WEBVTT

1
00:00.000 --> 00:00.685 align:middle line:84%


2
00:00.685 --> 00:02.060 align:middle line:90%
When implementing
Umbrella, there

3
00:02.060 --> 00:04.268 align:middle line:90%
are three really important
things that we want to do.

4
00:04.268 --> 00:07.240 align:middle line:90%
Number one is to decide on and
implement a policy, two, verify

5
00:07.240 --> 00:10.390 align:middle line:90%
it's working, and three, have
some great reporting to figure

6
00:10.390 --> 00:11.740 align:middle line:84%
out what the heck happened.

7
00:11.740 --> 00:14.950 align:middle line:90%
All that exists in Umbrella
with also the additional option

8
00:14.950 --> 00:16.510 align:middle line:84%
of doing some investigation.

9
00:16.510 --> 00:19.420 align:middle line:90%
So we have a URL or a site
that we're curious about.

10
00:19.420 --> 00:21.040 align:middle line:90%
There's an interface
an Umbrella where

11
00:21.040 --> 00:22.600 align:middle line:90%
I can put that
information in and it

12
00:22.600 --> 00:25.720 align:middle line:90%
will give us the reputation and
details regarding that site.

13
00:25.720 --> 00:27.730 align:middle line:90%
And that gives us the
tools in our own hands

14
00:27.730 --> 00:30.010 align:middle line:90%
to do that research
on suspicious sites
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:27.730 --> 00:30.010 align:middle line:90%
to do that research
on suspicious sites

15
00:30.010 --> 00:31.532 align:middle line:84%
that we have questions about.

16
00:31.532 --> 00:33.490 align:middle line:90%
So let me start off with
some really great URLs

17
00:33.490 --> 00:34.850 align:middle line:84%
that we can use in testing.

18
00:34.850 --> 00:39.820 align:middle line:90%
So let's start off right
here, welcome.umbrella.com,

19
00:39.820 --> 00:41.920 align:middle line:84%
or welcome.opendns.com.

20
00:41.920 --> 00:44.710 align:middle line:90%
Those can verify, first of
all, that your clients are

21
00:44.710 --> 00:46.870 align:middle line:84%
using Umbrella DNS services.

22
00:46.870 --> 00:49.120 align:middle line:90%
Now, this could be from
them pointing directly

23
00:49.120 --> 00:51.280 align:middle line:90%
to the DNS services
or it could be

24
00:51.280 --> 00:53.860 align:middle line:90%
from the client, the
remote client, installed

25
00:53.860 --> 00:55.570 align:middle line:90%
on their computer
that's forcing them

26
00:55.570 --> 00:58.650 align:middle line:90%
to use the OpenDNS or
the Umbrella DNS service.

27
00:58.650 --> 00:59.650 align:middle line:84%
So that's a great start.

28
00:59.650 --> 01:01.525 align:middle line:90%
Then there are some
fantastic websites
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.650 --> 01:01.525 align:middle line:90%
Then there are some
fantastic websites

29
01:01.525 --> 01:02.650 align:middle line:84%
that we should be aware of.

30
01:02.650 --> 01:06.730 align:middle line:90%
This is one of them,
www.internetbadguys.com.

31
01:06.730 --> 01:09.203 align:middle line:90%
Now, that is actually
managed by Cisco.

32
01:09.203 --> 01:10.870 align:middle line:90%
And so it's not really
a malicious page.

33
01:10.870 --> 01:12.620 align:middle line:90%
So if you went there
it wouldn't harm you.

34
01:12.620 --> 01:14.170 align:middle line:90%
However, it's a
great way to verify

35
01:14.170 --> 01:16.960 align:middle line:90%
that traffic is being stopped
that's being classified

36
01:16.960 --> 01:18.273 align:middle line:84%
as a security risk.

37
01:18.273 --> 01:19.690 align:middle line:90%
Another great site
that we can use

38
01:19.690 --> 01:23.077 align:middle line:90%
this www.examplemalware.com,
and once again,

39
01:23.077 --> 01:24.910 align:middle line:90%
that's being blocked
because it's identified

40
01:24.910 --> 01:26.350 align:middle line:84%
as being a security threat.

