Setting Up Cisco Umbrella Integration

Summary

In order for the Check Point MDR team to monitor your Cisco Umbrella integration, we will require integration with your Cisco Umbrella portal.  

Note:  You must have an administrator account to create the proper permissions.  

If you need any assistance with this procedure, please open a ticket in the MDR Customer portal under "MDR Support" or if you are currently onboarding reply to your welcome email, and we will schedule a time to assist.

Note: We will need these four items filled in on the MDR customer portal profile page when adding the integration also ensure the procedure outlined below is completed before adding:

• Client ID (Key)
• Client Secret
• Client URL (you can enter the following)

https://reports.api.umbrella.com/v2/organizations/

• Org ID

Procedure

• Log in to your Cisco Umbrella portal as an administrator account.
• Click Admin > API Keys and click Create; or in a management console (Multi-org, MSP, or MSSP), navigate to Settings > API Keys and click Add.
• Select Umbrella Reporting and click Generate Token.
• Expand Umbrella Reporting and copy Your Key and Your Secret.
• ClickTo keep it secure, ...check the box, and then click Close.

You must acknowledge that your key and secret are only displayed once to activate the Close button.

Note: You have only one opportunity to copy your secret. Umbrella does not save the Reporting v2 API secret and it cannot be retrieved after its initial creation.