Cisco Umbrella DNS Health Check Webinar

Alright, well welcome everybody today's umbrella DNS health check webinar. We will get started shortly. If you have any questions during the webinar, be sure to submit into the Q and A box.00:09To access the Q and A box, click on the three dots located in the lower right hand corner of your Webex console, and select Q and AI will also be adding a few questions via Slido today, so please answer any of those you would like. Today's webinar is being recorded and the link will be available after the session via the email.00:20At the end of the presentation, we will take some time to answer some questions if time permits. If we run out of time, we will provide answers to all questions submitted. Now I'd like to introduce you to our presenter today, Brett Parnell, he's one of our senior technical customer success specialists that supports Umbrella and secure access. We also have some technical customer success.00:39Panelists that can assist with any questions that come up to my, come to mind during the webinar. So let me go ahead and turn it over to Brett now.00:59Hi everybody, it's a pleasure to be here with you all today. Thanks for joining us. We're at the top of the hour here, so we're just gonna kind of move our way into things. We're gonna start with a short bit of a PowerPoint presentation, kind of go over what we're gonna talk about, and then we're gonna move into a.01:08Little health check for your umbrella dashboard. As Chris mentioned, my name is Brett Parnell. I am part of our at scale strategic customer success specialist team, and I work closely with our umbrella and secure access teams.01:25I'm glad to have you all here for the DNS health check webinar. Okay doke. So just a quick overview. We're just gonna go through an introduction of everything, a solution recap of of things and then a, a dashboard walkthrough. We'll talk a little bit about, you know.01:41Things to initially grab when you're starting umbrella troubleshooting for TAC cases, and how to open TAC cases. We have some slides with some links on that, that for you guys as well. And then we're kind of gonna go into a just quick overview of what's new.01:59Okay, oh yes, sorry I should click through to the slide when I was introducing myself, but yes, that's me. Alright, just before we start, I just want to go over a little bit of housekeeping. If you're having any issues with the webinar during the session, please use the chat feature in Webex to notify Chris.02:18And he'll try to help you figure that out if possible. And you know, as this, webinar is here wholly for your benefit, we do encourage you to ask questions. If you have any questions during the session, you'll notice that there is a Q and A section separate from the chat section.02:38We definitely prefer it if you put your questions in there because if you put them in chat, we will just ask you to reiterate them in Q and A cause it's a simpler way for us to pull out the questions and get them to you in writing afterwards. So please make sure that you're asking questions in Q and A if possible.02:57This session is being recorded as Chris mentioned, so it will be emailed out in the end. Okay, so just a quick overview of the agenda, we're gonna spend most of our time here in the dashboard talking about how you can use the information.03:15And that's there to make your umbrella deployment as healthy and as valuable to your organization as possible.03:35While we're inside the dashboard, we'll discuss how to make changes and how to take advantage of some new features. Okay, I'm seeing that there's NO Q and A sorry my apologies there. I guess we'll have to do things in chat. My apologies.03:41So do just put the questions in chat in that case. We'll figure out why that didn't pop up at a later date, but please feel free to ask your questions there. So while we're inside the dashboard, we'll discuss how to make changes and how to take advantage of some new features, also share some quick troubleshooting.03:56Steps that will help you drive quicker resolutions when you're reaching out to Cisco TAC.04:17After that, we're gonna kind of show you where you can check your, you know, keep up to date with your umbrella education. I know the product is quite mature and we have, we don't add a large number of new features, but it is important to make sure that you keep up to date with your umbrella knowledge.04:23Our what's new section this time will kind of go over an introduction to our newer products secure access and its DNS specific offering. So do be sure to stick around so that you can just hear a little bit about that and in the future we will also be going over in another webinar the migration from.04:40Umbrella DNS to secure access DNS defense. Okay, so the why of a health check? Why, why do we say that our customers should be doing health checks?05:00Say you've already deployed umbrella. You've made all your configurations and customizations and everything is running smoothly. So why would you need or want to go back into your dashboard to see how things are going? Well, you can ask yourself, have I fully completed my deployment? Has there been any new devices added? Any changes to the things that