Collect Cisco Umbrella audit logs

This document explains how to collect Cisco Umbrella audit logs to a Google Security Operations feed using AWS S3 bucket. The parser normalizes the raw CSV log data, handling different delimiters and potential formatting inconsistencies. Then, based on the log type (DNS or Audit), it maps the extracted fields to the corresponding UDM schema, enriching the data with additional context and standardizing the representation for further analysis.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you privileged access to AWS IAM and S3.
• Ensure that you have privileged access to Cisco Umbrella.

Configure a Cisco-managed Amazon S3 bucket

1. Sign in to the Cisco Umbrella dashboard.
2. Go to Admin > Log management.
3. Select Use a Cisco-managed Amazon S3 bucket option.
4. Provide the following configuration details:
   • Select a region: select a region closer to your location for lower latency.
   • Select a retention duration: select the time period. The retention duration is 7, 14, or 30 days. After the selected time period, data is deleted and cannot be recovered. If your ingestion cycle is regular, use a shorter time period. You can change the retention duration at a later time.
5. Click Save.
6. Click Continue to confirm your selections and to receive activation notification.
   In the Activation complete window that appears, the Access key and Secret key values are displayed.
7. Copy the Access key and Secret key values. If you lose these keys, you must regenerate them.
8. Click Got it > Continue.
9. A summary page displays the configuration and your bucket name. You can turn logging off or on as required by your organization. However, logs are purged based on the retention duration, regardless of new data getting added.

Optional: Configure user access keys for self-managed AWS S3 bucket

1. Sign in to the AWS Management Console.
2. Create a User following this user guide: Creating an IAM user.
3. Select the created User.
4. Select the Security credentials tab.
5. Click Create Access Key in the Access Keys section.
6. Select Third-party service as the Use case.
7. Click Next.
8. Optional: add a description tag.
9. Click Create access key.
10. Click Download CSV file to save the Access Key and Secret Access Key for later use.
11. Click Done.
12. Select the Permissions tab.
13. Click Add permissions in the Permissions policies section.
14. Select Add permissions.
15. Select Attach policies directly.
16. Search for and select the AmazonS3FullAccess policy.
17. Click Next.
18. Click Add permissions.

Optional: Configure a self-managed Amazon S3 bucket

1. Sign in to the AWS Management Console.

2. Go to S3.

3. Click Create bucket.

4. Provide the following configuration details:

   • Bucket name: provide a name for the Amazon S3 bucket.
   • Region: select a region.

5. Click Create.

Optional: Configure a bucket policy for self-managed AWS S3 bucket

1. Click the newly created bucket to open it.
2. Select Properties > Permissions.
3. In the Permissions list, click Add bucket policy.

4. Enter the preconfigured bucket policy as follows:

   {
     "Version": "2008-10-17",
     "Statement": [
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::568526795995:user/logs"
         },
         "Action": "s3:PutObject",
         "Resource": "arn:aws:s3:::BUCKET_NAME/*"
       },
       {
         "Sid": "",
         "Effect": "Deny",
         "Principal": {
           "AWS": "arn:aws:iam::568526795995:user/logs"
         },
         "Action": "s3:GetObject",
         "Resource": "arn:aws:s3:::BUCKET_NAME/*"},
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::568526795995:user/logs"
         },
         "Action": "s3:GetBucketLocation",
         "Resource": "arn:aws:s3:::BUCKET_NAME"
       },
       {
         "Sid": "",
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::568526795995:user/logs"
         },
         "Action": "s3:ListBucket",
         "Resource": "arn:aws:s3:::BUCKET_NAME"
       }
     ]
   }
   

   • Replace BUCKET_NAME with the Amazon S3 bucket name you provided.

5. Click Save.

Optional: Required Verification for self-managed Amazon S3 bucket

1. In the Cisco Umbrella dashboard, select Admin > Log management > Amazon S3.
2. In the Bucket name field, specify your exact Amazon S3 bucket name, and then click Verify.
3. As part of the verification process, a file named README_FROM_UMBRELLA.txt is uploaded from Cisco Umbrella to your Amazon S3 bucket. You may need to refresh your browser in order to see the readme file when it is uploaded.
4. Download the README_FROM_UMBRELLA.txt file, and open it using a text editor.
5. Copy and save the unique Cisco Umbrella token from the file.
6. Go to the Cisco Umbrella dashboard.
7. In the Token number field, specify the token and click Save.
8. If successful, you get a confirmation message in your dashboard indicating that the bucket was successfully verified. If you receive an error indicating that your bucket can't be verified, re-check the syntax of the bucket name and review the configuration.

Configure a feed in Google SecOps to ingest the Cisco Umbrella Audit logs

1. Go to SIEM Settings > Feeds.
2. Click Add new.
3. In the Feed name field, enter a name for the feed; for example, Cisco Umbrella Audit Logs.
4. Select Amazon S3 as the Source type.
5. Select Cisco Umbrella Audit as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • Region: enter the region where the Amazon S3 bucket is located.
   • S3 URI: the bucket URI.
     • s3:/BUCKET_NAME
       • Replace BUCKET_NAME with the actual name of the bucket.
   • URI is a: select Directory which includes subdirectories, Single file, or Directory, according to the log stream configuration.
   • Source deletion options: select deletion option according to your preference.
   • Access Key ID: enter the User access key with access to the s3 bucket.
   • Secret Access Key: enter the User secret key with access to the s3 bucket.
   • Optional: Asset namespace: provide the asset namespace.
   • Optional: Ingestion labels: provide the label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Changes

2024-01-10

Enhancement:

• Added support for DNS type logs.
• Mapped date_time to metadata.event_timestamp.
• Mapped most_granular_identity, most_granular_identity_type, identity_types and blocked_categories to additional.fields.
• Mapped internal_ip and external_ip to principal.ip.
• Mapped action_type to security_result.action_details.
• Mapped dns_query_type to network.dns.questions.type.
• Mapped dns_response_code to network.dns.response_code.
• Mapped domain to network.dns.questions.name.
• Mapped categories to security_result.category_details.

2023-02-28

• Newly created parser.

Need more help? Get answers from Community members and Google SecOps professionals.