Integrate Cisco Umbrella with Red Canary
- 26 Aug 2024
- 1 Minute to read
- PDF
Integrate Cisco Umbrella with Red Canary
- Updated on 26 Aug 2024
- 1 Minute to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
Integrating Cisco Umbrella with Red Canary provides a robust defense-in-depth strategy by combining cloud-based security with advanced threat detection and response. To integrate Cisco Umbrella with Red Canary, follow the procedure below from beginning to end.
Step 1: Red Canary–Create a Red Canary email for alerts
Create a Red Canary provided-email to send Cisco Umbrella alerts for ingestion.
From your Red Canary homepage, click Integrations, and See all integrations.
.png?sv=2022-11-02&spr=https&st=2024-09-20T14%3A41%3A10Z&se=2024-09-20T14%3A51%3A10Z&sr=c&sp=r&sig=MTj8FCKeoIQRs024vmyVh4pA%2FbbJTMN1nk0QviQu%2Fv8%3D)
Type and select Cisco Umbrella (DNS-layer Security).
Click Configure.
Enter a Name for your external alert source.
Select a Display Category.
Under the Ingest Format/Method dropdown, select Cisco Umbrella via Email.
Note: Only Email should be selected for this alert source. For more information, see Supported Integrations.
Click Save Configuration. This will generate the email address you will use to send Cisco Umbrella alerts to.
Click Edit Configuration.
With your alert source configured, click Activate.
With your Red Canary email generated, log in to Cisco Umbrella.
.png?sv=2022-11-02&spr=https&st=2024-09-20T14%3A41%3A10Z&se=2024-09-20T14%3A51%3A10Z&sr=c&sp=r&sig=MTj8FCKeoIQRs024vmyVh4pA%2FbbJTMN1nk0QviQu%2Fv8%3D)
Step 2: Cisco Umbrella–Configure email alerts
Adjust your Cisco Umbrella settings to send generated alerts to your Red Canary-provided email.
From your Cisco Umbrella dashboard, click the Reporting dropdown, and then click Scheduled Reports.
Click +Schedule.
Click Activity Search or Security Activity depending on the type of information you want to send to Red Canary.
Select the type of information you want to include in your alert report.
Enter the recommended configurations below:
Response:
BlockedEvent type:
Select All
When you have selected all of the filters for your alert report, click +Schedule.
Review your filter selections, and then click Continue.
Select a Delivery Schedule, and then click Continue.
Note: Red Canary recommends you select Daily for the Delivery Schedule.
Enter a Name for your Report Title.
Enter the Red Canary email provided in Step 1.7.
Click Save.
Was this article helpful?
