Welcome \u201cInvestigate API\u201d into the Cisco Cloud Security API experience<\/h2>\n

Developers and engineers can now leverage the new Umbrella API authentication to create API keys. This includes access to\u2026 Read more on Cisco Blogs<\/a><\/p>\n

\u200b[[{“value”:”<\/p>\n

Welcome \u201cInvestigate API\u201d into the Cisco Cloud Security API experience<\/h2>\n

Developers and engineers can now leverage the new Umbrella API authentication to create API keys. This includes access to Investigate API alongside other Umbrella APIs, utilizing a modern OAuth2 mechanism<\/a>. Previously, the process for authenticating the Investigate API<\/a> involved generating a specific Investigate API token (basic authentication) via the Investigate section in the user interface.<\/p>\n

Cisco customers and partners can also extensively utilize the Investigate API to enhance the data in their Security Information and Event Management (SIEM) systems, threat intelligence platforms, or incident management workflows. This enables them to promptly identify critical security events and provide additional information for security analysts and incident responders. The Investigate API is also a fundamental component in major integrations, such as Cisco XDR.<\/p>\n

In the screenshot below you can see how you can now set the description for the related API Key in the Umbrella dashboard.<\/p>\n\n

If we take into account cases where clients integrate Umbrella with a lot of 3d party platforms, descriptions can provide clarity as to the use of related API credentials. For example, you can add a description like \u201cInvestigate API Key with Read\/Write admin scope for Splunk.\u201d<\/p>\n

Restrict API access from specific IPs<\/h2>\n

Limiting API access for a given API Key<\/a> to a specific IP address or range of addresses is now possible. This significant security enhancement guarantees that customer API requests originate solely from secure and authorized locations. DevSecOps teams and administrators can now enforce that these requests are made exclusively from designated IP addresses or ranges and work with both IPv4 and IPv6 sources.<\/p>\n\n

A few more API updates<\/h2>\n

You can now seamlessly apply Internal Domains to Sites from the existing POST request<\/a>.
\nFor Application Discovery, now it\u2019s possible to get a list of application attributes<\/a>, including Vulnerabilities, Application Security, Access Controls, Audibility, and others for detected applications.
\nFor a list of Application API operation<\/a>, It\u2019s now possible to sort by Weighted Risk and Last Detected (in addition to First Detected).<\/p>\n

Try these updates in the DevNet Sandbox<\/h2>\n

Give it a try! Play with these updates using the Umbrella DevNet Sandbox<\/a>.<\/p>\n

\n\t\tShare\n

\n

<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n

Share:<\/div>\n

\n

\n

<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n

“}]]\u00a0\u00a0See how developers can utilize the Investigate API to enhance the data in their Security Information and Event Management (SIEM) systems, threat intelligence platforms, or incident management workflows.\u00a0\u00a0Read More<\/a>\u00a0Cisco Blogs\u00a0<\/p>","protected":false},"excerpt":{"rendered":"

<\/p>\n

Welcome \u201cInvestigate API\u201d into the Cisco Cloud Security API experience<\/h2>\n

Developers and engineers can now leverage the new Umbrella API authentication to create API keys. This includes access to\u2026 Read more on Cisco Blogs<\/a><\/p>\n

\u200b[[{“value”:”<\/p>\n

Welcome \u201cInvestigate API\u201d into the Cisco Cloud Security API experience<\/h2>\n

Developers and engineers can now leverage the new Umbrella API authentication to create API keys. This includes access to Investigate API alongside other Umbrella APIs, utilizing a modern OAuth2 mechanism<\/a>. Previously, the process for authenticating the Investigate API<\/a> involved generating a specific Investigate API token (basic authentication) via the Investigate section in the user interface.<\/p>\n

Cisco customers and partners can also extensively utilize the Investigate API to enhance the data in their Security Information and Event Management (SIEM) systems, threat intelligence platforms, or incident management workflows. This enables them to promptly identify critical security events and provide additional information for security analysts and incident responders. The Investigate API is also a fundamental component in major integrations, such as Cisco XDR.<\/p>\n

In the screenshot below you can see how you can now set the description for the related API Key in the Umbrella dashboard.<\/p>\n

If we take into account cases where clients integrate Umbrella with a lot of 3d party platforms, descriptions can provide clarity as to the use of related API credentials. For example, you can add a description like \u201cInvestigate API Key with Read\/Write admin scope for Splunk.\u201d<\/p>\n

Restrict API access from specific IPs<\/h2>\n

Limiting API access for a given API Key<\/a> to a specific IP address or range of addresses is now possible. This significant security enhancement guarantees that customer API requests originate solely from secure and authorized locations. DevSecOps teams and administrators can now enforce that these requests are made exclusively from designated IP addresses or ranges and work with both IPv4 and IPv6 sources.<\/p>\n

A few more API updates<\/h2>\n

You can now seamlessly apply Internal Domains to Sites from the existing POST request<\/a>.
\nFor Application Discovery, now it\u2019s possible to get a list of application attributes<\/a>, including Vulnerabilities, Application Security, Access Controls, Audibility, and others for detected applications.
\nFor a list of Application API operation<\/a>, It\u2019s now possible to sort by Weighted Risk and Last Detected (in addition to First Detected).<\/p>\n

Try these updates in the DevNet Sandbox<\/h2>\n

Give it a try! Play with these updates using the Umbrella DevNet Sandbox<\/a>.<\/p>\n

\n\t\tShare<\/p>\n

\n

<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n

Share:<\/div>\n

\n

\n

<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t\t<\/a>\n\t<\/div>\n<\/div>\n

\n

\n\t <\/a>\n\t<\/div>\n<\/div>\n<\/div>\n

“}]]\u00a0\u00a0See how developers can utilize the Investigate API to enhance the data in their Security Information and Event Management (SIEM) systems, threat intelligence platforms, or incident management workflows.\u00a0\u00a0Read More<\/a>\u00a0Cisco Blogs\u00a0<\/p>\n

<\/p>\n","protected":false},"author":0,"featured_media":2660,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-2659","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cisco-learning"],"yoast_head":"\n