Connecting Cisco Umbrella to Neo

You connect Cisco Umbrella once at the MSP level. One API key from your Multi-org, MSP or provider console covers every customer organization that console manages.

1. Create the API key

Only a Full Admin can create an Umbrella API key.

Open API Keys

Sign in to Cisco Umbrella, open the console that holds your customers (your Multi-org, MSP or provider console; a key from one customer’s own organization serves only agents that do not run on a ticket), and go to Admin > API Keys.

Add the key

Click Add, name it Neo, and choose the scopes Neo should use. Give Admin at least Read-Only: Neo reads your console’s customer list with it to map each customer to its company, and on a ticket Neo acts only in a mapped customer’s organization. For the access request job, also give Policies Read/Write and Reports and Investigate Read-Only; add Deployments if agents should read or change it. Pick an expiry date, or none, and click Create Key.

Copy the key and secret

Copy the API Key and the Key Secret. Umbrella shows the secret only once.

Do not delete, refresh or let the key expire after you connect it. Neo loses access until you save a new key here.

2. Add the key in Neo

Open Integrations

In the Neo Dashboard, open Integrations and find the Cisco Umbrella card, under Security.

Save the key

Paste the API key and the key secret and click Save. Neo checks them against Umbrella before saving, so a wrong key is rejected straight away.

3. Turn Cisco Umbrella on per agent

Open the agent, go to the Integrations section, and pick an access profile for the Cisco Umbrella block, or set each area yourself:

Area	Access levels you can pick	Notes
Destination Lists and Internal Domains	Disabled, Read Only, Read / Write	Allow and block lists and their destinations, and internal domains (sent to the customer’s own DNS without filtering).
Policies and Applications	Disabled, Read Only, Read / Write	Policies and their identities, application lists, App Discovery labels, and each device’s Secure Web Gateway override.
Deployments	Disabled, Read Only, Read / Write	Networks, internal networks, sites, virtual appliances, roaming computers, network devices, tags and tunnels.
Reports	Disabled, Read Only	DNS, web, firewall and intrusion activity, and the summary and top reports.
Investigate	Disabled, Read Only	Umbrella Investigate’s intelligence on a domain, IP, URL or file hash. Needs an Investigate licence.
Users and API Keys	Disabled, Read Only, Read / Write	Console users and roles, API keys without their secrets, and API usage.
Provider Console	Disabled, Read Only, Read / Write	Your console’s customer organizations, seats, trials and deals, and the reports across customers.

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read outside the Users and API Keys group	Every change in the Destination Lists and Internal Domains group; no other write is allowed
IT Admin	Every read, and Deployments changes outside Safety Controls	Changes in the Destination Lists and Internal Domains, Policies and Applications, Users and API Keys, and Provider Console groups, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

See Cisco Umbrella API for what the agent can read and change.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Connecting Cisco Umbrella to Neo

1. Create the API key

2. Add the key in Neo

3. Turn Cisco Umbrella on per agent

​1. Create the API key

​2. Add the key in Neo

​3. Turn Cisco Umbrella on per agent

1. Create the API key

2. Add the key in Neo

3. Turn Cisco Umbrella on per agent