WEBVTT

1
00:00.000 --> 00:08.410
It's absolutely crucial in any networking and security environment to have

2
00:08.410 --> 00:13.000
really good reports and information on what's going on in our network.

3
00:13.000 --> 00:18.070
Now, we just looked at the overview page, which, well, as the name implies,

4
00:18.070 --> 00:20.000
does give you a nice overview.

5
00:20.000 --> 00:25.000
And we can use that to drill down deeper into the detailed information.

6
00:25.000 --> 00:29.470
However, we also have some really nice reports available that'll give us that

7
00:29.470 --> 00:31.000
information as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:29.470 --> 00:31.000
information as well.

8
00:31.000 --> 00:36.020
So let's go ahead and jump in and take a look at some of the reporting that's

9
00:36.020 --> 00:38.000
available in Umbrella.

10
00:38.000 --> 00:43.000
So beginning here from the overview page, let's go over here to reporting.

11
00:43.000 --> 00:46.000
And as you can see, there's quite a few reports here.

12
00:46.000 --> 00:50.000
Let's start by looking at some of our core reports.

13
00:50.000 --> 00:53.000
Let's start with the top threats.

14
00:53.000 --> 00:58.580
So if we simply click on top threats here, what we see on this report first, in

15
00:58.580 --> 01:03.000
this left column, we have our different threat types.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:58.580 --> 01:03.000
this left column, we have our different threat types.

16
01:03.000 --> 01:08.330
And as we can see, it actually defaults for the tables to show us all threat

17
01:08.330 --> 01:09.000
types.

18
01:09.000 --> 01:11.000
Now we can click on any one of these.

19
01:11.000 --> 01:16.220
So for example, say Trojan, and it'll show us just the activity for that

20
01:16.220 --> 01:21.000
particular threat type, or we can click on say ransomware.

21
01:21.000 --> 01:25.000
There's also this link up here to see all the details.

22
01:25.000 --> 01:29.000
This will of course break it down even further.

23
01:29.000 --> 01:31.000
But let's go back to our threat types.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
01:29.000 --> 01:31.000
But let's go back to our threat types.

24
01:31.000 --> 01:35.380
Also, as usual, we can put our mouse over here to see information at specific

25
01:35.380 --> 01:36.000
times.

26
01:36.000 --> 01:42.000
And if we scroll down on any of these, we can see the total top threats.

27
01:42.000 --> 01:47.000
We can see the actual threat type under the category of ransomware.

28
01:47.000 --> 01:53.270
In this case, shade, we can also see the top active identities, which devices

29
01:53.270 --> 01:59.000
or users or networks are committing this infraction the most.

30
01:59.000 --> 02:03.340
If we scroll down even further, we get sort of the complete list of top
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:59.000 --> 02:03.340
If we scroll down even further, we get sort of the complete list of top

31
02:03.340 --> 02:08.000
entities rather than the shorter list that we had up in the main table.

32
02:08.000 --> 02:15.000
And we can see the top malicious domains committing this particular infraction.

33
02:15.000 --> 02:19.000
Down at the bottom, it would show us any newly seen domains.

34
02:19.000 --> 02:23.260
In other words, being more recent, things that it's learned within the

35
02:23.260 --> 02:28.000
timeframe, which again, this is defaulting to 24 hours.

36
02:28.000 --> 02:32.560
So this is a great report just to get some overall detail on what's going on in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
02:28.000 --> 02:32.560
So this is a great report just to get some overall detail on what's going on in

37
02:32.560 --> 02:34.000
your environment.

38
02:34.000 --> 02:36.000
Of course, there's some other great ones too.

39
02:36.000 --> 02:38.000
Let's take a look at security activity.

40
02:38.000 --> 02:42.050
There's a lot of different filtering we can do in the left hand column here,

41
02:42.050 --> 02:46.000
where we can choose the timeframe, the event type, what type of response.

42
02:46.000 --> 02:49.000
In other words, are we seeing what was allowed or what was blocked?

43
02:49.000 --> 02:54.190
And over on the right side, we can see all the security activity within again

44
02:54.190 --> 02:56.000
our scheduled timeframe.

45
02:56.000 --> 02:59.000
In this case, 24 hours.

46
02:59.000 --> 03:04.000
Down at the bottom here, of course, is a list of all of the infractions.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

46
02:59.000 --> 03:04.000
Down at the bottom here, of course, is a list of all of the infractions.

47
03:04.000 --> 03:07.000
And if we scroll down, we can see the complete list.

48
03:07.000 --> 03:10.000
As you can see, this is actually seven pages.

49
03:10.000 --> 03:12.000
This is just the beginning of it.

50
03:12.000 --> 03:14.000
We, of course, don't have to look over the whole thing.

51
03:14.000 --> 03:17.000
Let's take a look at our activity search.

52
03:17.000 --> 03:20.000
As you can see, this is quite similar.

53
03:20.000 --> 03:24.000
We can choose on the left what it is we want to filter based on.

54
03:24.000 --> 03:28.000
And of course, all of the activity is then shown on the right.

55
03:28.000 --> 03:30.000
Also for app discovery.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
03:30.000 --> 03:34.550
Here we can see different infractions that have occurred based on different

57
03:34.550 --> 03:36.000
application types.

58
03:36.000 --> 03:40.000
Such as generative AI or games or cloud storage.

59
03:40.000 --> 03:44.000
There's also a section down here of additional reports.

60
03:44.000 --> 03:47.000
And as you can see, there's a whole bunch of different things here.

61
03:47.000 --> 03:51.000
We're not going to look at every one of these, but categories, such as total

62
03:51.000 --> 03:54.000
requests and top categories and so on.

63
03:54.000 --> 03:57.000
And there's some management reports as well.

64
03:57.000 --> 04:02.000
As far as activities related to the management of Cisco umbrella.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
03:57.000 --> 04:02.000
As far as activities related to the management of Cisco umbrella.

65
04:02.000 --> 04:07.920
So as you can see, there are some super powerful reporting tools available here

66
04:07.920 --> 04:10.000
in Cisco umbrella.

67
04:10.000 --> 04:14.130
The core reports, of course, are the big ones, but the additional reports and

68
04:14.130 --> 04:17.000
the management reports are quite helpful as well.

69
04:17.000 --> 04:23.350
And one final note, many of these reports do have an option here to download

70
04:23.350 --> 04:27.000
this as a PDF, which, of course, can be quite nice.

71
04:27.000 --> 04:31.160
If you have to report this kind of thing to upper management, it gives you a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
04:27.000 --> 04:31.160
If you have to report this kind of thing to upper management, it gives you a

72
04:31.160 --> 04:35.690
nice easy way to deliver something through email or something like that without

73
04:35.690 --> 04:38.000
having to actually get into this interface.

74
04:38.000 --> 04:43.040
So in this video, we took a look at some of the really cool and powerful

75
04:43.040 --> 04:48.000
reporting tools that we have available here in Cisco umbrella.

76
04:48.000 --> 04:52.850
Now, you might have noticed that a lot of these things listed identities as we

77
04:52.850 --> 04:54.000
went through.

78
04:54.000 --> 04:58.030
So next, let's take a look at where we could go to actually manage those

79
04:58.030 --> 04:59.000
identities.

80
04:59.000 --> 05:09.000
[BLANK_AUDIO]
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:59.000 --> 05:09.000
[BLANK_AUDIO]