ThreatConnect and Cisco Umbrella Integration Overview
With integration between ThreatConnect and Cisco Umbrella, security officers and administrators are now able to extend protection against today's advanced threats to roaming laptops, tablets or phones while also providing another layer of enforcement to a distributed corporate network.
This guide outlines how to configure ThreatConnect to communicate with Umbrella so security events from the ThreatConnect TIP are integrated into policies that can be applied to clients protected by your Cisco Umbrella.
A ThreatConnect dashboard with access to update the URL for integrations.
Umbrella dashboard administrative rights.
The Umbrella dashboard must have ThreatConnect integration enabled.Note: The ThreatConnect integration is only included in the Umbrella Platform package. If you do not have the Platform package and would like to have ThreatConnect integration, please contact your Cisco Umbrella representative. If you have the Platform package but do not see ThreatConnect as an integration for your dashboard, please contact Technical Support.
Cisco Umbrella and ThreatConnect: How does it work?
The ThreatConnect platform first sends the Cyber Threat Intelligence that it's found, such as domains that host malware, command and control for botnet or phishing sites, to Umbrella.
Umbrella then validates the threat to ensure it can be added to a policy. If the information from ThreatConnect is confirmed to be a threat, the domain address is added to the ThreatConnect Destination List as part of a security setting that can be applied to any Umbrella policy. That policy is immediately applied to any requests being made from devices using policies with the ThreatConnect Destination List.
Going forward, Umbrella automatically parses ThreatConnect alerts and adds malicious sites to the ThreatConnect Destination List—extending ThreatConnect protection to all remote users and devices and providing another layer of enforcement to your corporate network.
Important: While Umbrella tries its best to validate and allow domains which are known to be generally safe (for example, Google and Salesforce), to avoid any unwanted interruptions, we suggest adding any domains you never wish to have blocked to the Global Allow List or other destination lists as per your policy.
- The home page for your organization. For example, mydomain.com
- Domains representing services you provide that might have both internal and external records. For example, mail.myservicedomain.com and portal.myotherservicedomain.com
- Lesser-known cloud applications you depend on heavily that Umbrella may not be aware of or include in their automatic domain validation. For example, localcloudservice.com
These domains should be added to the Global Allow List, which is found at Policies > Destination Lists in Umbrella https://dashboard2.opendns.com/#configuration/policysettings/domainlists
How to configure your Umbrella dashboard to receive events from ThreatConnect
The first step is to find your unique URL in Umbrella for the ThreatConnect appliance to communicate with.
- Log into your Umbrella dashboard, navigate to Settings > Integrations and click ThreatConnect in the table to expand it.
- Check Enable and then click Save. This generates a unique, specific URL for your organization within Umbrella.
You'll need the URL later when you're configuring the ThreatConnect to send data to Umbrella, so copy the URL and let's get started!
How to configure ThreatConnect to communicate with Umbrella
In order to begin sending traffic from ThreatConnect to Umbrella, you need to configure ThreatConnect with the URL information generated in the first step.
Log into your ThreatConnect dashboard and add the URL in the appropriate area to connect with Umbrella. Exact instructions vary, and we suggest contacting ThreatConnect support if you're uncertain of how or where to configure API integrations within ThreatConnect.
Observing events added to the ThreatConnect security category in 'audit mode'
Over time, events from your ThreatConnect dashboard will begin to populate a specific destination list that can be applied to policies as a ThreatConnect Security Category. By default, the destination list and the security category are in 'audit mode' and are not applied to policies and will not result in any change to your existing Umbrella policies.
Note: ‘Audit’ mode can be enabled for however long is necessary based on your deployment profile and network configuration.
Review destination list
You can review the ThreatConnect Destination List at any time.
- Navigate to Settings > Integrations.
- Expand ThreatConnect in the table and click See Domains.
Review security settings for a policy
You can review the security setting that can be enabled for a policy at any time.
- Navigate to Policies > Security Categories.
- Click a policy in the table to expand it and scroll to Integrations to locate the ThreatConnect setting.
