Cisco Umbrella (v2)

Adds one or more URLs, domains, or IP addresses to a destination list in Cisco Umbrella. Note: DNS policies accept URLs or domains while web policies accept IP addresses, URLs, or domains. This atomic requires read/write permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the JSON payload to POST
[] Execute the API request to add the new destination
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list data (to make sure the response was what we expected)
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/destinations-add-destinations-to-destination-list/

Cisco Umbrella - Add Records to Destination List

prod-nam

prod-eu

prod-apjc

Creates a new destination list in Cisco Umbrella. This atomic requires read/write permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the destination list be created
[] Check if the API request succeeded:
[]> If it did, attempt to extract the new destination list ID and set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/create-destination-list/

Cisco Umbrella - Create Destination List

Deletes a destination list by its ID in Cisco Umbrella. This atomic requires read/write permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Execute the API request to delete the destination list
[] Check if the API request succeeded:
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/delete-destination-list/

Cisco Umbrella - Delete Destination List

Fetches an OAuth2 authorization token for the Cisco Umbrella API. If you are using an integration-provided Umbrella target, you do not need to use this atomic as an access token will be generated by the target for you.

Target: HTTP Endpoint for "api.umbrella.com"

Account Key: HTTP Basic Authentication with a Cisco Umbrella API client ID and secret

Steps:
[] Make the API request to get a token
[] Check if the API request succeeded:
[]> If it did, attempt to extract the bearer token and expiration time and set the workflow's output variables
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/create-authorization-token/

Cisco Umbrella - Get Access Token

Gets a list of activity from within the given timeframe from Cisco Umbrella. If no activity type is provided, all types will be included. See the "Activity Type" input variable for more information about supported filters. The "Additional Parameters" input variable can be used to provide additional query string parameters which will be passed through to Umbrella. This atomic requires read permission to the "Reports / Aggregations" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Check if an activity type was provided and, if so, update the URL
[] Make the API request for the report entries
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-activities-all/

Cisco Umbrella - Get Activity

Gets a list of entries for a given destination list in Cisco Umbrella. This atomic requires read permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request the destination list entries from Umbrella
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list of records and set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-destinations-in-destination-list/

Cisco Umbrella - Get Destination List Entries

Gets a specific destination list's details from Cisco Umbrella. The list's details are available as output variables or the raw object's JSON is available in the Results output variable. This atomic requires read permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Execute the API request
[] Check if the API request was successful:
[]> If it was, attempt to extract the destination list's details and set the output variables
[]> If it wasn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-destination-list/

Cisco Umbrella - Get Destination List by ID

Gets a list of destination lists from Cisco Umbrella. This atomic requires read permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request the destination lists from Umbrella
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list of records and set the output variable
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/get-destination-lists/

Cisco Umbrella - Get Destination Lists

Removes a destination from a destination list by its ID in Cisco Umbrella. This atomic requires read/write permission to the "Policies / Destination Lists" API scope.

Target: Umbrella integration target or HTTP Endpoint for "api.umbrella.com" with no path

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Execute the API request to remove the destination
[] Check if the API request succeeded:
[]> If it did, attempt to extract the list data (to make sure the response was what we expected)
[]> If it didn't, output an error

More information about this API: https://developer.cisco.com/docs/cloud-security/destinations-delete-destinations-from-destination-list/