Pull data from the Cisco Umbrella API

Overview

Use the HTTP Pull Listener to collect data from the Cisco Umbrella API. Currently, we support the reports endpoint.

HTTP Pull Listener configuration

In Falcon Onum, go to the Listeners area and click New Listener > HTTP Pull. Give a name to your new Listener and enter the following data:

Parameters

Add the following parameter:

• Name - domain

• Value - Enter your Cisco Umbrella domain name.

Secrets

You must define these credentials in Onum:

• cisco_auth will reference your Umbrella Token Authorization API.

To do it, click Add element and enter a Name for the secret (in this case, cisco_auth). Then, click the Value field and select New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the Value field list.

Learn more about secrets in Onum in this article.

Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: EpochMillis
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: https://${parameters.domain}/auth/v2/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
        - name: authorization
          value: ${secrets.cisco_auth}
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: false
collectionPhase:
  paginationType: offsetLimit
  limit: 100
  isZeroIndex: false
  request:
    responseType: json
    method: GET
    url: https://${parameters.domain}/reports/v2/activity
    queryParams:
      - name: from
        value: ${temporalWindow.from}
      - name: to
        value: ${temporalWindow.to}
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: ".data"
    map: "."
    outputMode: element
retry:
  statusCodes: [429, 500, 502, 503, 504]
  type: fixed 
  fixed:
    interval: 2s

Manually configure

When you're done, click Create labels to move on to the next step and define the required Labels if needed.