Cisco Umbrella

Reporting API loggers added

• DNS activity
• Cloud Firewall activity
• Collect only what you need by filtering on verdict and categories

Log schema changes

• Added the Cisco Umbrella Firewall log schema
• Added threats and app to the Cisco Umbrella DNS log schema (filled by the API logger only)

Other improvements

• Added Base URL and Max Requests / Second options to the Cisco Umbrella connect profile
• Query commands now pace requests to stay within the Umbrella rate limit (5 per second) and retry on HTTP 429
• Changed response_code in the umbrella-activity-logs query command to a string, matching the log schema
• Changed the refresh interval of the Umbrella DNS 최근 로그 dashboard widget to 60 seconds

Add S3 DNS, audit log collector, and dashboards

Support 21 query commands

• umbrella-activity-logs
• umbrella-domain-whois
• umbrella-domain-risk-score
• umbrella-domain-security
• umbrella-domain-category
• umbrella-domain-whois-batch
• umbrella-domain-risk-score-batch
• umbrella-domain-security-batch
• umbrella-domain-category-batch
• umbrella-top-destinations
• umbrella-top-identities
• umbrella-top-threats
• umbrella-apps
• umbrella-summary
• umbrella-networks
• umbrella-categories
• umbrella-destination-lists
• umbrella-destinations
• umbrella-category-stats
• umbrella-destination-stats
• umbrella-api-usage-summary