Cisco Umbrella API

The common use is an Umbrella access request ticket: the agent finds the block in the customer’s activity report, checks the destination with Umbrella Investigate, and once the request is approved, adds the destination to the customer’s allow list and reads it back.

Automatically enabled when you configure Cisco Umbrella permissions in your agent workflow.

What It Does

Work in the ticket company’s own Umbrella organization, from the company mapping
Read DNS, web, firewall and intrusion activity, filtered by destination, identity, verdict and time
Check a domain, IP or URL with Umbrella Investigate: status, categories and security scores
Add or remove domains, URLs and IPs on allow and block lists, and create or rename lists
Read roaming computers, networks, sites, virtual appliances, tunnels, policies and application lists, and change them
Read console users and API keys, and your console’s customer organizations

Permission Groups

Group	Covers
Destination Lists and Internal Domains	Allow and block lists and their destinations; internal domains
Policies and Applications	Policies and their identities, application lists, App Discovery, Secure Web Gateway overrides
Deployments	Networks, internal networks, sites, virtual appliances, roaming computers, network devices, tags, tunnels
Reports	Activity, summary, top and deployment status reports (read only)
Investigate	Domain, IP, URL and file intelligence (read only)
Users and API Keys	Console users and roles, API keys without their secrets, API usage
Provider Console	Customer organizations, seats, trials, deals and access requests, the console’s contacts, cross-customer reports

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read outside the Users and API Keys group	Every change in the Destination Lists and Internal Domains group; no other write is allowed
IT Admin	Every read, and Deployments changes outside Safety Controls	Changes in the Destination Lists and Internal Domains, Policies and Applications, Users and API Keys, and Provider Console groups, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

Safety Controls

Control	Behavior
One organization per call	Neo gets a token for the customer organization a call names, so the call acts in that organization only
The ticket’s customer only	On a run for a ticket, Neo sends a call only for the organization the ticket’s company is mapped to, and no provider-console call
Always asks a technician	Deleting a network, site, network device, virtual appliance, tunnel, roaming computer or customer organization; changing or deleting an API key; a customer password reset; and a Secure Web Gateway override that may turn the gateway off
Refused	Creating or refreshing an API key, rotating the S3 bucket key, and creating a tunnel or rotating its credentials (each answer returns a secret once, which Neo hides), and uploading a provider console logo
Secrets	Fields that carry a credential, such as a key secret, a tunnel’s pre-shared key or a password, are hidden in every answer
Allowing a site	The agent checks the destination with Umbrella Investigate first and never allows one Umbrella marks as malicious

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Cisco Umbrella API

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls