Cisco Umbrella

You can integrate Cisco Umbrella with Sophos Fusion so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Cisco Umbrella product overview

Cisco Umbrella is a cloud-delivered security service that provides comprehensive protection against internet-based threats. It is designed to secure access to the internet for users both inside and outside the corporate network, offering a first line of defense against cybersecurity threats.

What we ingest

Sophos XDR can collect Cisco Umbrella data in two ways:

• API pull: Sophos XDR calls Cisco Umbrella APIs on a schedule, using the API key and related settings from your Cisco Umbrella integration.
• Customer-Managed S3: Sophos XDR receives Cisco Umbrella logs from an Amazon S3 bucket in your AWS account. Cisco Umbrella exports logs to the bucket, and a forwarding function deployed from a CloudFormation template sends them to Sophos XDR.

The two methods don't always collect the same scope of data. The table below explains the differences.

Umbrella returns JSON activity and log-style exports (for example, unified activity with types such as DNS, firewall, intrusion, and proxy, plus DNS export rows and advanced malware protection payloads where enabled). Sophos XDR ingests those records for the Umbrella organization associated with your credentials and supported by your subscription.

Depending on the Umbrella edition, policies, and threats observed, events can reflect threats such as those shown below:

• Malware
• Cryptomining
• High-risk sites and locations
• Phishing
• Command and control
• Dynamic DNS

See Event and data types for a more detailed summary of how data types get normalized to events.

Event and data types

Cisco Umbrella event coverage depends on the following:

• The ingest method you use.
• Your Cisco Umbrella edition.
• The services you've turned on.
• The logs or activity feeds you send to Sophos XDR.

API pull

The API pull method ingests security-relevant Cisco Umbrella event categories.

Customer-Managed S3

The Customer-Managed S3 method ingests a broader set of Cisco Umbrella data than the API pull method. We ingest the following event and data types:

• DNS activity and DNS-layer policy: Unified activity JSON with type dns (domain, verdict, querytype, identities, categories, threats when present) and exported DNS log rows (client/resolver IPs, query type, response code, domain, policy outcome, categories). Normalized to DNS query telemetry. Additionally, JSON DNS activity may include threat classification fields when relevant. Exported DNS logs may include fields that describe blocking events and security category context, similar to third-party security alerts.

• Intrusion detection: Unified activity JSON with type intrusion: severity, verdict, and endpoint addresses for IPS-style detections. Normalized to third-party security alert telemetry.
• Secure web proxy (HTTP/HTTPS): Unified activity JSON with type proxy (url, statuscode, port, verdict, timestamps) and HTTP/S proxy export formats. Normalized to HTTP-style telemetry.
• Advanced malware protection (file reputation): JSON payloads with disposition, sha256, malwarename, and related fields where the file isn't clean. Normalized to antivirus / file protection telemetry.

Data provided by this integration

Data provided by Cisco Umbrella gets normalized to the following schemas:

• antivirus
• dnsquery

• http

• thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation

• Cisco Umbrella - Add Umbrella API Keys
• Enable Logging to Your Own S3 Bucket
• Use Cases and Best Practices