Skip to Content

Cisco Umbrella 

Cisco Umbrella Overview


Cisco Umbrella uses the internet's infrastructure to enforce security at the cloud edge and block malicious activity before a connection is ever established.

30 seconds to set up a free 30 day trial!


A Cisco Umbrella trial is very easy to set up. You can test the platform without needing hardware, with most users blocking threats in 30 minutes or less


Apply for a Free Trial of Cisco Umbrella

also used as first administrator
you can add up to 4 more admin emails (apart from yourself, which is already assumed)
You can have as many trial users as you like. We will check how many you will need if you want to move forwards with a paid subscription at the trial expiry.
DNS Security Advantage: Key features
  • Use the Investigate web console for interactive threat intel access and the on-demand enrichment API to integrate intelligence into other systems
  • Discover and block shadow IT (based on domains) with the App Discovery report
  • Proxy and decrypt risky domains for deeper inspection of URLs and files
  • Enable web filtering using 85+ domain content categories
  • Create custom allow and block lists
  • Protect mobile and roaming users who are off network

Cisco Umbrella DNS Security Essentials: Key features 
  • Includes a core, highly targeted set of DNS-layer threat-blocking tools
  • Deploy within minutes without adding latency or sacrificing uptime
  • Filter traffic and block domains carrying malware, botnets, and more
  • View activity in real-time using the Umbrella API to identify and extract critical events

  Cisco Umbrella SIG Essentials: Key features
  • Groups together critical security solutions typically sold individually
  • Requires less time and fewer resources to configure
  • Helps reduce risk exposure and cut complexity in convergent SASE environments
  • Value-focused package uses a single license to cover all

Learn More...
Umbrella Package Remote Browser Isolation 'Add-Ons'

RBI and thus the Web policy rule’s “Isolate” Rule Action is only available as an Add-on to your Umbrella package. If available and chosen as the Rule Action, the availability of destinations for selection when configuring a rule is based on your Umbrella package’s RBI Add-on. There are several variations of the RBI add-on available, each with its own level of isolation.

Isolate Any
Any security categories, content categories, applications, and destination lists can be isolated.

Isolate Risky
Isolate is available for the following destination types:

  • Security Categories: Malware, Command and Control Callbacks, Phishing Attacks, and Potentially Harmful
  • Content Categories: Uncategorized

Isolate Web Apps
Isolate is available for the following destination types:

  • Content Categories Chat, File Storage, File Transfer Services, Instant Messaging, Organizational Email Professional Networking, Social Networking, and Webmail.

Learn More...
Cloud-Delivered Firewall

The Umbrella cloud-delivered firewall provides visibility and control for all traffic across all ports and protocols. This could include mobile apps, peer-to-peer file sharing, collaboration (for example, WebEx or Zoom), or any non-web or non-DNS traffic. It logs activity and blocks unwanted traffic using IP, port, and protocol rules (layer 3/4 firewall), application rules (layer 7 firewall), and intrusion prevention system (IPS) rules.

Data Loss Prevention

Umbrella data loss prevention (DLP) analyzes sensitive data in-line to provide visibility and control over sensitive data. DLP does more than retroactively alert you of potential leaks and abnormal file transfers. It blocks the transfer of your sensitive data before it even leaves your organization.

Learn More...

Cisco Umbrella SIG Advantage: Key features

  • The highest level of Cisco Umbrella protection in a single service
  • Includes 7-layer firewall, data loss prevention, other features exclusive to this package
  • Seamlessly helps block cyberattacks at the DNS-layer across SASE environments
  • Value-focused subscription covers all features: CASB, advanced malware analytics, and more

Learn More...
Umbrella Package Remote Browser Isolation 'Add-Ons'

RBI and thus the Web policy rule’s “Isolate” Rule Action is only available as an Add-on to your Umbrella package. If available and chosen as the Rule Action, the availability of destinations for selection when configuring a rule is based on your Umbrella package’s RBI Add-on. There are several variations of the RBI add-on available, each with its own level of isolation.