41
01:26.350 --> 01:28.060 align:middle line:90%
And if we did actually
go to that site

42
01:28.060 --> 01:30.910 align:middle line:90%
and we weren't using
Umbrella, this exact URL
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.060 --> 01:30.910 align:middle line:90%
and we weren't using
Umbrella, this exact URL

43
01:30.910 --> 01:33.280 align:middle line:90%
would not harm us if we are
going to the real server

44
01:33.280 --> 01:35.900 align:middle line:90%
there because that's
maintained by Cisco as well.

45
01:35.900 --> 01:37.270 align:middle line:84%
And it's just used for testing.

46
01:37.270 --> 01:43.530 align:middle line:90%
Another great site is this,
www.examplebotnetdomain.com,

47
01:43.530 --> 01:46.740 align:middle line:90%
again as a test to verify
that our policy is blocking

48
01:46.740 --> 01:48.450 align:middle line:84%
those types of DNS requests.

49
01:48.450 --> 01:50.620 align:middle line:90%
And then this one right
here is also quite good.

50
01:50.620 --> 01:52.890 align:middle line:84%
It's exampleadultsite.com.

51
01:52.890 --> 01:53.880 align:middle line:84%
And you want to be--

52
01:53.880 --> 01:56.610 align:middle line:90%
I'm always very nervous on
testing against adult pages

53
01:56.610 --> 01:59.530 align:middle line:90%
because you don't want to have
that traffic on your network.

54
01:59.530 --> 02:01.410 align:middle line:90%
And so this is one
that you'd want to make
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:59.530 --> 02:01.410 align:middle line:90%
And so this is one
that you'd want to make

55
02:01.410 --> 02:02.460 align:middle line:84%
sure you type in correct.

56
02:02.460 --> 02:05.820 align:middle line:90%
This is one that's being
maintained by OpenDNS/Cisco,

57
02:05.820 --> 02:08.160 align:middle line:90%
and it's saying here it's
only a demonstration site.

58
02:08.160 --> 02:10.502 align:middle line:90%
If you are using OpenDNS
Parental Controls,

59
02:10.502 --> 02:11.460 align:middle line:84%
this would be filtered.

60
02:11.460 --> 02:13.350 align:middle line:90%
Now, the question that
we could ask ourselves

61
02:13.350 --> 02:15.210 align:middle line:84%
is, why am I seeing this page?

62
02:15.210 --> 02:16.860 align:middle line:90%
Why am I not seeing
a block page?

63
02:16.860 --> 02:18.090 align:middle line:84%
Why am I seeing this?

64
02:18.090 --> 02:20.520 align:middle line:90%
And that's because the
policy that we have applied,

65
02:20.520 --> 02:24.360 align:middle line:90%
we are specifically only
blocking one category of URL,

66
02:24.360 --> 02:26.112 align:middle line:90%
and that was
alcohol-related websites.

67
02:26.112 --> 02:27.820 align:middle line:90%
And that's why this
one is going through.

68
02:27.820 --> 02:29.195 align:middle line:90%
So it's a great
idea, a great way

69
02:29.195 --> 02:31.962 align:middle line:90%
to test to verify our
policies are being enforced.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:29.195 --> 02:31.962 align:middle line:90%
to test to verify our
policies are being enforced.

70
02:31.962 --> 02:33.420 align:middle line:90%
If we're getting
different results,

71
02:33.420 --> 02:35.670 align:middle line:90%
we'd want to look at our
policies a little bit closer.

72
02:35.670 --> 02:39.960 align:middle line:90%
Another great site is this,
ihaveabadreputation.com,

73
02:39.960 --> 02:42.600 align:middle line:90%
which is also identified
being a security threat.

74
02:42.600 --> 02:44.550 align:middle line:90%
And this also leads
us to a great way

75
02:44.550 --> 02:48.150 align:middle line:90%
to use the investigate tool
that's built into Umbrella.

76
02:48.150 --> 02:50.247 align:middle line:90%
So I'm going to copy that
URL, and we'll go back

77
02:50.247 --> 02:51.330 align:middle line:84%
to the Umbrella interface.

78
02:51.330 --> 02:52.622 align:middle line:84%
Let me collapse a few of these.

79
02:52.622 --> 02:55.480 align:middle line:90%
And let's go down to
Investigate, right here.

