Umbrella IP Logs
Overview
Cisco Umbrella offers flexible, cloud-delivered security. It combines multiple security functions into one solution, so that protection can be extended to devices, remote users, and distributed locations anywhere. CISCO Umbrella is a leading provider of network security and recursive DNS services.
- Vendor: Cisco
- Supported environment: SaaS
- Detection based on: Telemetry
- Supported application or feature: Host network interface, Netflow/Enclave netflow, Network device logs, Network protocol analysis
Configure
This section will guide you to configure the forwarding of Cisco Umbrella logs to Sekoia.io by means of AWS S3 buckets.
Prerequisites
- Administrator access to the Cisco Umbrella console
- Access to Sekoia.io Intakes and Playbook pages with write permissions
- Administrator access to the Amazon console with permissions to create and manage S3 buckets, SQS queues, and IAM identities
AWS Authentication Setup
Sekoia.io supports two authentication methods to access your AWS resources. Choose the one that best fits your security requirements:
| Method | Summary | When to use |
|---|---|---|
| IAM Role with OIDC (Recommended) | Sekoia.io assumes an IAM Role using short-lived credentials issued via OpenID Connect (OIDC). No long-lived access keys are stored. | Preferred for new setups and security-conscious environments |
| Static Access Keys | A dedicated IAM user authenticates with a static access key and secret. | Existing setups or environments where OIDC federation is not available |
This method uses OpenID Connect (OIDC) federation so that Sekoia.io can assume an AWS IAM Role and obtain short-lived credentials automatically. No long-lived access keys are stored in Sekoia.io.
Step 1 — Register Sekoia.io as an OIDC Identity Provider in AWS IAM
- Open the IAM console and navigate to Identity providers.
- Click Add provider and select OpenID Connect.
- Fill in the form:
- Provider URL:
https://app.sekoia.io/api/v1/symphony/oidc - Audience:
sts.amazonaws.com
- Provider URL:
- Click Add provider to confirm.
Once created, note the Provider ARN (e.g. arn:aws:iam::XXXXXXXXXXXX:oidc-provider/app.sekoia.io/api/v1/symphony/oidc). You will need it in the steps below.
Step 2 — Create an IAM Role for Sekoia.io
- In the IAM console, navigate to Roles and click Create role.
- Select Web identity as the trusted entity type.
- Choose the
app.sekoia.io/api/v1/symphony/oidcidentity provider you just registered and set the audience tosts.amazonaws.com. -
Proceed to the Trust policy and replace its content with the following, substituting your AWS account ID, community UUID, and module configuration UUID:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::XXXXXXXXXXXX:oidc-provider/app.sekoia.io/api/v1/symphony/oidc" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "app.sekoia.io/api/v1/symphony/oidc:aud": "sts.amazonaws.com" }, "StringLike": { "app.sekoia.io/api/v1/symphony/oidc:sub": "community:<COMMUNITY_UUID>:modconf:<MODULE_CONFIGURATION_UUID>" } } } ] }
Step 3 — Attach a permission policy to the role
Attach an inline or managed policy granting the role read access to the SQS queue and S3 bucket:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::NAME_HERE"
},
{
"Effect": "Allow",
"Action": [
"sqs:GetQueueUrl",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": "arn:aws:sqs:REGION_HERE:XXXXXXXXXXXX:NAME_HERE"
}
]
}
Step 4 — Copy the Role ARN
After creating the role, note its ARN (e.g. arn:aws:iam::XXXXXXXXXXXX:role/ROLE_NAME). You will need it when configuring the connector in Sekoia.io.
Step 5 — Configure the Sekoia.io AWS module
In the Sekoia.io connector configuration, set the following fields:
- AWS Region (
aws_region_name): the AWS region where your resources are deployed (e.g.eu-west-1) - AWS Role ARN (
aws_role_arn): the ARN of the role you created above
Leave the Access Key and Secret Access Key fields empty — they are not used with this method.
This method authenticates using a dedicated IAM user with a static access key and secret access key stored in Sekoia.io.
Step 1 — Create a dedicated IAM user
Create a dedicated IAM user in the IAM console and generate programmatic access credentials (access key ID and secret access key) for that user.
Step 2 — Attach a resource-based policy to your SQS queue and S3 bucket
Ensure that the IAM user has the following permissions on your SQS queue and S3 bucket:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl"
],
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:user/USERNAME_HERE"
},
"Resource": "arn:aws:sqs:REGION_HERE:XXXXXXXXXXXX:NAME_HERE"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Principal": {
"AWS": "arn:aws:iam::XXXXXXXXXXXX:user/USERNAME_HERE"
},
"Resource": "arn:aws:s3:::NAME_HERE/*"
}
]
}
Step 3 — Configure the Sekoia.io AWS module
In the Sekoia.io connector configuration, set the following fields:
- AWS Region (
aws_region_name): the AWS region where your resources are deployed (e.g.eu-west-1) - Access Key (
aws_access_key): the access key ID of your IAM user - Secret Access Key (
aws_secret_access_key): the secret access key of your IAM user
Leave the AWS Role ARN field empty — it is not used with this method.
