Cisco Umbrella Integration

Add credentials in the connector catalog; the Cisco Umbrella manifest handles auth, polling schedule, checkpointing, and dedup automatically. Most tenants are streaming events in under an hour.

ManySignal ships curated detection rules for Cisco Umbrella that run alert-only until they prove precision in your environment, then can be promoted.

Yes. Cisco Umbrella alerts flow into the agentic SOC queue where the triage agent renders evidence-weighted verdicts using entity-graph context.

Where the source supports it, response actions are available under the autonomy ladder — recommend-only, approve-gated, or autonomous, always with dry-run previews.

The connector manifest documents the minimum required scopes for Cisco Umbrella. ManySignal follows least-privilege principles: read scopes for telemetry ingestion and write scopes only for the specific response actions you choose to enable.

The health-monitoring subsystem tracks ingestion lag and checkpoint staleness per connector. If a feed goes silent or falls behind expected event rate, an operational alert fires before the gap becomes a detection blind spot.

Yes. ManySignal normalises events from all sources into a unified OCSF-aligned schema, so Cisco Umbrella telemetry correlates with endpoint, identity, cloud, and network events in the same entity graph and triage queue.

The connector manifest maps source fields to the OCSF event schema. Entity resolution links Cisco Umbrella user and asset identifiers to the canonical entity nodes in the graph — deduplication across sources happens automatically.

The default retention window is 90 days for raw events and 180 days for entity graph state. Enterprise customers can extend raw event retention to 365 days or beyond under a data retention add-on, with per-source policies configurable in the connector settings.