When getting started, it's best to leave this security setting set to Allow (default) in order to ensure domains are correctly populating in an 'audit' mode.
Applying the ThreatConnect security settings in block mode to a policy for managed clients
Once you're ready to have these additional security threats enforced against by clients managed by Umbrella, simply change the security setting on an existing policy, or create a new policy that that sits above your default policy to ensure it is enforced first.
First, create or update a security setting at Policies > Security Categories. You can edit the default security settings to enable the ThreatConnect security category in block mode or create a new security setting with the ThreatConnect security category enabled in block mode.
Simply click the icon to change the ThreatConnect security setting from Allow to Block.
Next, in the Policy wizard, add a security setting to the policy you're editing:
- Navigate to Policies > Policy List.
- Expand a policy.
- Click the Select Policy Settings tab.
- In the Security Settings to enforce pull-down, select a security setting that includes the Block for ThreatConnect setting.
- Click Save.
Note: It’s possible to edit your security settings from the Policy wizard if you so choose.
Complete and save the policy, and the ThreatConnect domains contained within the security setting for ThreatConnect will be blocked for those identities using the policy.
Reporting within Umbrella for ThreatConnect events
Reporting on ThreatConnect security events
The ThreatConnect Destination List is one of the security categories lists you can report on. Most or all of the reports use the Security Categories as a filter. For instance, to see the activity for websites addresses that were blocked by the ThreatConnect Destination List, go to Reporting > Activity Search. Apply a filter to only show the security category for ThreatConnect and then click Run Report to see the activity for the time period selected in the report.
To run a report of the security activity associated with domains originating from the ThreatConnect dashboard, navigate to Reporting > Activity Search and select the report to run only for that category.
Reporting on when domains were added to the ThreatConnect Destination List
The Admin Audit log includes events from the ThreatConnect dashboard as it adds domains to the destination list. A user named “ThreatConnect Account”, which is also branded with the ThreatConnect logo, generates the events. These events include the domain that was added and the time at which it was added.
You can filter to only include ThreatConnect changes by applying a filter for the “ThreatConnect Account” user.
Handling Unwanted Detections or False Positives
Although unlikely, it is possible that domains added automatically by your ThreatConnect could potentially trigger an unwanted detection that would cause your users to be blocked from accessing particular websites. In a situation like this, we recommend adding the domain(s) to an allow list, which takes precedence over all other types of block lists, including security settings.
There are two reasons why this approach is preferable. First, in case the ThreatConnect dashboard was to re-add the domain after it was removed, the allow list safeguards against that causing further issues. Secondly, the allow list shows a historical record of problematic domains that can be used for forensics or audit reports.
By default, there is a Global Allow List that is applied to all policies. Adding a domain to the Global Allow List results in the domain being allowed in all policies.
If the ThreatConnect security setting in block mode is only applied to a subset of your managed Umbrella identities (for instance, it's only applied to roaming computers and mobile devices), you can create a specific allow list for those identities or policies.
To create an allow list:
- Navigate to Policies > Destination Lists, click the (Add) icon and select Add Allow List.
- Give the list a meaningful name and add your domain to the list.
- Click Save.
Once the destination list has been saved, you can add it to an existing policy covering those clients that have been affected by the unwanted block.
Deleting domains from the ThreatConnect Destination List
Next to each domain name in the ThreatConnect Destination List is a (Delete) icon. Deleting domains lets you clean up the ThreatConnect Destination List in the event of an unwanted detection.
However, the delete is not permanent if the ThreatConnect dashboard resends the domain to Umbrella.
To delete a domain:
- Navigate to Settings > Integrations, then click ThreatConnect to expand it.
- Click See Domains.
- Search for the domain name you want to delete.
- Click the Delete icon.
- Click Close.
- Click Save.
In the instance of an unwanted detection or false positive, we recommend creating an allow list in Umbrella immediately and then remediating the false positive within the ThreatConnect dashboard. Later, you can remove the domain from the ThreatConnect Destination List.