When implementing Umbrella, there
are three really important things that we want to do.
Number one is to decide on and implement a policy, two, verify
it's working, and three, have some great reporting to figure
out what the heck happened.
All that exists in Umbrella with also the additional option
of doing some investigation.
So we have a URL or a site that we're curious about.
There's an interface an Umbrella where
I can put that information in and it
will give us the reputation and details regarding that site.
And that gives us the tools in our own hands
to do that research on suspicious sites WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to do that research on suspicious sites
that we have questions about.
So let me start off with some really great URLs
that we can use in testing.
So let's start off right here, welcome.umbrella.com,
or welcome.opendns.com.
Those can verify, first of all, that your clients are
using Umbrella DNS services.
Now, this could be from them pointing directly
to the DNS services or it could be
from the client, the remote client, installed
on their computer that's forcing them
to use the OpenDNS or the Umbrella DNS service.
So that's a great start.
Then there are some fantastic websites WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then there are some fantastic websites
that we should be aware of.
This is one of them, www.internetbadguys.com.
Now, that is actually managed by Cisco.
And so it's not really a malicious page.
So if you went there it wouldn't harm you.
However, it's a great way to verify
that traffic is being stopped that's being classified
as a security risk.
Another great site that we can use
this www.examplemalware.com, and once again,
that's being blocked because it's identified
as being a security threat.
And if we did actually go to that site
and we weren't using Umbrella, this exact URL WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we weren't using Umbrella, this exact URL
would not harm us if we are going to the real server
there because that's maintained by Cisco as well.
And it's just used for testing.
Another great site is this, www.examplebotnetdomain.com,
again as a test to verify that our policy is blocking
those types of DNS requests.
And then this one right here is also quite good.
It's exampleadultsite.com.
And you want to be--
I'm always very nervous on testing against adult pages
because you don't want to have that traffic on your network.
And so this is one that you'd want to make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is one that you'd want to make
sure you type in correct.
This is one that's being maintained by OpenDNS/Cisco,
and it's saying here it's only a demonstration site.
If you are using OpenDNS Parental Controls,
this would be filtered.
Now, the question that we could ask ourselves
is, why am I seeing this page?
Why am I not seeing a block page?
Why am I seeing this?
And that's because the policy that we have applied,
we are specifically only blocking one category of URL,
and that was alcohol-related websites.
And that's why this one is going through.
So it's a great idea, a great way
to test to verify our policies are being enforced. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to test to verify our policies are being enforced.
If we're getting different results,
we'd want to look at our policies a little bit closer.
Another great site is this, ihaveabadreputation.com,
which is also identified being a security threat.
And this also leads us to a great way
to use the investigate tool that's built into Umbrella.
So I'm going to copy that URL, and we'll go back
to the Umbrella interface.
Let me collapse a few of these.
And let's go down to Investigate, right here.
And this gives us opportunities to do searches
and looking into email addresses, or URLs, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and looking into email addresses, or URLs,
or host names.
There's also options for regular expression,
but if we wanted to just search on, for example,
that URL, ihaveabadreputation.com,
and then click on Investigate, it's
going to show right here the risk level, the security
categories, and if we expand Security Indicators,
it'll talk about the security indicators
and why they are what they are.
As we continue to scroll down, more details
and information about that.
If we were to grab some other site like CBTNuggets.com,
great, so it's been categorized by Cisco Umbrella, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
great, so it's been categorized by Cisco Umbrella,
and behind that, the Talos security teams.
And they've identified as a Low Risk as the category.
And here's the security indicators,
which are leading up to the overall security risk.
There are some quantities regarding
DNS requests over time, and regarding DNS resolution
addresses, name servers involved.
And it looks like based on the name servers
here that we are using a lot AWS to host that for us.
And let's also take a look at Reporting.
So over here on the left, we click on Reporting.
And if we expand Reporting right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we expand Reporting right here,
we've got Security Overview, Security Activity,
Activity Search, App Discovery, Threats,
and then additional reports.
So we had tons of reports, a bunch of core reports
and additional reports to basically ferret out
any details that we'd like to know about.
So I'm going to go ahead and say This Week.
And there we have some blocks, and those are the blocks
that we tested just a few moments ago.
Fantastic.
There's an Activity Search.
So a lot of this traffic is coming
from KB-TestNet, which does not have the custom policy we
associated with Bob that has the default policy, which
is catching all identities.
So I have a few computers here that are associated WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I have a few computers here that are associated
with that one outside global address,
and that's why we see this activity here.
And then Top Categories and Top Identities.
And while I have you here, there's
one more element I'd like to share with you.
And that's under the Admin section.
And that is regarding Log Management.
So as you might imagine, the log files
could be quite large over time for an organization.
And so it's showing us right here on your data storage
that Umbrella is saving my log data to the North American data
warehouse, which is important if we
want to be aware geographically in the world that's
being saved. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
being saved.
If we want to change that, we can change location.
And if you scroll down, there's also
an option here under Log Management for Amazon S3.
So we could use a company managed Amazon S3 bucket
by specifying the name and verifying it,
or click on this radio button and use Cisco-managed Amazon
S3 storage.
So the key here is under Log Management,
we can control how and where we want that data saved.
In this video, we've identified three basic things.
Number one, there is reporting galore with Cisco Umbrella.
Secondly, we also have the Investigate feature WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Secondly, we also have the Investigate feature
where we can do additional research on an IP address,
or email address, or domain to find out more about it
should we need to.
All those tools are built into Umbrella.
And then third, regarding log files,
we can control where they're stored geographically.
And if we want to use Amazon storage as part of that,
we can control that, too, right through the Umbrella interface.
So thanks for joining me in this video.
I'll see you in the next one.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.