Umbrella - Add Observable to Destination List

This workflow appears in the pivot menu and allows a user to add an observable to the configured destination list in Cisco Umbrella.

Note that the types of observables supported by a destination list will depend on the type of list and if it's configured for allow or block. DNS destination lists support domains (block/allow), URLs (block), and IPv4 addresses (allow). Web policy destination lists support domains, URLs, and IPv4 addresses. Depending on your configuration, you may want to remove observable types from this workflow's properties that don't apply to your use case.

Target: Umbrella

Steps:

• Loop through each page of destination lists:
  • Get this page of lists
  • Parse the results to see if a matching list was found
  • Check if a matching list was found:
    • If it was, add the observable to that list and end the workflow
  • Check if there are more pages of lists:
    • If there are, continue to the next page
    • If there aren't, end the workflow