If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

The goal of this guide is to add a new SkyFormation for Cisco Umbrella for endpoints Connector to your SkyFormation Platform.

Prerequisites

To add theCisco Umbrella connector to SkyFormation app, you will need to have the following information at hand:

1. Access Key
   
2. Secret Key
3. S3 bucket Name
4. Folder (Prefix) of the bucket

In order to get this information, follow the next steps:

1. log into https://login.umbrella.com/

2. In your Cisco Umbrella console, go to Settings > Log Management and complete the following steps.

   1. Select the option to use a Cisco managed S3 bucket.
   2. Select your Region and select Save.

   

   3. The console will take a few moments to activate. Then you will see a confirmation message with the Bucket Name, Access Key, and Secret Key. 

On-board SkyFormation for Cisco Umbrella connector - steps

1. Login to your SkyFormation Platform:

2. Navigate via left navigation panel to "Settings" section

3. Navigate via New Settings left navigation panel to "Accounts" section

4. Click the "Add Account" bottom

5. At the "SELECT SERVICE TO ADD" choose "Cisco Umbrella" 

    You will see the below screen:

6. Fill in the following information:

    - Account Name
        Give the Cisco Cisco Umbrella account a meaningful name for you. This will become your cloud app          connector name displayed in the application and the events sent to external systems as SIEM/Log              management. This is a mandatory field.

      e.g. "Corporate Cisco Umbrella for endpoints"     

    - Description
      Add a text that describes the Cisco Umbrella service account for you.

      e.g. "An admin service to manage the Corp Cisco Umbrella suite". This is an optional field.

   -  Access Key

        The client ID from the prerequisites section.

   - Client Key 

        The secure API Key. from the prerequisites section. 

   - S3 Bucket Name

         Cisco managed Amazon S3 bucket

  - Folder (Prefix)

         Data Path from Cisco at the form of s3://bucketname/f1/f2/f3.  f1/f2/f3 would be used as the folder prefix. For more information please see :

https://support.umbrella.com/hc/en-us/articles/115004685266-Cisco-managed-Buckets-in-Amazon-S3-for-Log-Management

At this point you can click on "TEST CONNECTION" to make sure the connection is setup successfully, or just click on "DONE".

Start the Cisco Umbrella connector and make sure that the status becomes "OK" after a few seconds.

DONE!