Create an AWS S3 Bucket
To create a new AWS S3 Bucket, please refer to this guide.
- On the AWS S3, go to
Bucketsand select our bucket. - Select
Permissionstab and go toBucket Policysection - Click
Editand paste the JSON Bucket policy from Cisco Umbrella - In the Policy, replace the
bucketnameplaceholde by the name of our bucket. - Click
Save changes.
Important
Keep in mind to conserve the /* when defining in the policy.
Configure Cisco Umbrella
- Log on the Cisco Umbrella console
- Go to
Admin>Log Management - In the
Amazon S3section, selectUse your company-managed Amazon S3 bucket -
In
Amazon S3 bucket, type the name of your bucket and clickVerify. -
On your AWS console, go in your bucket.
- In the
Objectstab, click onREADME_FROM_UMBRELLA.txtthen click onOpen - Copy the token from the readme
- On the Cisco Umbrella console, in the field
Token Number, paste the token and clickSave
Note
After clicking Verify, the message Great! We successfully verified your Amazon S3 bucket must be displayed
Note
After clicking Save, the message We’re sending data to your S3 storage must be displayed
Important
According to the type of the logs, the objects will be prefixed with dnslogs/ for DNS logs, proxylogs for proxy logs, iplogs for ip logs, ...
Create a SQS queue
The collect will rely on S3 Event Notifications (SQS) to get new S3 objects.
- Create a queue in the SQS service by following this guide
- In the Access Policy step, choose the advanced configuration and adapt this configuration sample with your own SQS Amazon Resource Name (ARN) (the main change is the Service directive allowing S3 bucket access):
{ "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__owner_statement", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "SQS:SendMessage", "Resource": "arn:aws:sqs:XXX:XXX" } ] }
Important
Keep in mind that you have to create the SQS queue in the same region as the S3 bucket you want to watch.
Create a S3 Event notification
Use the following guide to create S3 Event Notification. Once created:
- In the General configuration, type
iplogs/as the Prefix - Select the notification for object creation in the Event type section
- As the destination, choose the SQS service
- Select the queue you created in the previous section
Configure Your Intake
This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.
- Go to the Sekoia Intake page.
- Click on the
+ New Intakebutton at the top right of the page. - Search for your Intake by the product name in the search bar.
- Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
- Click on
Create.
Note
For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.
Configure Your Playbook
This section will assist you in pulling remote logs from Sekoia and sending them to the intake you previously created.
- Go to the Sekoia playbook page.
- Click on the
+ New playbookbutton at the top right of the page. - Select
Create a playbook from scratch, and clickNext. - Give it a Name and a Description, and click
Next. - Choose a trigger from the list by searching for the name of the product, and click
Create. - A new Playbook page will be displayed. Click on the module in the center of the page, then click on the Configure icon.
- On the right panel, click on the
Configurationtab. - Select an existing Trigger Configuration (from the account menu) or create a new one by clicking on
+ Create new configuration. - Configure the Trigger based on the Actions Library (for instance, see here for AWS modules), then click
Save. - Click on
Saveat the top right of the playbook page. - Activate the playbook by clicking on the "On / Off" toggle button at the top right corner of the page.
Info
Refer to the AWS Authentication Setup section above for instructions on configuring either OIDC (recommended) or static access keys.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
"2020-06-12 14:31:52","FR123","1.1.1.1","54128","2.2.2.2","443","","Roaming Computers"
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Cisco Umbrella IP. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Cisco Umbrella IP on ATT&CK Navigator
Cryptomining
Detection of domain names potentially related to cryptomining activities.
- Effort: master
Dynamic DNS Contacted
Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.
- Effort: master
Exfiltration Domain
Detects traffic toward a domain flagged as a possible exfiltration vector.
- Effort: master
Remote Access Tool Domain
Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).
- Effort: master
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Sekoia.io EICAR Detection
Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.
- Effort: master
TOR Usage Generic Rule
Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.
- Effort: master
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Host network interface |
every packets are logged |
Netflow/Enclave netflow |
Umbrella IP logs are Netflow-like |
Network device logs |
packets logged by Umbrella IP |
Network protocol analysis |
traffic analysis at levels 2/3/4 |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": " \"2020-06-12 14:31:52\",\"FR123\",\"1.1.1.1\",\"54128\",\"2.2.2.2\",\"443\",\"\",\"Roaming Computers\"",
"event": {
"outcome": "success"
},
"@timestamp": "2020-06-12T14:31:52Z",
"action": {
"name": "block",
"outcome": "success",
"target": "network-traffic"
},
"destination": {
"address": "2.2.2.2",
"ip": "2.2.2.2",
"port": 443
},
"host": {
"hostname": "FR123",
"name": "FR123"
},
"related": {
"hosts": [
"FR123"
],
"ip": [
"1.1.1.1",
"2.2.2.2"
]
},
"source": {
"address": "1.1.1.1",
"ip": "1.1.1.1",
"port": 54128
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.target |
keyword |
Target of the action |
destination.ip |
ip |
IP address of the destination. |
destination.port |
long |
Port of the destination. |
host.hostname |
keyword |
Hostname of the host. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.