Cisco Umbrella DNS

Overview

Cisco Umbrella offers flexible, cloud-delivered security. It combines multiple security functions into one solution, so that protection can be extended to devices, remote users, and distributed locations anywhere.

The following Sekoia.io built-in rules match the intake Cisco Umbrella DNS. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Cisco Umbrella DNS on ATT&CK Navigator

Cisco Umbrella Threat Detected

Cisco Umbrella has detected a malicious traffic categorized as malware, phishing or adware.

Effort: intermediate

Cryptomining

Detection of domain names potentially related to cryptomining activities.

Effort: master

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

Effort: master

Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

Effort: master

Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

Effort: master

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

Effort: elementary

Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

Effort: master

Sliver DNS Beaconing

Detects suspicious DNS queries known from Sliver beaconing

Effort: intermediate

TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
`DNS records`	DNS queries are fully analyzed
`Network device logs`	DNS queries logged by Umbrella DNS

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

DNS_Tunnel.jsonumbrella-dns-1.jsonumbrella-dns-2.jsonumbrella-dns-3.jsonumbrella-dns-5.jsonumbrella-dns-6.json

{
    "message": " \"2021-02-21 15:30:49\",\"CORP - IP INTERNET\",\"CORP - IP INTERNET\",\"1.1.1.1\",\"1.1.1.1\",\"Blocked\",\"1 (A)\",\"NOERROR\",\"something.net\",\"DNS Tunneling VPN\",\"Networks\",\"Networks\",\"DNS Tunneling VPN\"",
    "event": {
        "outcome": "success"
    },
    "@timestamp": "2021-02-21T15:30:49Z",
    "action": {
        "name": "DNS query",
        "outcome": "success",
        "properties": {
            "Categories": "DNS Tunneling VPN"
        },
        "target": "network-traffic",
        "type": "blocked"
    },
    "dns": {
        "question": {
            "name": "something.net",
            "registered_domain": "something.net",
            "top_level_domain": "net",
            "type": "A"
        },
        "response_code": "NOERROR",
        "size_in_char": "13",
        "type": "query"
    },
    "related": {
        "hosts": [
            "something.net"
        ],
        "ip": [
            "1.1.1.1"
        ],
        "user": [
            "CORP - IP INTERNET"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "nat": {
            "ip": "1.1.1.1"
        }
    },
    "user": {
        "name": "CORP - IP INTERNET"
    }
}

{
    "message": " \"2020-06-12 14:29:47\",\"client\",\"client,FRBCORP\",\"1.1.1.1\",\"2.2.2.2\",\"Allowed\",\"1 (A)\",\"NOERROR\",\"client group\",\"Software/Technology,Business Services,Infrastructure,SaaS and B2B,Science and Technology,Application\",\"AD Users\",\"AD Users,Roaming Computers\",\"\"",
    "event": {
        "outcome": "success"
    },
    "@timestamp": "2020-06-12T14:29:47Z",
    "action": {
        "name": "DNS query",
        "outcome": "success",
        "properties": {
            "Categories": "Software/Technology,Business Services,Infrastructure,SaaS and B2B,Science and Technology,Application"
        },
        "target": "network-traffic",
        "type": "allowed"
    },
    "dns": {
        "question": {
            "name": "client group",
            "type": "A"
        },
        "response_code": "NOERROR",
        "size_in_char": "12",
        "type": "query"
    },
    "related": {
        "hosts": [
            "client group"
        ],
        "ip": [
            "1.1.1.1",
            "2.2.2.2"
        ],
        "user": [
            "client"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "nat": {
            "ip": "2.2.2.2"
        }
    },
    "user": {
        "name": "client"
    }
}