80
02:55.480 --> 02:57.720 align:middle line:90%
And this gives us
opportunities to do searches

81
02:57.720 --> 03:00.720 align:middle line:90%
and looking into email
addresses, or URLs,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:57.720 --> 03:00.720 align:middle line:90%
and looking into email
addresses, or URLs,

82
03:00.720 --> 03:01.407 align:middle line:84%
or host names.

83
03:01.407 --> 03:03.240 align:middle line:90%
There's also options
for regular expression,

84
03:03.240 --> 03:05.460 align:middle line:90%
but if we wanted to just
search on, for example,

85
03:05.460 --> 03:08.130 align:middle line:90%
that URL,
ihaveabadreputation.com,

86
03:08.130 --> 03:10.080 align:middle line:90%
and then click on
Investigate, it's

87
03:10.080 --> 03:12.510 align:middle line:90%
going to show right here
the risk level, the security

88
03:12.510 --> 03:15.523 align:middle line:90%
categories, and if we
expand Security Indicators,

89
03:15.523 --> 03:17.190 align:middle line:90%
it'll talk about the
security indicators

90
03:17.190 --> 03:18.700 align:middle line:84%
and why they are what they are.

91
03:18.700 --> 03:20.910 align:middle line:90%
As we continue to scroll
down, more details

92
03:20.910 --> 03:22.290 align:middle line:84%
and information about that.

93
03:22.290 --> 03:27.300 align:middle line:90%
If we were to grab some other
site like CBTNuggets.com,

94
03:27.300 --> 03:30.330 align:middle line:90%
great, so it's been
categorized by Cisco Umbrella,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:27.300 --> 03:30.330 align:middle line:90%
great, so it's been
categorized by Cisco Umbrella,

95
03:30.330 --> 03:32.970 align:middle line:90%
and behind that, the
Talos security teams.

96
03:32.970 --> 03:36.420 align:middle line:90%
And they've identified as
a Low Risk as the category.

97
03:36.420 --> 03:38.340 align:middle line:90%
And here's the
security indicators,

98
03:38.340 --> 03:40.782 align:middle line:90%
which are leading up to
the overall security risk.

99
03:40.782 --> 03:42.240 align:middle line:90%
There are some
quantities regarding

100
03:42.240 --> 03:45.570 align:middle line:90%
DNS requests over time, and
regarding DNS resolution

101
03:45.570 --> 03:47.970 align:middle line:90%
addresses, name
servers involved.

102
03:47.970 --> 03:49.800 align:middle line:90%
And it looks like based
on the name servers

103
03:49.800 --> 03:53.820 align:middle line:90%
here that we are using a
lot AWS to host that for us.

104
03:53.820 --> 03:55.725 align:middle line:90%
And let's also take
a look at Reporting.

105
03:55.725 --> 03:57.960 align:middle line:90%
So over here on the left,
we click on Reporting.

106
03:57.960 --> 04:00.180 align:middle line:90%
And if we expand
Reporting right here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:57.960 --> 04:00.180 align:middle line:90%
And if we expand
Reporting right here,

107
04:00.180 --> 04:02.610 align:middle line:90%
we've got Security
Overview, Security Activity,

108
04:02.610 --> 04:05.110 align:middle line:90%
Activity Search, App
Discovery, Threats,

109
04:05.110 --> 04:06.390 align:middle line:84%
and then additional reports.

110
04:06.390 --> 04:08.523 align:middle line:90%
So we had tons of reports,
a bunch of core reports

111
04:08.523 --> 04:10.440 align:middle line:90%
and additional reports
to basically ferret out

112
04:10.440 --> 04:12.580 align:middle line:90%
any details that we'd
like to know about.

113
04:12.580 --> 04:14.640 align:middle line:90%
So I'm going to go
ahead and say This Week.

114
04:14.640 --> 04:16.529 align:middle line:90%
And there we have some blocks,
and those are the blocks

115
04:16.529 --> 04:18.112 align:middle line:90%
that we tested just
a few moments ago.

116
04:18.112 --> 04:18.910 align:middle line:84%
Fantastic.

117
04:18.910 --> 04:20.123 align:middle line:84%
There's an Activity Search.

118
04:20.123 --> 04:21.540 align:middle line:90%
So a lot of this
traffic is coming

119
04:21.540 --> 04:24.390 align:middle line:90%
from KB-TestNet, which does
not have the custom policy we

120
04:24.390 --> 04:27.060 align:middle line:90%
associated with Bob that has
the default policy, which

121
04:27.060 --> 04:28.337 align:middle line:84%
is catching all identities.

