View Cisco’s documentation for configuring this integration here, or follow the steps below:
  1. Login to Cisco Umbrella
    1. If you are an MSSP or Service Provider, login to your Umbrella Dashboard > Customer Management > Select the customer you want to integrate
  2. Select Admin > Log Management
  3. Select Use a Cisco-managed Amazon S3 bucket
    1. Set data retention to 7 days
    2. Set region to us-west-1
  4. Save the data path and AWS keys
  5. In Wirespeed, navigate to Integrations > Add Integration > Cisco Umbrella and provide the information from step 4
After adding the integration, it typically takes 5-10 minutes for Cisco to start publishing data.
Proxy logs from Cisco Umbrella are not currently supported

Cisco publishes DNS events every 10 minutes, so there is approximately a 10 minute delay until events show up in Wirespeed.