---
title: "Integrate Cisco Umbrella with Red Canary"
slug: "integrate-cisco-umbrella-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-cisco-umbrella-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Cisco Umbrella with Zscaler MDR

**Integrating Cisco Umbrella with Zscaler MDR** provides a robust defense-in-depth strategy by combining cloud-based security with advanced threat detection and response. To integrate Cisco Umbrella with Zscaler MDR, follow the procedure below from beginning to end.

## **Step 1: Zscaler MDR–Create a Zscaler MDR email for alerts**

Create a Zscaler MDR provided-email to send Cisco Umbrella alerts for ingestion.

1. In the Zscaler MDR portal, click **Integrations**, then click **Add Integration**.

![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
2. Type and select Cisco Umbrella (DNS-layer Security).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/umbrella.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
3. Click **Configure**.
4. Enter a Name for your external alert source.
5. Select a Display Category.
6. Under the Ingest Format/Method dropdown, select **Cisco Umbrella via Email**.

> **Note**: Only Email should be selected for this alert source. For more information, see [Supported Integrations](/doc/docs/supported-integrations).

![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385505615511.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
7. Click **Save Configuration**. This will generate the email address you will use to send Cisco Umbrella alerts to.

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385505654551.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
8. Click **Edit Configuration**.
9. With your alert source configured, click **Activate**.
10. With your Zscaler MDR email generated, log in to Cisco Umbrella.

## **Step 2: Cisco Umbrella–Configure email alerts**

Adjust your Cisco Umbrella settings to send generated alerts to your Zscaler MDR-provided email.

1. From your Cisco Umbrella dashboard, click the **Reporting** dropdown, and then click **Scheduled Reports**.
2. Click **+Schedule**.
3. Click **Activity Search** or **Security Activity** depending on the type of information you want to send to Zscaler MDR.

![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385488955415.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
4. Select the type of information you want to include in your alert report.
5. Enter the recommended configurations below:
  - **Response**: `Blocked`
  - **Event type**: `Select All`

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385488998167.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
6. When you have selected all of the filters for your alert report, click **+Schedule**.
7. Review your filter selections, and then click **Continue**.
8. Select a Delivery Schedule, and then click **Continue**.

> **Note**: Zscaler MDR recommends you select **Daily** for the Delivery Schedule.

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385505682327.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
9. Enter a Name for your Report Title.
10. Enter the Zscaler MDR email provided in [Step 1.7](/docs/integrate-cisco-umbrella-with-red-canary#:~:text=Click%20Save%20Configuration.%20This%20will%20generate%20the%20email%20address%20you%20will%20use%20to%20send%20Cisco%20Umbrella%20alerts%20to.).

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385489029399.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A52Z&se=2026-11-04T16%3A02%3A52Z&sr=c&sp=r&sig=AEuERHU%2FdVRhlL3rS6SpZhVLPpQCdkFAAZINtsoQzYM%3D)
11. Click **Save**.