Note, these scripts are provided as examples and customization or updates may be required.The Umbrella Enforcement API allows partners and customers with their own homegrown SIEM/Threat Intelligence Platform (TIP) environments to inject events and/or threat intelligence into their Umbrella environment. The OpenDNS Umbrella Enforcement API Developer Hub Welcome to the OpenDNS Umbrella Enforcement API developer hub. All received events will be segmented by the mutual customer and used for future enforcement.In order to successfully integrate you will need to format your events to meet the public format included in this document. All requests must include your API key and secret. Let's jump right in!
You may also list the domains and delete individual domains from the list. The API is designed to give technology partners the ability to send security events from their platform/service/appliance within a mutual customer’s environment to the Cisco security cloud for enforcement. This API is a REST API and follows RESTful principles in implementation.Welcome to the OpenDNS Umbrella Enforcement API developer hub.
Let's jump right in!You can only suggest edits to Markdown body content, but not to the API spec.All responses are served as JSON and authentication is required for all requests. The API makes extensive use of query strings to retrieve and filter resources. Cisco Umbrella: The Umbrella Enforcement API for Custom Integrations; Log Export Format and Versioning; Roaming Client for Windows – Version 2.2.150; Comments 0 comments. You'll find comprehensive guides and documentation to help you start working with OpenDNS Umbrella Enforcement API as quickly … If you are a customer of either ThreatConnect or ThreatQuotient, you could use the Umbrella integrations with those products to avoid writing any custom code.You might already process, manage, and curate your own threat intelligence system and processes that result in the desire to take actions on domains identified as malicious or suspicious. They can also optionally leverage Cisco Investigate to enrich those systems.If your workflow includes the unblocking of domains that were blocked because of previously injected events, a DELETE request will allow you to remove a domain from the destination list associated with that integration.You can also view the Activity Volume report to see the snapshot or trend over time tally reports including your custom integration(s).The following perl scripts provide guidance on how you can generate an event for your custom integration. The OpenDNS Umbrella Enforcement API Developer Hub Welcome to the OpenDNS Umbrella Enforcement API developer hub. Thus, traffic associated with the custom integration can optionally be ingested back into your SIEM/TIP and the feedback loop closed.Now that you’ve validated that you can inject events (and optionally list and delete domains), you can configure what you want to happen to DNS requests from your identities that are destined for domains in your custom integration’s security category.If your workflow includes the unblocking of domains that were blocked because of previously injected events, a LIST request will provide all of the domains currently included in the destination list associated with that integration.If it passes validation (for example, it’s unknown and safe to block), it’s added to a destination list associated with that custom integration and surfaced within the Umbrella dashboard as a custom security category.In the following example, the organization is using both Umbrella and Investigate alongside their own SIEM/TIP, and are leveraging a few of our APIs to create a full feedback loop.Using the Enforcement API docs, the organization writes custom scripts that can inject events and list or delete domains added to the custom integration’s security category as a result of previous events. In essence, you are able to create a destination list in Umbrella from an external source that you manage directly through the API, then choose to block those destinations for identities within Umbrella.When you expand the entry, you should see the event which resulted in your sample event (creditcards.com) being added to your custom integration.You can have up to 10 custom integrations at a time. (Note: if the organization is a child org of an Umbrella MSP, MSSP, or MOC, custom integrations shared from the console level will show up before integrations created at the child org level.