Device Details
|
Device Name |
Cisco Umbrella DNS |
|
Vendor |
Cisco |
|
Device Type |
Umbrella DNS |
|
Supported Model Name/Number |
N/A |
|
Supported Software Version |
N/A |
|
Collection Method |
Flat File |
|
Configurable Log Output |
No |
|
Log Source Type |
Flat File - Cisco Umbrella DNS |
|
Log Processing Policy |
LogRhythm Default V 2.0 |
|
Exceptions |
N/A |
|
Additional Information |
https://docs.umbrella.com/umbrella-user-guide/docs/log-format-and-versioning#dns |
Supported Log Messages
(List of LR tags used to parse the log information for each message type)
|
Type |
Product Version |
Supported Schema Fields |
|
V 2.0: Admin Audit Logs |
N/A |
<account>, <login>, <object>, <action>, <tag1>, <sip> |
|
V 2.0: Cloud Firewall Logs |
N/A |
<object>, <objecttype>, <protnum>, <size>, <sip>, <sport>, <dip>, <dport>, <action>, <tag1> |
|
V 2.0: DLP Logs |
N/A |
<severity>, <object>, <process>, <domainorigin>, <action>, <tag1>, <policy>, <size>, <hash> |
|
V 2.0: DNS Logs |
N/A |
<object>, <login>, <sip>, <dip>, <action>, <tag1>, <sessiontype>, <responsecode>, <domainimpacted>, <subject>, <objecttype>, <result> |
|
V 2.0: IP Logs |
N/A |
<object>, <sip>, <sport>, <dip>, <dport>, <subject>, <objecttype> |
|
V 2.0: IPS Logs |
N/A |
<object>, <objecttype>, <subject>, <severity>, <cve>, <protname>, <session>, <sip>, <sport>, <dip>, <dport>, <action>, <tag1> |
|
V 2.0: Proxy Web Logs |
N/A |
<login>, <sip>, <dip>, <action>, <tag1>, <url>, <useragent>, <responsecode>, <bytesout>, <bytesin>, <hash>, <subject>, <threatname>, <object>, <objecttype>, <status> |
|
V 2.0: Catch All: Level 1 |
N/A |
N/A |
Revision History
|
KB Version |
Log Type |
Change Type |
Details |
|
KB 7.1.661.0 |
Flat File-Cisco Umbrella DNS |
New Log Source Optimization (LSO) policy: LogRhythm Default V 2.0 |
Optimized new log processing policy for Flat File-Cisco Umbrella DNS |