Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Cisco Umbrella Cloud Connector

Cisco Umbrella is a cloud-based Secure Internet Gateway (SIG) platform that offers multiple levels of security against internet-based threats. Cisco Umbrella unifies firewall, secure web gateway, DNS-layer security, threat intelligence solutions, and cloud access security broker (CASB) into a single platform. Cisco Umbrella protects internet access across all network devices, locations, and roaming users. For more information, see the Cisco Umbrella documentation.

Prerequisites to Configure the Cisco Umbrella Connector

Before you configure the Cisco Umbrella connector you must obtain the Cisco managed S3 bucket data including the access key, secret key, folder prefix, and the S3 bucket name.

Before you configure the Cisco Umbrella connector:

  • Obtain the Cisco managed S3 bucket data including the access key, secret key, folder prefix, and the S3 bucket name.

  • Obtain the company managed S3 bucket data, if you want to use S3 bucket managed by your organization.

  • Have full administrative access to Cisco Umbrella.

Obtain the Cisco Managed S3 Bucket Data

Cisco Umbrella APIs are authenticated via application keys. You must obtain the access key, secret key, folder prefix, and S3 bucket name to use while configuring the Cisco Umbrella for endpoints connector.

To obtain an application key and client ID:

  1. Log in to Cisco Umbrella console by accessing https://login.umbrella.com/ as an administrator.

  2. Navigate to Admin > Log Management.

  3. Click Cisco-managed Amazon S3 bucket.

  4. Select a region in the list. The regional endpoints are required to reduce latency while downloading logs to your servers. Select a region that is closer to you.

  5. Select a time-period from the Select a Retention Duration list and click Save. After the selected time-period, all the data is purged and cannot be retrieved.

  6. In the confirmation box that displays selected region and retention duration, click Continue to confirm the settings.

    1. Cisco sends an activation notification. When the activation is complete, the Amazon S3 Summary page displays the data path, an access key, and a secret key.

    2. Record the values for the data path, access key, and secret key. The values appear only once, if you lose the key values, you must regenerate the values.

  7. After noting the values, select the Got it check box, and click Continue.

    For more information, see the Cisco Umbrella documentation. The data path value contains S3 bucket name and folder prefix. The data value looks like this: s3://bucketname/f1/f2/f3. Use the values while configuring the Cisco Umbrella Connector on the Exabeam Cloud Connector platform.

Obtain the Company Managed S3 Bucket Data

Create a bucket policy to grant other AWS accounts or IAM users access permissions for the bucket and the objects in the bucket. For more information see Amazon S3 bucket policies.

To create or edit the bucket policy:

  1. In the AWS management console, edit the bucket policy to ensure that the bucket accepts uploads from Cisco Umbrella by replacing bucketname with the S3 bucket name that you specify in the following JSON file using the bucket policy text editor. For more information see the Cisco Umbrella Documentation and the AWS bucket policy guide.

    1{ 2"Version": "2008-10-17",a 3"Statement": [ 4{ 5"Sid": "", 6"Effect": "Allow", 7"Principal": { 8"AWS": "arn:aws:iam::568526795995:user/logs" 9}, 10"Action": "s3:PutObject", 11"Resource": "arn:aws:s3:::bucketname/*" 12}, 13{ 14"Sid": "", 15"Effect": "Deny", 16"Principal": { 17"AWS": "arn:aws:iam::568526795995:user/logs" 18}, 19"Action": "s3:GetObject", 20"Resource": "arn:aws:s3:::bucketname/*" 21}, 22 23{ 24"Sid": "", 25"Effect": "Allow", 26"Principal": 27 28{ "AWS": "arn:aws:iam::568526795995:user/logs" } 29 30, 31"Action": "s3:GetBucketLocation", 32"Resource": "arn:aws:s3:::bucketname" 33}, 34 35{ 36"Sid": "", 37"Effect": "Allow", 38"Principal": { 39"AWS": "arn:aws:iam::568526795995:user/logs" 40}, 41"Action": "s3:ListBucket", 42"Resource": "arn:aws:s3:::bucketname" 43} 44] 45}

  2. In the Cisco Umbrella console, navigate to Admin > Log Management.

  3. Click Use your company-managed Amazon S3 bucket.

  4. In the Amazon S3 bucket box, type the S3 bucket name that you specified in the JSON file.

  5. Click Verify.

  6. Cisco Umbrella verifies and connects to the bucket and saves a README_FROM_UMBRELLA.txt file to the bucket.

  7. Copy the token from the README_FROM_UMBRELLA.txt file that Cisco Umbrella saved to your bucket.

  8. Paste the token in the Token Number box.

  9. Click Save.

Configure the Cisco Umbrella Connector

Cisco Umbrella is a cloud-based Secure Internet Gateway (SIG) platform that offers multiple levels of security against internet-based threats. Cisco Umbrella unifies firewall, secure web gateway, DNS-layer security, threat intelligence solutions, and cloud access security broker (CASB) into a single platform. Cisco Umbrella protects internet access across all network devices, locations, and roaming users. For more information, see the Cisco Umbrella documentation.

The following table displays audit source API and security events supported by the connector.

Audit Source: API

Service or Module Covered

Event Included

Security Activity

Any

All

Table 5. Audit source API and security events supported by the connector


To configure the Cisco Umbrella connector to import data into the Exabeam Cloud Connector platform:

  1. Complete the Prerequisites to Configure the Cisco Umbrella Connector.

  2. Log in to the Exabeam Cloud Connectors platform with your registered credentials.

  3. Navigate to Settings > Accounts > Add Account.

  4. Click Select Service to Add, and then select Cisco Umbrella from the list.

  5. In the Accounts section enter the required information.

    1. Tenant – Select a tenant to attach to the connector if you are using a multi-tenant edition of Exabeam. Otherwise, select default.

    2. Account Name – Specify a name for the Cisco Umbrella connector. For example, Corporate Cisco Umbrella SIG for Endpoints.

    3. (Optional) Description – Describe the Cisco Umbrella connector. For example, Cisco Umbrella SIG for internet security.

    4. Access Key – Enter the value for the access key represented by a string of letters and numbers, that you obtained while completing prerequisites.

    5. Secret Key – Enter the value for the secret key represented by a string of letters and numbers, that you obtained while completing prerequisites.

    6. S3 Bucket Name – Enter the bucket name mentioned in the initial part of the value for data path that you obtained while completing prerequisites for Cisco managed Amazon S3 bucket. Enter the S3 bucket name that you specified in the AWS console while completing prerequisites for company-managed Amazon S3 bucket.

    7. Folder (Prefix) – Enter the value for the folder prefix mentioned in the later part of the data path that you obtained while completing prerequisites. For example, in the data path s3://bucketname/f1/f2/f3, the f/f2/f3 represents the folder prefix.

      Note

      Required fields are indicated with a red bar.

  6. To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

  7. Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

  8. To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.

Troubleshoot for the Cisco Umbrella Connector

Problem: Events are not received in DL and CC UI for a certain endpoint.

Solution: The Exabeam DNS, Proxy, and IP Cisco Umbrella endpoints work in pairs. Exabeam uses the Explorer endpoint to read the log file names stored in the S3 bucket, then uses the data endpoint to retrieve data. Each endpoint in Cisco Umbrella has an explorer endpoint. Check if the explorer endpoint of the endpoint that is not collecting data is active. For example, if you want to use the DNS endpoint, ensure that the DNS-explorer endpoint is active.