Cisco Umbrella Investigate Response Integration via API

Purpose

This guide explains how to configure the Cisco Umbrella Investigate Response integration in Logsign USO, so that an analyst (or an action rule) can look up domain reputation, categorization, co-occurrences, passive DNS history, WHOIS records, and related threat-intelligence data directly from a Logsign Incident. This is a threat-intelligence lookup integration, not a containment integration: none of its methods block, quarantine, or otherwise change state on Umbrella or elsewhere. It only runs when a method is called from Settings > Integrations > Responses, an Action Rule, or a manual incident action.

This is not the same product as Cisco Umbrella (DNS security) log collection, which pulls DNS/proxy logs into Logsign on a schedule and is documented separately. Umbrella Investigate is Cisco's threat-intelligence API for looking up domains and IPs, unrelated to log collection.

Prerequisites

• A Cisco Umbrella Investigate API subscription (a separate entitlement from base Umbrella DNS security; confirm with your Cisco/Umbrella account team that Investigate API access is included in your license).
• An Umbrella Investigate API token.

Step 1: Obtain an Umbrella Investigate API Token

1. Log in to the Cisco Umbrella dashboard with an administrator account.
2. Navigate to the Investigate API token management area (the exact menu path varies by Umbrella dashboard version and was not independently verified during this research).
3. Generate an API token and copy it immediately; treat it as a secret credential.

Step 2: Configure the Integration in Logsign USO

In Logsign USO, go to Settings > Integrations > Responses, search for Cisco Umbrella Investigate, click Configure then +Device, and fill in:

Click Create to save the device.

Available Methods

All of the following are read-only lookups; none of them change state on Umbrella:

• get_domain_category — returns the content category classification for a domain.
• get_domain_security_data — returns Umbrella's security/risk metrics for a domain.
• get_domain_risk_score — returns a numeric risk score for a domain.
• get_cooccurences_for_domain — returns domains that co-occur with the given domain in DNS query patterns (useful for finding related infrastructure).
• get_related_domains_for_domain — returns domains related to the given domain.
• get_domain_dns_history — returns passive DNS history for a domain.
• get_passive_dns_by_ip — returns passive DNS history for an IP address.
• get_malicious_domains_for_ip — returns domains flagged as malicious that have resolved to a given IP.
• search_domain_with_regex — searches for domains matching a regular expression pattern.
• get_domain_whois_info — returns WHOIS registration data for a domain.
• get_email_whois_info — returns domains associated with a WHOIS registrant email address.
• get_nameserver_whois_info — returns domains associated with a given nameserver.

Troubleshooting

Notes and Limits

• This integration is read-only threat intelligence; it does not block, quarantine, or take any containment action. For DNS-layer blocking, use Cisco Umbrella's own policy/destination-list features directly, or a separate containment-capable integration if one exists for your firewall/proxy.
• The exact console navigation path for generating an Investigate API token was not independently verified against a live Umbrella dashboard during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.