Cisco Umbrella Integration (Commercial and Gov Cloud)

Connect Cisco Umbrella or Cisco Umbrella for Gov Cloud to Atlas AVD to see the last 24 hours of DNS activity for the tenant.

Before you begin

  • An Enterprise plan or above. The Integrations hub is locked below Enterprise
  • The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
  • A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
  • An Umbrella API key and secret, created in the Umbrella dashboard that matches the card (commercial or Gov Cloud)

What you can do

  • See the last 24 hours of DNS activity for the Umbrella organization: Total Requests, Blocked, Malware Blocks and Phishing Blocks.
  • Refresh the numbers and re-check the connection on demand.
  • Connect the commercial service, the Gov Cloud service, or both, for the same tenant. Each keeps its own credentials.

Step 1: Create an API key in Umbrella

In the Umbrella dashboard (the Gov Cloud dashboard for Cisco Umbrella for Gov Cloud), go to Admin → API Keys and add a key for Atlas with read-only access to Reports and Deployments (Atlas reads the organization's details and its DNS activity report). Copy the API Key and the Key Secret; the secret is shown once.

Step 2: Connect in Atlas

The credentials are stored encrypted for the selected tenant. Cisco Umbrella for Gov Cloud talks only to Umbrella's Gov Cloud service (api.umbrella-gov.com), never to the commercial one.

  1. Select the tenant in the tenant picker.
  2. Go to Administration → Integrations and click Connect on the Cisco Umbrella card, or on Cisco Umbrella for Gov Cloud (the card with the FedRAMP badge).
  3. Paste the API Key and API Secret and click Connect. Atlas signs in to Umbrella and reads your organization before saving anything; if Umbrella rejects the key, nothing is stored.

Viewing activity

Click Manage on a connected card to open its panel. It shows the Umbrella organization name, when the connection was last refreshed, and the four counters for the last 24 hours. Click Refresh to re-check the credentials and reload the numbers.

What the integration does not do

  • It is read-only. It does not change Umbrella policies, destination lists, identities or settings.
  • It shows organization-wide totals only, for a fixed 24-hour window. There is no per-user, per-device or per-domain activity, no date picker, and no top-domains report. Atlas leaves the per-query activity log out on purpose, because it identifies people.
  • It has no page of its own beyond the panel on the hub card, and the numbers do not appear in dashboards, reports or Atlas Advisor.
  • It does not deploy the Umbrella roaming client, Secure Client module or virtual appliances.
  • Each card connects one Umbrella organization per tenant. If your key can see several organizations, Atlas uses the first one it is given.

Atlas Resolve vs. Cisco Umbrella

Umbrella filters DNS in Cisco's service and Atlas shows its totals. Atlas Resolve is Atlas AVD's own DNS filtering, applied on each device by the Atlas Reach agent, with policies you manage in Atlas and no third-party account. See Set Up DNS Filtering with Atlas Resolve.

Disconnecting

Click Manage, then Disconnect, and confirm. Atlas deletes its stored credentials for the selected tenant; nothing changes in Umbrella. Delete the key in the Umbrella dashboard too if you no longer need it. You can reconnect at any time.

Troubleshooting

  • Cisco Umbrella rejected the credentials (or Cisco Umbrella Gov Cloud rejected the credentials): the key or secret is wrong or was deleted, or it was created in the other Umbrella dashboard. Gov Cloud keys only work on the Gov Cloud card.
  • Invalid API key format or Invalid API secret format: paste the values again without spaces.
  • Please wait before retrying the connection: wait a few seconds after a failed attempt.
  • Could not verify credentials with Cisco Umbrella: Umbrella could not be reached. Try again shortly.
  • Failed to load metrics. Try refreshing.: the key may lack the Reports read scope, or you refreshed more than 30 times in a minute. Umbrella credentials are no longer valid on Refresh means the key was revoked: disconnect and connect with a new one.
  • The card says Not connected after it was connected: the stored credentials could not be read. Connect again.
  • All counters show 0: there was no DNS traffic for the organization in the last 24 hours, or traffic is not reaching Umbrella. Check your Umbrella deployment.

Next steps