122
04:28.337 --> 04:30.420 align:middle line:90%
So I have a few computers
here that are associated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:28.337 --> 04:30.420 align:middle line:90%
So I have a few computers
here that are associated

123
04:30.420 --> 04:32.460 align:middle line:90%
with that one outside
global address,

124
04:32.460 --> 04:34.590 align:middle line:90%
and that's why we see
this activity here.

125
04:34.590 --> 04:37.530 align:middle line:90%
And then Top Categories
and Top Identities.

126
04:37.530 --> 04:39.030 align:middle line:90%
And while I have
you here, there's

127
04:39.030 --> 04:40.930 align:middle line:90%
one more element I'd
like to share with you.

128
04:40.930 --> 04:42.780 align:middle line:90%
And that's under
the Admin section.

129
04:42.780 --> 04:45.370 align:middle line:90%
And that is regarding
Log Management.

130
04:45.370 --> 04:47.400 align:middle line:90%
So as you might
imagine, the log files

131
04:47.400 --> 04:50.140 align:middle line:90%
could be quite large over
time for an organization.

132
04:50.140 --> 04:52.620 align:middle line:90%
And so it's showing us right
here on your data storage

133
04:52.620 --> 04:55.722 align:middle line:90%
that Umbrella is saving my log
data to the North American data

134
04:55.722 --> 04:57.180 align:middle line:90%
warehouse, which
is important if we

135
04:57.180 --> 04:59.400 align:middle line:90%
want to be aware geographically
in the world that's

136
04:59.400 --> 05:00.030 align:middle line:84%
being saved.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
04:59.400 --> 05:00.030 align:middle line:84%
being saved.

137
05:00.030 --> 05:02.640 align:middle line:90%
If we want to change that,
we can change location.

138
05:02.640 --> 05:04.140 align:middle line:90%
And if you scroll
down, there's also

139
05:04.140 --> 05:08.290 align:middle line:90%
an option here under Log
Management for Amazon S3.

140
05:08.290 --> 05:10.740 align:middle line:90%
So we could use a company
managed Amazon S3 bucket

141
05:10.740 --> 05:12.660 align:middle line:90%
by specifying the
name and verifying it,

142
05:12.660 --> 05:16.200 align:middle line:90%
or click on this radio button
and use Cisco-managed Amazon

143
05:16.200 --> 05:17.263 align:middle line:84%
S3 storage.

144
05:17.263 --> 05:18.930 align:middle line:90%
So the key here is
under Log Management,

145
05:18.930 --> 05:22.320 align:middle line:90%
we can control how and where
we want that data saved.

146
05:22.320 --> 05:24.590 align:middle line:90%
In this video, we've
identified three basic things.

147
05:24.590 --> 05:28.830 align:middle line:90%
Number one, there is reporting
galore with Cisco Umbrella.

148
05:28.830 --> 05:31.170 align:middle line:90%
Secondly, we also have
the Investigate feature
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
05:28.830 --> 05:31.170 align:middle line:90%
Secondly, we also have
the Investigate feature

149
05:31.170 --> 05:33.822 align:middle line:90%
where we can do additional
research on an IP address,

150
05:33.822 --> 05:36.030 align:middle line:90%
or email address, or domain
to find out more about it

151
05:36.030 --> 05:36.960 align:middle line:84%
should we need to.

152
05:36.960 --> 05:39.030 align:middle line:90%
All those tools are
built into Umbrella.

153
05:39.030 --> 05:41.070 align:middle line:90%
And then third,
regarding log files,

154
05:41.070 --> 05:43.290 align:middle line:90%
we can control where they're
stored geographically.

155
05:43.290 --> 05:46.210 align:middle line:90%
And if we want to use Amazon
storage as part of that,

156
05:46.210 --> 05:48.995 align:middle line:90%
we can control that, too, right
through the Umbrella interface.

157
05:48.995 --> 05:50.620 align:middle line:90%
So thanks for joining
me in this video.

158
05:50.620 --> 05:51.828 align:middle line:84%
I'll see you in the next one.

159
05:51.828 --> 05:54.060 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

160
05:54.060 --> 05:57.380 align:middle line:90%
and I'd like to thank
you for viewing.