{
    "message": " \"2020-06-12 14:29:48\",\"ERT - IP INTERNET\",\"ERT - IP INTERNET\",\"1.1.1.1\",\"1.1.1.1\",\"Allowed\",\"Other\",\"NXDOMAIN\",\"_ldap._tcp.dc._msdcs.subdomain.corp.intra.\",\"\",\"Networks\",\"Networks\",\"\"",
    "event": {
        "outcome": "failure"
    },
    "@timestamp": "2020-06-12T14:29:48Z",
    "action": {
        "name": "DNS query",
        "outcome": "failure",
        "outcome_reason": "NXDOMAIN",
        "target": "network-traffic",
        "type": "allowed"
    },
    "dns": {
        "question": {
            "name": "_ldap._tcp.dc._msdcs.subdomain.corp.intra",
            "subdomain": "_ldap._tcp.dc._msdcs.subdomain.corp"
        },
        "response_code": "NXDOMAIN",
        "size_in_char": "42",
        "type": "query"
    },
    "related": {
        "hosts": [
            "_ldap._tcp.dc._msdcs.subdomain.corp.intra"
        ],
        "ip": [
            "1.1.1.1"
        ],
        "user": [
            "ERT - IP INTERNET"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "nat": {
            "ip": "1.1.1.1"
        }
    },
    "user": {
        "name": "ERT - IP INTERNET"
    }
}

{
    "message": "\"2024-03-04 11:17:25\",\"Firstname LASTNAME (firstname.lastname@corp.com)\",\"Firstname LASTNAME \n(firstname.lastname@corp.com),FR01-MDBBC-L029.hdb.int,CORP_RANGE_01,CORP\",\"10.1.1.1\",\"80.1.1.1\",\"Allowed\",\"1 (A)\",\"NXDOMAIN\",\"10.1.1.1_1.\",\"\",\"AD Users\",\"AD Users,AD \nComputers,Internal Networks,Sites\",\"\"",
    "event": {
        "outcome": "failure"
    },
    "@timestamp": "2024-03-04T11:17:25Z",
    "action": {
        "name": "DNS query",
        "outcome": "failure",
        "outcome_reason": "NXDOMAIN",
        "target": "network-traffic",
        "type": "allowed"
    },
    "dns": {
        "question": {
            "name": "10.1.1.1_1",
            "subdomain": "10.1.1",
            "type": "A"
        },
        "response_code": "NXDOMAIN",
        "size_in_char": "11",
        "type": "query"
    },
    "related": {
        "hosts": [
            "10.1.1.1_1"
        ],
        "ip": [
            "10.1.1.1",
            "80.1.1.1"
        ],
        "user": [
            "Firstname LASTNAME (firstname.lastname@corp.com)"
        ]
    },
    "source": {
        "address": "10.1.1.1",
        "ip": "10.1.1.1",
        "nat": {
            "ip": "80.1.1.1"
        }
    },
    "user": {
        "name": "Firstname LASTNAME (firstname.lastname@corp.com)"
    }
}

{
    "message": " \"2024-01-15 17:29:16\",\"CORP - IP INTERNET\",\"CORP - IP INTERNET\",\"1.1.1.1\",\"1.1.1.1\",\"Allowed\",\"1 (A)\",\"NOERROR\",\"emea.corp.\",\"\",\"Networks\",\"Networks\",\"\"",
    "event": {
        "outcome": "success"
    },
    "@timestamp": "2024-01-15T17:29:16Z",
    "action": {
        "name": "DNS query",
        "outcome": "success",
        "target": "network-traffic",
        "type": "allowed"
    },
    "dns": {
        "question": {
            "name": "emea.corp",
            "subdomain": "emea",
            "type": "A"
        },
        "response_code": "NOERROR",
        "size_in_char": "10",
        "type": "query"
    },
    "related": {
        "hosts": [
            "emea.corp"
        ],
        "ip": [
            "1.1.1.1"
        ],
        "user": [
            "CORP - IP INTERNET"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "nat": {
            "ip": "1.1.1.1"
        }
    },
    "user": {
        "name": "CORP - IP INTERNET"
    }
}

