Integrating Cisco Umbrella with SecurityCoach

In this article, you will learn how to integrate Cisco Umbrella with SecurityCoach. Once you set up this integration, data provided by Cisco Umbrella will be available under the SecurityCoach tab of your KMSAT console. This data can be viewed in SecurityCoach reports and used to create detection rules for real-time coaching campaigns. For general information about SecurityCoach, see our SecurityCoach Product Manual.

To set up this integration, you will need access to a Cisco administrator account. Click the links below to learn how to integrate Cisco Umbrella with SecurityCoach.

Jump to:
Create an API Key and API Secret
Set Up or Update the Integration in Your KMSAT Console

• Set Up the Integration in Your KMSAT Console
  Update the Integration in Your KMSAT Console

Create an API Key and API Secret

You'll need to create an API key and API secret in your Cisco Umbrella console for this integration. Follow the steps below to create an API key and API secret.

1. Log into your Cisco Umbrella administrator account.
2. Navigate to Admin > API Keys.

3. From the top-right corner of the page, click Add.

4. Enter a name for your application, such as “SecurityCoachAPIAccess”.

5. In the Key Scope section, select the Reports option. Then, select Read-Only for the selected scope and resource.

6. For the Expiry Date, select Never expire.

7. Click Create Key.

8. Copy and save the API Key and API Secret somewhere that you can easily access.

   Note: You will need these credentials to complete the process outlined in the Set Up the Integration in Your KMSAT Console section of this article below.

   
9. Click Accept and Close.

Back to top

Set Up or Update the Integration in Your KMSAT Console

Once you have created your Cisco Umbrella API key and API secret, you can set up the integration in your KMSAT console. If you created a new API key and API secret for an existing integration, you can also update your integration in your KMSAT console.

To learn how to set up or update your Cisco Umbrella integration, see the subsections below.

Set Up the Integration in Your KMSAT Console

To set up the integration in your KMSAT console, follow the steps below:

1. Log in to your KMSAT console and navigate to SecurityCoach > Setup > Security Vendor Integrations.
2. Locate Cisco Umbrella and click Configure.

   

3. Enter your API Key and API Secret in the corresponding fields.
4. Click Authorize.

Once you’ve successfully authorized this integration, you can manage detection rules for Cisco Umbrella on the Detection Rules subtab of SecurityCoach. For a full list of available system detection rules for this vendor, see our Which Detection Rules Can I Use with My Vendors? article.

Back to top

Update the Integration in Your KMSAT Console

To update your integration with a new API key and API secret, follow the steps below:

1. Log in to your KMSAT console and navigate to SecurityCoach > Setup > Security Vendor Integrations.
2. Locate Cisco Umbrella and click Edit.
3. Click Update Registration to update the existing integration.
   
4. Update the values in the API Key and API Secret fields.
5. Click Authorize.

Back to top