Cisco Umbrella Integration with TEM

Overview

Check Point Threat Exposure Management (TEM) integrates with Cisco Umbrella to enhance visibility, minimize exposures, and streamline security operations.

The integration provides centralized Indicators Management, enabling consistent management and distribution of threat intelligence across all integrated security controls. This ensures unified enforcement and alignment of threat policies throughout the organization.

Integrating Cisco Umbrella with TEM

Step 1 - Assigning the VeritiBlockList to a Policy

TEM automatically creates and maintains a destination list named VeritiBlockList in Cisco Umbrella.

However, to enforce the indicators in this list, you must manually assign VeritiBlockList to a policy:

  1. Log in to the Cisco Umbrella Dashboard.

  2. From the left navigation panel, go to All Policies and click on a policy from the list.

  3. In the Destination Lists Enforced section, click Edit.

    The Apply Destination List page appears.

  4. In the All Destination Lists section, enable the VeritiBlockList checkbox.

  5. Click Set & Return.

  6. Click Save.

Step 2 - Generating an API Token in Cisco Umbrella

  1. Log in to the Cisco Umbrella dashboard.

  2. Go to Admin > API Keys.

  3. Click Add at the top right corner.

  4. In the Add New API Key pop-up that appears, enter a new API key.

  5. In the Key Scope section, expand Policies and enable the Destination Lists checkbox.

  6. In the selected Scope section, set the permission to Read / Write.

  7. Click CREATE KEY.

    Note - Ensure you copy and securely store both the API Key and Key Secret immediately after creation, as they cannot be retrieved later if lost.

Step 3 - Configuring the TEM Portal

  1. Log in to the TEM portal.

  2. Go to Settings> Integrations > Catalog and select Umbrella.

  3. In the Connection tab, enter the following details to establish integration with Umbrella.

    1. In the Connection Name field, enter a name for this integration instance.

    2. In the API Key field, paste the API Key generated from the Cisco Umbrella dashboard.

    3. In the Key Secret field, paste the corresponding Key Secret.

  4. Click Next.

  5. (Optional) In the Configuration section, enable the Backfill Indicators checkbox to import existing indicators into the integration.

  6. Click Connect to establish a connection.