Enricher - Cisco Malicious Domains#

Note

This article describes how to configure a particular enrichment source. To see how to configure enrichers in general, see Configure enrichers.

Specifications

Enricher name

Cisco Malicious Domains

Input

Ipv4.

Output

Malicious domain names related to or hosted by the input IP addresses.

API endpoints

https://investigate.api.umbrella.com/ips/{Input}/latest_domains

Description

Enriches supported observables with a list of malicious domain names the input IP addresses host.

Note

The default Source reliability value for this enricher is C – Fairly reliable.
You can change it to a different reliability value, as needed.

Requirements#

Users need an API key. Log in to Cisco Umbrella, and then go to the Investigate API Access area to create a new API token.

Configure the enricher parameters#

  1. Edit the enricher.

  2. From the Observable types drop-down menu, select one or more observable types you want to enrich with data retrieved through the Cisco Malicious Domains enricher.

  3. The API URL field is automatically filled in with the default domain for the endpoint.
    You can add a proxy or set up ports according to your needs.
    Default value: https://investigate.api.umbrella.com.

  4. In the API key field, enter your Cisco API token.

  5. To store your changes, click Save; to discard them, click Cancel.