WEBVTT

1
00:00.000 --> 00:08.280
So let's begin by connecting to DCloud and getting connected into the umbrella

2
00:08.280 --> 00:09.500
instant demo.

3
00:09.500 --> 00:15.100
Now, what's cool about the instant demo is we don't have to schedule it or VPN

4
00:15.100 --> 00:15.500
into

5
00:15.500 --> 00:17.620
DCloud to connect to it.

6
00:17.620 --> 00:19.700
We can just get right to it.

7
00:19.700 --> 00:24.100
Now that said, there can be a lot of people in here at the same time.

8
00:24.100 --> 00:26.260
Everybody's sharing the same server.

9
00:26.260 --> 00:29.460
Therefore, it is going to be a read only environment.

10
00:29.460 --> 00:31.220
But that's all we want to do right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.460 --> 00:31.220
But that's all we want to do right now.

11
00:31.220 --> 00:35.540
We want to get in and get familiar with the umbrella interface.

12
00:35.540 --> 00:41.170
So let's go ahead and get connected and take a look at the very first page, the

13
00:41.170 --> 00:41.620
overview

14
00:41.620 --> 00:42.620
page.

15
00:42.620 --> 00:45.540
Let's take a look.

16
00:45.540 --> 00:51.300
So if you follow the link provided below this video, you should end up on this

17
00:51.300 --> 00:52.020
page.

18
00:52.020 --> 00:57.080
If for some reason you don't, you can always just log into DCloud and do a

19
00:57.080 --> 00:58.340
search for this

20
00:58.340 --> 01:04.460
title right here, the Cisco umbrella version 2.2 instant demo.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:58.340 --> 01:04.460
title right here, the Cisco umbrella version 2.2 instant demo.

21
01:04.460 --> 01:08.240
That would also give you the opportunity to get on a data center that might be

22
01:08.240 --> 01:08.620
closer

23
01:08.620 --> 01:10.780
to your physical location.

24
01:10.780 --> 01:16.460
As you can see right here, I am currently connected to RTP, which is in North

25
01:16.460 --> 01:17.260
Carolina

26
01:17.260 --> 01:19.140
in the United States.

27
01:19.140 --> 01:23.460
If that's not relatively close to you, you may want to choose a different data

28
01:23.460 --> 01:23.940
center

29
01:23.940 --> 01:28.060
and you can simply do that as you're going through DCloud.

30
01:28.060 --> 01:32.840
But once we arrive on this page, you can of course look over the information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:28.060 --> 01:32.840
But once we arrive on this page, you can of course look over the information

31
01:32.840 --> 01:33.140
here and

32
01:33.140 --> 01:35.820
there are some resources available as well.

33
01:35.820 --> 01:40.640
But to get into umbrella, what we really want to do is simply click on view up

34
01:40.640 --> 01:41.020
here

35
01:41.020 --> 01:43.900
and it's going to launch us into umbrella.

36
01:43.900 --> 01:47.950
So the first thing we're seeing here is that we end up on the Cisco umbrella

37
01:47.950 --> 01:50.020
overview page.

38
01:50.020 --> 01:52.860
We're also getting a time sensitive message here.

39
01:52.860 --> 01:57.150
We can see this was actually posted seven months ago at this point in time

40
01:57.150 --> 01:57.660
where they're

41
01:57.660 --> 02:03.260
actually retiring the umbrella roaming client and instead migrating to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:57.660 --> 02:03.260
actually retiring the umbrella roaming client and instead migrating to the

42
02:03.260 --> 02:04.300
Cisco secure

43
02:04.300 --> 02:05.620
client.

44
02:05.620 --> 02:09.700
So since this message is time sensitive, this won't always be displayed.

45
02:09.700 --> 02:15.090
However, we then start with the real overview right below that critical message

46
02:15.090 --> 02:15.140
.

47
02:15.140 --> 02:19.340
But before we start going over that, it's also important to note that up here

48
02:19.340 --> 02:19.780
in the

49
02:19.780 --> 02:25.900
top right is a listing of when this is showing information from.

50
02:25.900 --> 02:29.580
It's defaulting to the last 24 hours.

51
02:29.580 --> 02:33.890
But as you can see, we can also choose yesterday, the last seven days, the last
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
02:29.580 --> 02:33.890
But as you can see, we can also choose yesterday, the last seven days, the last

52
02:33.890 --> 02:34.940
30 days or we

53
02:34.940 --> 02:37.220
can configure a custom range.

54
02:37.220 --> 02:39.740
Now again, we're just doing an overview here.

55
02:39.740 --> 02:45.090
So the last 24 hours is fine, but we can definitely change this range if we

56
02:45.090 --> 02:45.740
need to.

57
02:45.740 --> 02:51.530
So everything we see on this page is representing statistics for the last 24

58
02:51.530 --> 02:52.460
hours.

59
02:52.460 --> 02:58.920
So right below our message, we just have some counters, how much malware botnet

60
02:58.920 --> 02:59.820
requests,

61
02:59.820 --> 03:05.260
crypto mining requests have all happened within the last 24 hours.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:59.820 --> 03:05.260
crypto mining requests have all happened within the last 24 hours.

62
03:05.260 --> 03:07.780
Then we see the deployment health.

63
03:07.780 --> 03:12.220
This just covers the overall health of the different deployment types.

64
03:12.220 --> 03:14.260
How many active networks do we have?

65
03:14.260 --> 03:19.380
How many current active roaming clients are there active virtual appliances and

66
03:19.380 --> 03:20.300
active network

67
03:20.300 --> 03:22.260
tunnels?

