Skip to main content
Cisco Umbrella filters your customers’ DNS and web traffic. Connect it once with an API key from your Multi-org, MSP or provider console, and Neo agents can work Umbrella from the ticket for every customer organization that console manages.

​
What Neo can do with Cisco Umbrella

  • Answer an Umbrella access request (“[Cisco Umbrella] Access request to …”): find the block in the activity report, check the destination with Umbrella Investigate, and, once the request is approved, add it to the customer’s allow list
  • Add a phishing domain, URL or IP to a customer’s block list, or remove a destination from a list
  • Read DNS, web and firewall activity: who was blocked, when, by which category and policy
  • Check a roaming computer’s DNS and web protection, its last sync and its client version
  • Read networks, sites, virtual appliances, tunnels, policies and application lists
  • Read your console’s customer organizations, their seats and their deployment status

​
Each call acts in one customer organization

Umbrella gives each of your customers its own organization. Neo gets a separate token for each organization it works in, from the one API key you connect, so a call for one customer never acts in another’s organization. On a ticket, Neo acts only in the organization the ticket’s company is mapped to. A key made inside a single customer’s organization serves agents that do not run on a ticket, such as scheduled agents; for ticket work, connect the key from the console that holds your customers.

​
Allow and block lists ask first by default

Allowing a destination can let a user reach a site the customer’s policy blocks, so the Helpdesk and IT Admin profiles ask a technician before any change to a destination list. Before it allows a site, the agent checks it with Umbrella Investigate and never allows one Umbrella marks as malicious.

​
Your organizations are mapped to companies

Neo matches your Umbrella customer organizations to the companies in your PSA and keeps the mapping on the Cisco Umbrella card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the organization name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Last comes an AI match for the long tail. An exact name that matches exactly one of your PSA companies, or a match you confirm, is handed straight to your agents. A mapping lets an agent on that company’s tickets act in the organization, so every other match waits for you on the Organization Mapping tab: a match after stripping a legal-form suffix, a name two of your PSA companies share, two Umbrella customers on one company, and an AI match. Confirm or correct each there. Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. See Cisco Umbrella API for the permission groups.

​
Next steps

Connect Cisco Umbrella

Create an API key and save it in Neo.