In this short video, I'll talk about application control in Umbrella and how to make use of app discovery report. My name is the and I'm a security customer success specialist with Cisco.00:05With that, let's talk about today's agenda. We'll talk about application visibility and control using app discovery report, how to make use of that report and configure different application settings and finally we'll take a look at the demo. With that, let's talk about application visibility and control.00:17So if you see on the right side, you can see a small screenshot from the app discovery report, which gives you a full view across your managed and unmanaged cloud activity. It tells you what are the different apps in your environment, filtered by your labels that you have custom created or the risk categorization based on Talos intelligence or based on the type.00:35Of app it is, whether it belongs to media, financial service, marketing, education, et cetera.00:55This helps you overall minimize negative impact on productivity, your expenses, security and support issues. It also gives you a way to detect and monitor your cloud apps across your entire environment. Discover apps based on vendors, categories, risk ranking.01:01And more and also get an easier access to easily block or unblock apps in your environment, which you approve or don't approve depending on your requirement. This is another screenshot from the app discovery report itself, and this gives you a better idea on how the report looks like. If you see, you can easily see 3822 apps dis.01:18Out of which how many are unreviewed, which apps are still under ordered by the administrators, apps that have not been approved by you or approved apps. It also tells you flagged category, which is a very important category.01:39Category or section in the report, as I say, it tells you what are the top flagged apps according to us or according to Talos. E.g., in this the top three flagged categories are anonymizers, P2P and games, which is something you should review once you come and take a look at the report.01:51You also get a visibility into the cloud app usage. Like if you see, you can see the total number of DNS requests sorted by your risk or the labels. Again, this is something we'll take a look at in the demo, but this both these pages should give you a fair understanding on what app discovery report looks like and you get an idea of what apps are being used in your environment.02:06Once you get an understanding around that, that's where you go and create your application settings where you get more granular app control, you get more visibility via the app discovery report. So for your example over here, you can go and just search in the app where you can just give it any names, type in the app you want to block.02:26Whenever you see a complete checkbox, it means you're blocking the entire category within it. Or if you see a-or a-then it means that within that entire category you're blocking some apps. But this is how you can go and create your own application settings and then eventually apply it in your policy. So now that we have seen how the report and the settings.02:44Look like. Let's go and see it in the demo. So this is my umbrella dashboard that I've logged into and this is my overview page. The 1st thing that we'll do is take a look at the report. So this is where your app discovery report is located within the reporting section.03:04Once you come over here, based on everyone's environment, you will see the total number of apps discovered, what are your flagged categories, flagged protocols, some of these styles depend on what type of licenses you have. Are you a DNS customer? Are you a sick customer? So it will definitely depend on that. But overall, this is how the report will look like.03:20So this is where you can see the DNS request by app risk, where you can see the number of requests based on risk, whether it was very high, high, medium. So this is where you can see that or you can see the apps by the type of application and the risk. So both the types of categorization are there where you can just click on any one of these and get more details.03:39But what we are going to do is we are going to pick one of these flagged categories and click on it. So it gives brings you to this core report where you can see what these apps are. You can always cross the unreviewed unreviewed label. Always remember whatever you see over there are labels. You can go and change them to.03:58Either of these depending on where you stand with that report. Now, let's assume we want to block open AI chat GPT. You can, before you make that decision, you can click on that app, come over here and see what type of app it is. What is the app URL?04:16What is the business risk? What is the web reputation, data storage? Again, you see all of these details and you can always click on this page of Talos intelligence if you want more details about the app. And the usage risk tells you about how high the usage of the app is, how many people are using it, how many, how much is your DNS traffic. So you see all of those details.04:32And finally you see vendor compliance. So you see what are the different certificates that are that are there on that particular app, for different types. So if you can see these are the name of different certificates and what is the status in terms of compliance.04:52Another important aspect is your identity aspect where you can see who are the users using it. The identities could vary depending on how you've configured. It could be tunnel, it could be your network device, it could be a username or it could be a roaming computer. But this page fairly gives you an idea on how many requests are coming, who are the users and.05:07To get an idea around that app.05:27All of this helps you make an informed decision whether you want to block an app or not. Now coming onto the configuration part, you go to policies and over here you go to application settings. Now, if it's just a DNS in your environment, you will see apply to DNS policy, but if you are a sick customer, you have application settings for web policy as well.05:29We'll talk about just the DNS policy, so if I just expand this over here, you should be able to see these options over here. So if you see here, some options are selected within this.05:49If I go over here and select everything, this is how it will be there. You have an option to just type in a name and go over here and select it. So this is where you can just come and make an informed decision based on the app on what do you want to allow or block in your environment. Once you do that, that is when you go to your DNS policy, select which.05:59This is the policy in which you want to make those change, see what are the identities to which is applied. This is where you come to your application settings and from the dropdown select what setting you want to apply. And that is how you control applications in your environment depending on what that particular user is.06:19So with that, I hope you got a fair understanding of what application settings are. How do you create those settings and apply it to the policy? Thank you so much for watching this video.06:39
