Autotask and Umbrella Integration

Introduction

The Cisco Umbrella – Autotask integration allows MSPs to be notified of potentially infected end-points requiring attention by automatically creating tickets in Autotask. The integration also pushes service deployment status and value data between the Umbrella dashboard and an Autotask Installed Product (automatically created) called OpenDNS_Umbrella. 

Steps to Integration:

1. Prerequisites
2. Initial Autotask Authentication and Umbrella Setup
3. Configure Autotask Ticketing
4. Company Mapping in Umbrella
5. Setting up the OpenDNS_Umbrella Configuration Item

1. Prerequisites

The following table contains the base software requirements for installation:

2. Initial Autotask Authentication and Umbrella Setup

Establish a user for authentication:

In order to connect to the AutoTask API, Umbrella needs a login for Autotask. This can be a new user resource account or an existing shared login.

• Existing user—If you already have an Autotask login that you use for integrations, please check that the account is set as an API User. The account should not be using two-step authentication.
• New User—To create a new user resource, log in to your Autotask dashboard. Click Admin, then click Resources (Users), then click New. Fill in the personal information requirements for the user under the HR tabs. Under the Security tab, ensure Security Level for this user is set to "API User (system)".

Note:  the user for authentication must have the “View Unprotected Data” checkbox selected in Admin → Features & Settings → Resources/Users (HR) → Security → Protected Data Permission → [the user for authentication].

Note:  effective June 1 2021 the user for authentication must have an API Tracking Identifier set.  For more information, please see:  https://support.umbrella.com/hc/en-us/articles/360061447351-Changes-to-Autotask-PSA-integration-with-Umbrella

Once an account has been created or selected, navigate to Umbrella for MSPs.

1. Navigate to MSP Settings > PSA Integration Details.
2. Click Set-Up Integration to open the Integration wizard.
3. Under Select PSA, select Autotask as the Integration type, then click Save and Continue.
   
   
4. Next, you'll be asked to enter the account selected earlier (e-mail address and password) and Verify your credentials in order to select a Material Billing Code:
   
   

Select appropriate Material Billing Code:

Once you've authenticated, the Material Billing Code will show a selection with your existing Autotask material billing code. At a later time, you can change the material billing code for the OpenDNS_Umbrella product within Autotask if you wish.

Click Save & Continue.

3. Configure Autotask Ticketing

Umbrella for MSPs proactively notifies you of infected hosts that require action by creating tickets within an Autotask Service Desk queue. When correctly integrated, Umbrella will automatically check for infected hosts being contained and create tickets for you.

How a Service Queue Ticket is Generated by Umbrella:

Currently, the following criteria must be met in order to generate a ticket within an Autotask Service Desk queue:

• Umbrella monitors your identities for 'botnet activity' being blocked. This activity indicates an endpoint that is infected and that Umbrella is actively blocking attempts to 'call home' for updates, to upload stolen data, or to be a part of a botnet. If an identity in your organization is repeatedly trying to reach a site categorized as 'botnet', this means that while we are containing the damage, the machine is infected with malware and needs additional action on your part for remediation.
• Umbrella does not create alerts when it prevents infections, for categories such as malware or drive-by downloads, as those events are preventively blocking the user from visiting malicious sites and no additional action is required. 
• Every four hours, we check all of the organizations that are mapped to PSA organizations in your Umbrella for MSP console.
• If a single identity, such as a computer with an agent installed or a network, has more botnet events than the "query threshold" (three by default) within the four hour block, the Umbrella Integration automatically opens a ticket within the Service Desk defined by the Ticketing Details Integration in the Integration wizard. The query threshold can be changed there.
• If the same identity continues to generate additional botnet activity in the next four hour window, or another time window after that, and the ticket is still open, the ticket will get additional data appended to it. Umbrella references the ticket by its ticket number and will not create unnecessary duplicates even if a ticket is moved to another service desk queue or if the copy is changed.
• If the ticket has been marked Closed, then a new ticket will be created as it is assumed that this is a new botnet related security event (such as re-infection) for the same identity.

Set Ticketing Details:

If you're following the Integration wizard, you should be on step 3 of the Integration wizard. If you are configuring ticketing later, click PSA Integration > Integration Details. Your credentials should show as enabled but ticketing as disabled.

1. Clicking Disabled under Ticketing brings you to Set Ticketing Details.
2. First, select a queue. In this example, we’ll be using the Triage queue to leave tickets in. The queue must be selected first in order to populate the additional fields:
   
   
   
   
   
3. After selecting your queue, wait a few seconds for the detail to be populated for the remaining fields, then select the appropriate one. Each field in the Umbrella dashboard should map to the equivalent field within the tickets for the Service Desk queue selected.
   