68
03:22.260 --> 03:26.310
If we scroll down a little bit, we can see the network and the firewall

69
03:26.310 --> 03:27.220
breakdown.

70
03:27.220 --> 03:31.770
In the network section, we're seeing the total number of requests, total number
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:27.220 --> 03:31.770
In the network section, we're seeing the total number of requests, total number

71
03:31.770 --> 03:33.220
of blocks,

72
03:33.220 --> 03:35.580
and how many security blocks.

73
03:35.580 --> 03:40.620
We can also click on the tabs up here at the top and choose to see how many DNS

74
03:40.620 --> 03:41.580
requests,

75
03:41.580 --> 03:48.180
DNS blocks, and DNS security blocks there have been, as well as the web.

76
03:48.180 --> 03:52.160
Again, the same fields, but this is going to give us some counters and

77
03:52.160 --> 03:53.460
statistics as far

78
03:53.460 --> 03:54.980
as the network.

79
03:54.980 --> 04:01.420
For the firewall, we simply have total firewall sessions and total firewall
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:54.980 --> 04:01.420
For the firewall, we simply have total firewall sessions and total firewall

80
04:01.420 --> 04:02.380
blocks.

81
04:02.380 --> 04:07.170
If we scroll down a little bit more, we can see information about the IPS

82
04:07.170 --> 04:07.580
system, total

83
04:07.580 --> 04:11.880
signature events, signature events that have been allowed, and signature events

84
04:11.880 --> 04:12.020
that have

85
04:12.020 --> 04:13.340
been blocked.

86
04:13.340 --> 04:17.650
And by the way, all of these charts, as we're looking through here, if we put

87
04:17.650 --> 04:18.580
our mouse over

88
04:18.580 --> 04:24.600
one of these, we can get information about specific times and points on the

89
04:24.600 --> 04:25.460
chart.

90
04:25.460 --> 04:29.880
We can also click on the title for any one of these, and this will take us

91
04:29.880 --> 04:30.460
right to the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:29.880 --> 04:30.460
right to the

92
04:30.460 --> 04:34.940
detailed information about this particular chart.

93
04:34.940 --> 04:38.430
When each of these things happens, we can see here, for example, when things

94
04:38.430 --> 04:39.260
were blocked,

95
04:39.260 --> 04:44.560
when things were allowed, and we can see over on the right, in this case, what

96
04:44.560 --> 04:45.980
IPS signature

97
04:45.980 --> 04:50.220
triggered this to either be allowed or blocked.

98
04:50.220 --> 04:53.180
Then of course, we can go right back to the overview.

99
04:53.180 --> 04:57.100
So our next section here is security categories.

100
04:57.100 --> 05:01.560
We can see where it's doing malware blocks, phishing blocks, command and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:57.100 --> 05:01.560
We can see where it's doing malware blocks, phishing blocks, command and

101
05:01.560 --> 05:02.940
control blocks,

102
05:02.940 --> 05:05.620
and crypto mining blocks.

103
05:05.620 --> 05:10.530
A little further down, we have the app discovery and control, which is a

104
05:10.530 --> 05:12.160
breakdown of the Cloud

105
05:12.160 --> 05:16.740
app classification and flagged app categories.

106
05:16.740 --> 05:20.980
We're going to see this here listed by the total app reviews.

107
05:20.980 --> 05:27.420
The flagged apps card here is showing individual flagged apps.

108
05:27.420 --> 05:30.500
Then below this, we have the security requests.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
05:27.420 --> 05:30.500
Then below this, we have the security requests.

109
05:30.500 --> 05:36.190
Here we can see the top 10 by identity by default, and of course, we can change

110
05:36.190 --> 05:36.620
this

111
05:36.620 --> 05:39.740
to by destination or by type.

112
05:39.740 --> 05:44.460
But here it's showing us the top 10 identities that have had the most blocked

113
05:44.460 --> 05:45.340
requests.

114
05:45.340 --> 05:50.930
Of course, there's multiple pages here, so we could look at the top 50 actually

115
05:50.930 --> 05:51.300
, but

116
05:51.300 --> 05:54.740
again, this is just a nice overview.

117
05:54.740 --> 05:58.340
Then down here at the bottom, we have the file retrospective.

118
05:58.340 --> 06:04.220
This section actually shows any downloaded files that the Cisco threat grid
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
05:58.340 --> 06:04.220
This section actually shows any downloaded files that the Cisco threat grid

119
06:04.220 --> 06:05.020
actually

120
06:05.020 --> 06:06.500
analyzed.

121
06:06.500 --> 06:11.590
So as you can see, there's actually a lot of information here on the overview

122
06:11.590 --> 06:12.220
page.

123
06:12.220 --> 06:16.230
And even if this overview was not showing you exactly what you want to see, we

124
06:16.230 --> 06:16.940
can use

125
06:16.940 --> 06:21.900
these sections to drill down into more information.

126
06:21.900 --> 06:27.720
So in this video, our focus was on getting connected in here to the D cloud

127
06:27.720 --> 06:28.460
umbrella

128
06:28.460 --> 06:30.260
instant demo.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
06:28.460 --> 06:30.260
instant demo.

129
06:30.260 --> 06:34.540
Once we got connected, we spent a few minutes here going over the overview page

130
06:34.540 --> 06:35.340
, which has

131
06:35.340 --> 06:40.210
a lot of great information, and we can use it to drill down into more

132
06:40.210 --> 06:41.540
information.

133
06:41.540 --> 06:46.230
Next up, let's take a look at getting some more detailed information by looking

134
06:46.230 --> 06:46.700
at some

135
06:46.700 --> 06:47.900
security reports.

136
06:47.900 --> 06:56.460
[BLANK_AUDIO]