> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Cisco Umbrella to Neo

> Create a Cisco Umbrella API key and save it in Neo

You connect Cisco Umbrella once at the MSP level. One API key from your Multi-org, MSP or provider console covers every customer organization that console manages.

## 1. Create the API key

Only a Full Admin can create an Umbrella API key.

<Steps>
  <Step title="Open API Keys">
    Sign in to [Cisco Umbrella](https://login.umbrella.com), open the console that holds your customers (your Multi-org, MSP or provider console; a key from one customer's own organization serves only agents that do not run on a ticket), and go to **Admin > API Keys**.
  </Step>

  <Step title="Add the key">
    Click **Add**, name it Neo, and choose the scopes Neo should use. Give **Admin** at least Read-Only: Neo reads your console's customer list with it to map each customer to its company, and on a ticket Neo acts only in a mapped customer's organization. For the access request job, also give **Policies** Read/Write and **Reports** and **Investigate** Read-Only; add **Deployments** if agents should read or change it. Pick an expiry date, or none, and click **Create Key**.
  </Step>

  <Step title="Copy the key and secret">
    Copy the **API Key** and the **Key Secret**. Umbrella shows the secret only once.
  </Step>
</Steps>

<Warning>
  Do not delete, refresh or let the key expire after you connect it. Neo loses access until you save a new key here.
</Warning>

## 2. Add the key in Neo

<Steps>
  <Step title="Open Integrations">
    In the Neo Dashboard, open **Integrations** and find the Cisco Umbrella card, under Security.
  </Step>

  <Step title="Save the key">
    Paste the API key and the key secret and click **Save**. Neo checks them against Umbrella before saving, so a wrong key is rejected straight away.
  </Step>
</Steps>

## 3. Turn Cisco Umbrella on per agent

Open the agent, go to the Integrations section, and pick an access profile for the Cisco Umbrella block, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Destination Lists and Internal Domains** | Disabled, Read Only, Read / Write | Allow and block lists and their destinations, and internal domains (sent to the customer's own DNS without filtering). |
| **Policies and Applications** | Disabled, Read Only, Read / Write | Policies and their identities, application lists, App Discovery labels, and each device's Secure Web Gateway override. |
| **Deployments** | Disabled, Read Only, Read / Write | Networks, internal networks, sites, virtual appliances, roaming computers, network devices, tags and tunnels. |
| **Reports** | Disabled, Read Only | DNS, web, firewall and intrusion activity, and the summary and top reports. |
| **Investigate** | Disabled, Read Only | Umbrella Investigate's intelligence on a domain, IP, URL or file hash. Needs an Investigate licence. |
| **Users and API Keys** | Disabled, Read Only, Read / Write | Console users and roles, API keys without their secrets, and API usage. |
| **Provider Console** | Disabled, Read Only, Read / Write | Your console's customer organizations, seats, trials and deals, and the reports across customers. |

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read outside the Users and API Keys group | Every change in the Destination Lists and Internal Domains group; no other write is allowed |
| **IT Admin** | Every read, and Deployments changes outside [Safety Controls](/agents/tools/security/cisco-umbrella-api#safety-controls) | Changes in the Destination Lists and Internal Domains, Policies and Applications, Users and API Keys, and Provider Console groups, and the changes in [Safety Controls](/agents/tools/security/cisco-umbrella-api#safety-controls) |
| **Full Automation** | Every read and write outside [Safety Controls](/agents/tools/security/cisco-umbrella-api#safety-controls) | The changes in [Safety Controls](/agents/tools/security/cisco-umbrella-api#safety-controls) |

See [Cisco Umbrella API](/agents/tools/security/cisco-umbrella-api) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.