CiscoUmbrellaAdminAudit_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

---

Attribute	Value
Ingestion API Supported	✓ Yes

Contents

• Schema
• Solutions
• Connectors
• Content Items
• Parsers

Schema (10 columns)

Source: Connector definition

Column Name	Type	Description
Action	string	The type of change made, such as Create, update, or Delete.
After	string	The policy or setting after the change was made.
AuditType	string	Where the change was made, such as settings or a policy.
Before	string	The policy or setting before the change was made.
Email	string	The email of the user that triggered the event.
Id	string	Unique identifier for the admin audit event.
LoggedInFrom	string	The user's IP source.
TimeGenerated	datetime
Timestamp	string	The date and time of the administrative change event, expressed as a UTC-formatted string.
User	string	The account name of the user who created the change.

Solutions (1)

This table is used by the following solutions:

• CiscoUmbrella

Connectors (3)

This table is ingested by the following connectors:

Connector	Selection Criteria
Cisco Umbrella (via Codeless Connector Framework)
Cisco Cloud Security
Cisco Cloud Security (using elastic premium plan)

---

Content Items Using This Table (21)

Analytic Rules (10)

GitHub Only:

Analytic Rule	Selection Criteria
Cisco Cloud Security - Connection to Unpopular Website Detected
Cisco Cloud Security - Connection to non-corporate private network
Cisco Cloud Security - Crypto Miner User-Agent Detected
Cisco Cloud Security - Empty User Agent Detected
Cisco Cloud Security - Hack Tool User-Agent Detected
Cisco Cloud Security - Rare User Agent Detected
Cisco Cloud Security - Request Allowed to harmful/malicious URI category
Cisco Cloud Security - Request to blocklisted file type
Cisco Cloud Security - URI contains IP address
Cisco Cloud Security - Windows PowerShell User-Agent Detected

Hunting Queries (10)

In solution CiscoUmbrella:

Hunting Query	Selection Criteria
Cisco Cloud Security - 'Blocked' User-Agents.
Cisco Cloud Security - Anomalous FQDNs for domain
Cisco Cloud Security - DNS Errors.
Cisco Cloud Security - DNS requests to unreliable categories.
Cisco Cloud Security - High values of Uploaded Data
Cisco Cloud Security - Higher values of count of the Same BytesIn size
Cisco Cloud Security - Possible connection to C2.
Cisco Cloud Security - Possible data exfiltration
Cisco Cloud Security - Proxy 'Allowed' to unreliable categories.
Cisco Cloud Security - Requests to uncategorized resources

Workbooks (1)

In solution CiscoUmbrella:

Workbook	Selection Criteria
CiscoUmbrella

Parsers Using This Table (1)

Other Parsers (1)

Parser	Solution	Selection Criteria
Cisco_Umbrella	CiscoUmbrella

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index