{
    "message": " \"2024-03-12 09:09:48\",\"CD111\",\"CD111\",\"1.1.1.1\",\"1.1.1.1\",\"Allowed\",\"1 (A)\",\"NOERROR\",\"substrate.office.com.\",\"Software/Technology,Webmail,Business Services,Allow List,Organizational Email,Application,Web-based Email,Computers and Internet\",\"Anyconnect Roaming Client\",\"Anyconnect Roaming Client\",\"Allow List\"",
    "event": {
        "outcome": "success"
    },
    "@timestamp": "2024-03-12T09:09:48Z",
    "action": {
        "name": "DNS query",
        "outcome": "success",
        "properties": {
            "Categories": "Software/Technology,Webmail,Business Services,Allow List,Organizational Email,Application,Web-based Email,Computers and Internet"
        },
        "target": "network-traffic",
        "type": "allowed"
    },
    "dns": {
        "question": {
            "name": "substrate.office.com",
            "registered_domain": "office.com",
            "subdomain": "substrate",
            "top_level_domain": "com",
            "type": "A"
        },
        "response_code": "NOERROR",
        "size_in_char": "21",
        "type": "query"
    },
    "related": {
        "hosts": [
            "substrate.office.com"
        ],
        "ip": [
            "1.1.1.1"
        ],
        "user": [
            "CD111"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "nat": {
            "ip": "1.1.1.1"
        }
    },
    "user": {
        "name": "CD111"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
`@timestamp`	`date`	Date/time when the event originated.
`action.properties.Categories`	`keyword`
`action.target`	`keyword`	the target of the action
`dns.question.name`	`keyword`	The name being queried.
`dns.question.type`	`keyword`	The type of record being queried.
`dns.response_code`	`keyword`	The DNS response code.
`dns.size_in_char`	`keyword`
`dns.type`	`keyword`	The type of DNS event captured, query or answer.
`source.ip`	`ip`	IP address of the source.
`source.nat.ip`	`ip`	Source NAT ip
`user.name`	`keyword`	Short name or login of the user.

Configure

This section will guide you to configure the forwarding of Cisco Umbrella logs to Sekoia.io by means of AWS S3 buckets.

Prerequities

Administrator access to the Cisco Umbrella console
Access to Sekoia.io Intakes and Playbook pages with write permissions
Access to AWS S3 and AWS SQS

Create an AWS S3 Bucket

To create a new AWS S3 Bucket, please refer to this guide.

On the AWS S3, go to Buckets and select our bucket.
Select Permissions tab and go to Bucket Policy section
Click Edit and paste the JSON Bucket policy from Cisco Umbrella
In the Policy, replace the bucketname placeholde by the name of our bucket.
Click Save changes.

Important

Keep in mind to conserve the /* when defining in the policy.

Configure Cisco Umbrella

Log on the Cisco Umbrella console
Go to Admin > Log Management
In the Amazon S3 section, select Use your company-managed Amazon S3 bucket
In Amazon S3 bucket, type the name of your bucket and click Verify.
On your AWS console, go in your bucket.
In the Objects tab, click on README_FROM_UMBRELLA.txt then click on Open
Copy the token from the readme
On the Cisco Umbrella console, in the field Token Number, paste the token and click Save

Note

After clicking Verify, the message Great! We successfully verified your Amazon S3 bucket must be displayed

Note

After clicking Save, the message We’re sending data to your S3 storage must be displayed

Important

According to the type of the logs, the objects will be prefixed with dnslogs/ for DNS logs, proxylogs for proxy logs, iplogs for ip logs, ...

Create a SQS queue

The collect will rely on S3 Event Notifications (SQS) to get new S3 objects.

Create a queue in the SQS service by following this guide

In the Access Policy step, choose the advanced configuration and adapt this configuration sample with your own SQS Amazon Resource Name (ARN) (the main change is the Service directive allowing S3 bucket access):

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__owner_statement",
      "Effect": "Allow",
      "Principal": {
    "Service": "s3.amazonaws.com"
      },
      "Action": "SQS:SendMessage",
      "Resource": "arn:aws:sqs:XXX:XXX"
    }
  ]
}

Important

Keep in mind that you have to create the SQS queue in the same region as the S3 bucket you want to watch.

Create a S3 Event notification

Use the following guide to create S3 Event Notification. Once created:

In the General configuration, type dnslogs/ as the Prefix
Select the notification for object creation in the Event type section
As the destination, choose the SQS service
Select the queue you created in the previous section

Create the intake

Go to the intake page and create a new intake from the format Cisco Umbrella DNS.

Pull events

To start to pull events, you have to:

Go to the playbook page and create a new playbook with the AWS Fetch new logs on S3 connector
Set up the module configuration with the AWS Access Key, the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created
Start the playbook and enjoy your events

Cisco Umbrella DNS

Overview

Related Built-in Rules

Event Categories

Event Samples

Extracted Fields

Configure

Prerequities

Create an AWS S3 Bucket

Configure Cisco Umbrella

Create a SQS queue

Create a S3 Event notification

Create the intake

Pull events

Further Readings