Security & Identity · CONNECTIONRead Umbrella networks, roaming computers, sites, destination lists, DNS activity and domain categories and risk, and add or remove destinations in a list.
Explore 12 workflow actions for Cisco Umbrella, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Add up to 500 domains, URLs or IPs to a destination list, such as a block list (scope policies.destinations:write).
A repeated request may repeat the external action. Review the previous result before retrying a write.
Read one destination list (scope policies.destinationLists:read).
Read a domain's status and its content and security categories (scope investigate.investigate:read).
Read a domain's risk score and indicators (scope investigate.investigate:read).
Read one roaming computer (scope deployments.roamingcomputers:read).
List allow and block destination lists (scope policies.destinationLists:read).
List the domains, URLs and IPs in a destination list (scope policies.destinations:read).
Read DNS activity over a time range, optionally by domain, verdict, identity or threat (scope reports.granularEvents:read).
List the organization's networks (scope deployments.networks:read).
List roaming computers, optionally by name, DNS-layer status or last sync (scope deployments.roamingcomputers:read).
List the organization's sites (scope deployments.sites:read).
Remove up to 500 destinations from a destination list by their IDs (scope policies.destinations:write).
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in Cisco Umbrella. A saved workflow is not a completed provider action.