Isolate Any
Any security categories, content categories, applications, and destination lists can be isolated.

Isolate Risky
Isolate is available for the following destination types:

  • Security Categories: Malware, Command and Control Callbacks, Phishing Attacks, and Potentially Harmful
  • Content Categories: Uncategorized

Isolate Web Apps
Isolate is available for the following destination types:

  • Content Categories Chat, File Storage, File Transfer Services, Instant Messaging, Organizational Email Professional Networking, Social Networking, and Webmail.

Learn More...
Cloud-Delivered Firewall

The Umbrella cloud-delivered firewall provides visibility and control for all traffic across all ports and protocols. This could include mobile apps, peer-to-peer file sharing, collaboration (for example, WebEx or Zoom), or any non-web or non-DNS traffic. It logs activity and blocks unwanted traffic using IP, port, and protocol rules (layer 3/4 firewall), application rules (layer 7 firewall), and intrusion prevention system (IPS) rules.

Data Loss Prevention

Umbrella data loss prevention (DLP) analyzes sensitive data in-line to provide visibility and control over sensitive data. DLP does more than retroactively alert you of potential leaks and abnormal file transfers. It blocks the transfer of your sensitive data before it even leaves your organization.

Learn More...

Submit


DNS Essential DNS Advantage SIG Essential Sig Advantage
Security, Access, and Control
Recursive DNS-Layer Security
Block access to domain with malware, phishing, botnet, and other high-risk items with low latency ● ● ● ●
Application discovery, monitoring, blocking, and risk scoring ● ● ● ●
Filtering by domain or category ● ● ● ●
Application and Network Access/Monitoring

SD-WAN integration and 3rd party support ● ●
Secure Web Gateway (SWG)



Custom block/allow lists of domains ● ● ● ●
Custom block/allow lists of URLs
Partial ● ●
Proxy and inspect web traffic
Partial ● ●
Secure Malware Analytics (sandbox suspicious files; block malicious files)

500 samples/day ●
Secure Malware Analytics - manual file submission, full glove box and full SMA console access


●
Roaming Security and Client Support



Roaming user protection for DNS traffic and web traffic (via SWG), with Cisco Secure Client roaming module (* = DNS traffic only) ●* ●* ●* ●*
Cloud Access Security Broker (CASB)



Advanced visibility and control of cloud app usage (including gen AI, OAuth-approved apps, tenant controls). Limited Limited ● ●
Scan and remove malware from cloud-based file storage apps

● up to 2 ●
SaaS security posture management (SSPM) capabilities + Advanced capability via partnership with AppOmni (+ = partnership) ●+ ●+ ●+ ●+
Data Loss Prevention (DLP)



Integrated inline/SaaS API (cloud) data inspection and blocking to protect against sensitive data loss

Add-on ●
Firewall as a Service (FWaaS)



Layer 3 and 4 control of IPs, ports, and protocols

● ●
Layer 7 control

Add-on ●
Intrusion Prevention System (IPS) with decryption


limited to decryption 
Remote Browser Isolation (RBI)



Isolated browsing provides a virtual air-gapped solution in those instances where users need to safely go to sites that present a risk

Add-on Add-on
Threat Intelligence



Continuously updated threat intelligence from Cisco Talos ● ● ● ●
Deep domain, IP, and Autonomous System Number (ASN) data for rapid investigations (via Investigate API)
● ● ●
SIEM and XDR Interoperability



Integrations with multiple tools, includ. Cisco Splunk and XDR ● ● ● ●
Management, Reporting, and Support



Management



Single management interface ● ● ● ●
Customize block page and warn page options  ● ● ● ●
Reporting and Logging



Real-time activity search, plus API to extract key events ● ● ● ●
Choose North America or Europe log storage ● ● ● ●
Cisco-managed S3 buckets or customer AWS S3 buckets ● ● ● ●
Support



24x7 Enhanced Software Support Service via email and phone (Premium upgrade available) Add-on Add-on Add-on Add-on