the given timeframe. If no activity type is provided, all event types will be included. See the "Activity Type" input variable for more information about supported filters. The "Additional Parameters" input variable can be used to provide additional query string parameters which will be passed through to Umbrella. This atomic requires read permission to the "Reports / Aggregations" API scope.

Target: HTTP Endpoint for "reports.api.umbrella.com"

Account Key: None (uses an access token)

Steps:
[] Check if an activity type was provided. If so, prepend a forward slash so it can be inserted into the request URL
[] Make the API request for the report entries
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/activity-all/

Cisco Umbrella - Reporting v2 - Get Activity

Gets a list of categories from Umbrella. This atomic requires read permission to the "Reports / Utilities" API scope.

Target: HTTP Endpoint for "reports.api.umbrella.com"

Account Key: None (uses an access token)

Steps:
[] Make the API request for the categories
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/list-categories/

Cisco Umbrella - Reporting v2 - Get Categories

Gets an OAuth2 token for the Umbrella v2 API using a client ID and secret.

Target: HTTP Endpoint for "management.api.umbrella.com"

Account Key: HTTP Basic Authentication with an Umbrella Reporting API client ID and secret

Steps:
[] Make the API request to get a token
[] Check if the API request succeeded:
[]> If it did, attempt to extract the bearer token and expiration time and set the workflow's output variables
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/reporting-v2-getting-started/#authentication

Cisco Umbrella - Reporting v2 - Get Token

Gets a list of the top internal IPs from within the given timeframe. The "Additional Parameters" input variable can be used to provide additional query string parameters which will be passed through to Umbrella. This atomic requires read permission to the "Reports / Aggregations" API scope.

Target: HTTP Endpoint for "reports.api.umbrella.com"

Account Key: None (uses an access token)

Steps:
[] Make the API request for the report entries
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/list-top-ips-internal/

Cisco Umbrella - Reporting v2 - Get Top Internal IPs

Gets a list of top threats from within the given timeframe. If no threat type is provided, all threats will be included. See the "Threat Type" input variable for more information about supported filters. The "Additional Parameters" input variable can be used to provide additional query string parameters which will be passed through to Umbrella. This atomic requires read permission to the "Reports / Aggregations" API scope.

Target: HTTP Endpoint for "reports.api.umbrella.com"

Account Key: None (uses an access token)

Steps:
[] Check if a threat type was provided. If so, prepend a forward slash so it can be inserted into the request URL
[] Make the API request for the report entries
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/top-threats-all/