Skip to main content

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Cisco Umbrella Cloud Collector

Complete the following prerequisites to configure the Cisco Umbrella Cloud Collector:

  • Obtain the Cisco managed S3 bucket data including the access key, secret key, data path, and the S3 bucket name, if you want to use S3 bucket managed by Cisco.

  • Obtain the company managed S3 bucket data, if you want to use S3 bucket managed by your organization.

  • Add Accounts for AWS Cloud Collectors to use the same account information across multiple Cisco Umbrella cloud collectors.

  • Get full administrative access to Cisco Umbrella.

Obtain the Cisco Managed S3 Bucket Data

Cisco Umbrella APIs are authenticated via application keys. You must obtain the Cisco managed S3 bucket data that contains access key, secret key, data path, and S3 bucket name to use while configuring the Cisco Umbrella Cloud Collector.

To obtain Cisco managed S3 bucket data that contains access key, secret key, and client ID:

  1. Log in to the Cisco Umbrella console by accessing https://login.umbrella.com/ as an administrator.

  2. Navigate to Admin > Log Management.

    Cisco_Managed_S3_Bucket_Data_1-1.png

  3. Click Use a Cisco-managed Amazon S3 bucket.

    Cisco_Managed_S3_Bucket_Data_1.png

  4. Select a region that is closer to you. The regional endpoints are required to reduce latency while downloading logs to your servers.

  5. Select a time-period from the Select a Retention Duration list and click Save. After the selected time-period, all the data is purged and cannot be retrieved.

  6. In the confirmation box that displays selected region and retention duration, click Continue to confirm the settings.

    Cisco sends an activation notification. When the activation is complete, the Amazon S3 Summary page displays the data path, an access key, and a secret key.

  7. Record the values for the data path, access key, and secret key. The values appear only once, if you lose the key values, you must regenerate the values.

    Cisco_Managed_S3_Bucket_Data_2.png

  8. After noting the values, select Got it, and click Continue. For more information, see the Cisco Umbrella documentation. The data path value contains S3 bucket name and data path. Note the values to use them while configuring the Cisco Umbrella Cloud Collector on the Exabeam Security Operations Platform.

  9. Proceed to Configure the Cisco Umbrella Cloud Collector.

Obtain the Company Managed S3 Bucket Data

Create a bucket policy to grant other AWS accounts or IAM users access permissions for the bucket and the objects in the bucket. For more information see Amazon S3 bucket policies.

To create or edit the bucket policy:

  1. In the AWS management console, edit the bucket policy to ensure that the bucket accepts uploads from Cisco Umbrella by replacing bucketname with the S3 bucket name that you specify in the JSON file using the bucket policy text editor. For more information see the Cisco Umbrella Documentation and the AWS bucket policy guide.

  2. In the Cisco Umbrella console, navigate to Admin > Log Management.

  3. Click Use your company-managed Amazon S3 bucket.

    Cisco_Managed_S3_Bucket_Data_3.png

  4. Enter the Amazon S3 bucket name that you specified in the JSON file.

  5. Click Verify.

    Cisco Umbrella verifies and connects to the bucket and saves a README_FROM_UMBRELLA.txt file to the bucket.

  6. Copy the token from the README_FROM_UMBRELLA.txt file that Cisco Umbrella saved to your bucket.

  7. Paste the token in the Token Number field.

  8. Click Save.

  9. Proceed to Configure the Cisco Umbrella Cloud Collector.