   The exact parameters for each field will vary slightly based on your implementation. One field of note is the Query Threshold, which is the number of botnet activities from a single identity that are blocked before the ticket is created.
   
   
4. Complete all fields as applicable, click Continue and Save.

The fourth and final step of the integration allows you to review all of your settings to ensure they're what you expect. 

 

Note:

If you would like to generate a test ticket, please contact Support with a request to do so. This ticket will obey your Autotask ticketing rules.

 

4. Company Mapping in Umbrella

Mapping customer companies enables the integration and allows tickets and installed products to be associated with the customer account. The Installed Product OpenDNS_Umbrella contains valuable statistics about the customer usage and efficacy of Umbrella and is configured in Step 5.

In order to synchronize customers between Autotask and Umbrella, you must have the Account ID for each customer. This may not be shown in Autotask by default. 

1. To see the customer ID in the Autotask dashboard, click CRM, then choose My Accounts from the drop-down list. Each account has an account ID in the properties for that account, visible by double-clicking on the account name, which opens a pop-up window showing the Account ID.
    
2. To see all of the account IDs for your customers in the overview, you must expose a new column. Right-click the columns to show the Column Chooser.
   
    
3. Within the column chooser, move the Account ID column to the Selected Columns.
   
    
   
   This should show you the Account Id for the customer:
   
    
4. Once you have the account ID for your customer, return to Umbrella for MSPs.
5. Navigate to Customer Management to show a list of the customers you’ve configured in your console
   Note: If there are no customers listed here, you’ll need to add customers to your Umbrella for MSP MSP. Please read the MSP Console Guide for more information.
6. Next, select the customer to map to Autotask. For this example, we'll use Able Manufacturing Co.
7. Earlier, we found that Able Manufacturing Co. has an Account ID of 29683561. Click the name of the customer, then enter in the Company Account ID under the field for PSA ID.
   
   
8. Click Save to confirm the change. You should receive a confirmation message about the integration being enabled. From that point forward, the PSA ID will show next to the customer it's enabled for in the Customer Details.
9. To confirm your integration is enabled, navigate to Centralized Reports > Deployment Status. If it's operational, a PSA Status column will be populated.  Organizations with valid PSA IDs will show up with a green Active status; organizations that do not have a PSA ID value will show up with a gray Inactive status.
   
   

5. Setting up the OpenDNS_Umbrella Configuration Item (Optional)

Once the PSA Company ID has been successfully integrated, an Installed Product/Configuration Item named OpenDNS_Umbrella will be automatically created.

You can view the Configuration Item under Directory > Accounts and then select one of the accounts you integrated in Step 4. Within this account, there should now be a Configuration Item for OpenDNS_Umbrella.

Note that by default the Configuration Item will include all possible fields and the Umbrella fields we’ve added in the integration. Some fields are not filled as they are not applicable to Umbrella, such as Brand or Make & Model.

In order to change the product to not include these fields, set up a unique Configuration type for Umbrella.

Configuration Type Setup

Configuration items created in Autotask through the Umbrella integration create user-defined fields (UDFs) for your Umbrella auto-updated information. By default, a new product will show all UDFs and a configuration item type is recommended. Due to limitations with the current Autotask API, the process of creating a Configuration Item Type within Autotask is limited to manual intervention by you or your Autotask administrator. The following table provides a list of all fields which should be added to your Configuration Item Type.

For users unfamiliar with the setup of new Configuration Item Types in Autotask please follow the instructions below to create the new record in the system.

1. Sign into Autotask as an administrator.
2. Navigate to the Admin section using the top menu.
3. Expand Products and Services, Products, Configuration Items and select Configuration Items Types.
   
    
   
   
4. Click New Configuration Item Type menu option above the list of current types.
5. Enter a name for your new Configuration Item Type.
6. Click New, enter the field information for the first field in the top above.
7. Repeat step 6 until you have added all the fields in the table above to the new item type.
   
    
8. Save and close your new Configuration Item Type.

Product Setup

The Umbrella integration will automatically create a Product within your Autotask implementation to tie configuration items to when being created. After the product has been created in your system, it is recommended that you update the product definition with settings which best reflect your business standards and needs.

To identify the product definition and update its settings follow these steps:

1. Sign into Autotask as an administrator.
2. Navigate to the Admin section using the top menu.
3. Expand Products and Services, Products and select Products.
4. Type ‘Umbrella’ into the Product Name search field and click Search.
5. Select the Umbrella product to view its details.
   
    
6. Update the product definition to reflect your desired settings.
7. Click Save & Close.

Important Notes:

1. Do not change the Product Name string from OpenDNS_Umbrella to something else. This will break the integration, but if you did rename it simply rename it back to fix the issue. 

2. Make sure Active is checked as you see in the screenshot above. 

The definition of each of the Umbrella AutoTask fields that will be updated and included in the Configuration Item are listed in the table below.