Configuring Cisco Umbrella Connectors
Connectors allow Stellar Cyber to collect data from external sources and add it to the data lake.
Connector Overview: Cisco Umbrella
Capabilities
-
Collect: Yes
-
Respond: No
-
Native Alerts Mapped: No
-
Runs on: DP
-
Interval: Configurable
Collected Data
Content Type |
Index |
Locating Records |
---|---|---|
Cloud Firewall Logs DNS Logs IP Logs Proxy Logs |
Syslog |
Domain
N/A
Response Actions
N/A
Third Party Native Alert Integration Details
N/A
Required Credentials
-
Data Path, Access Key, and Secret Key
Let us know if you find the above overview useful.
Adding a Cisco Umbrella Connector
To add a Cisco Umbrella connector:
- Configure Cisco Umbrella log management
- Add the connector in Stellar Cyber
- Test the connector
- Verify ingestion
Configuring Cisco Umbrella Log Management
To configure Cisco Umbrella log management:
Use our example as a guideline, as you might be using a different software version.
- Log in to your Cisco Umbrella dashboard at https://umbrella.cisco.com .
-
Click Admin. The Admin menu expands.
- Click Log Management. The Log Management page appears.
- In the Amazon S3 section, configure your S3 storage:
- Click Save. A confirmation dialog appears.
-
Click Continue. Your storage is activated, and an activation screen appears. Copy the Access Key and Secret Key to a safe location.
- Click Got it!. The Continue button becomes active.
-
Click Continue. The Amazon S3 section now displays your S3 storage.
-
Copy the Data Path and add a forward slash (/) to the end of the value.
Adding the Connector in Stellar Cyber
With the data path and keys ready, you can add a Cisco Umbrella connector in Stellar Cyber:
-
Log in to Stellar Cyber.
-
Click System | Integration | Connectors. The Connector Overview appears.
-
Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.
The asterisk (*) indicates a required field.
-
Choose Web Security from the Category drop-down.
-
Choose Cisco Umbrella from the Type drop-down.
-
For this connector, the supported Function is Collect, which is enabled already.
-
Enter a Name.
This field does not accept multibyte characters.
-
Choose a Tenant Name. The Interflow records created by this connector include this tenant name.
-
Choose the device on which to run the connector.
-
(Optional) When the Function is Collect, you can create Log Filters. For information, see Managing Log Filters.
-
Click Next. The Configuration tab appears.
The asterisk (*) indicates a required field.
-
Enter the Data Path you copied earlier. Make sure there is a forward slash (/) at the end of the value.
-
Enter the Access Key you copied earlier.
-
Enter the Secret Key you copied earlier.
-
Enter the Interval (min). This is how often the logs are collected. By default, the interval is 10 minutes.
-
Choose the Content Type you would like to collect. The logs for Cloud Firewall Logs, DNS Logs, IP Logs, and Proxy Logs are supported.
-
Click Next. The final confirmation tab appears.
-
Click Submit.
To pull data, a connector must be added to a Data Analyzer profile if it is running on the Data Processor.
The new connector is immediately active.
Testing the Connector
When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates only the authentication / connectivity; it does not validate data flow).
For connectors running on a sensor, Stellar Cyber recommends that you allow 30-60 seconds for new or modified configuration details to be propagated to the sensor before performing a test.
-
Click System | Integrations | Connectors. The Connector Overview appears.
-
Locate the connector that you added, or modified, or that you want to test.
-
Click Test at the right side of that row. The test runs immediately.
Note that you may run only one test at a time.
Stellar Cyber conducts a basic connectivity test for the connector and reports a success or failure result. A successful test indicates that you entered all of the connector information correctly.
To aid troubleshooting your connector, the dialog remains open until you explicitly close it by using the X button. If the test fails, you can select the button from the same row to review and correct issues.
The connector status is updated every five (5) minutes. A successful test clears the connector status, but if issues persist, the status reverts to failed after a minute.
Repeat the test as needed.
Verifying Ingestion
To verify ingestion:
- Click Investigate | Threat Hunting. The Interflow Search tab appears.
- Change the Indices to Syslog. The table immediately updates to show ingested Interflow records.