you need to cover?05:15Such as, you know.05:35Before you didn't care about, having AD users now, you need to add AD users. As, as your environment changes, you need to keep up with what, what needs to be protected. So while Umbrella feels like it could be a setup and forget it ish a product, it is really not.05:37We're constantly coming out with, you know, slight changes to how things operate. In this case we are moving to newer products such as secure access. So it's important to regularly log into your dashboard and check your environment. This can include new versions to virtual appliances or AD connectors to make sure that, you know.05:55There aren't errors in your devices to make sure that everything is healthy.06:16As I mentioned, you want to make sure that your deployment is meeting your organization's needs. Companies don't stay the same. I'm sure you all know that, so it's important to continually review and confirm that your deployment is meeting or exceeding your organization's changing acceptable use policies.06:22The 3rd reason that I find to do a health check is to ensure that you are taking advantage and maximizing all of the features and entitlements of your subscription. As I mentioned before, this is not a set it and forget it product, and we all know how quickly cyber the cybersecurity landscape can shift.06:40So as a result, we are constantly building and releasing new capabilities and updates to our existing features. It's for those three reasons we encourage you to familiarize yourself with the health check process so that you can ensure that your umbrella deployment is serving your organization's needs.06:59My apologies, just one sec. There's a large amount of noise coming from my background I'm just gonna fix that. All right, so we're getting ready for our umbrella health check here as we explore and go through your umbrella dashboard.07:17We're going to go through it as if it's a hub. We obviously land on our main overview page. It's a snapshot of your umbrella deployment. I do recommend logging in at least every week just to make sure that everything is going as expected.07:36You don't need to change anything when you log in, but taking a quick 10 min to peruse and, you know, look through your reports to make sure there are NO unusual behaviors is important. It'll really save you a lot of time in the long run to make sure that, you know, there aren't any things that you've missed.07:53If you aren't sure how to do that or are not very comfortable with navigating around the dashboard, don't worry because that's exactly what we're going to do today. For this webinar, we'll be walking through a health check progresses in processes in a DNS security dashboard.08:13Okay, so please make sure that you're asking any questions that you have and we'll get started. So just give me a second here while I transition to my dashboard. Okay, I have a.08:31Test dashboard up here for you guys. I do have a couple of extra screens as well that I want to just quickly check over. If you're using a device and you haven't checked if it's being protected by Umbrella and you want to quickly check, I do suggest quickly going to welcome.umbrella.com.08:47It will tell you if you are being protected. It's important to just double check that on new devices that you're deploying. It's the quick 1st step to make sure that umbrella is functioning as expected. Okay, so when you 1st log in.09:07This is the 1st page you'll see, the overview page. We like to call this your single pane snapshot of your umbrella environment. If you have only 2 min of time, you have enough time to get a quick summary of your protection. Thanks to this overview.09:23So here we can see our message center. Unfortunately right now there's NO messages to show, but I just wanted to point out that it's there. This is where you will find kind of one liner informational reports, notices of changes to features or alerts for new releases on, you know.09:40Roaming clients that need to be updated to a certain version for product capabilities. Our product team tends to post messages there if we plan to remove reports or end of life a feature, not that this happens often, but that is generally where you will see it within the dashboard.09:58Additionally, if there is an issue with any components like a domain controller or virtual appliance, you will see a red or yellow error message here. These messages are another reason why I recommend logging in at least once a week.10:16So if you log in and see a bunch of red or yellow at the top of the page, that is a good indication of where to start your health check. Now, at the top of the page, you'll see this handy component right here that allows you to change how much data you are seeing.10:32You have the options of last 24 h, last seven days, 30 days or a custom range. If you only log in once a week, I would recommend setting it to the last seven days. But for the purpose of this demo, I'm going to stay within the last 24 h.10:49So, when you are performing a health check, you want to match the data patterns on the screen to your own expectations. I say this because NO two organizations and as such, NO two umbrella deployments will look the same. That's why it's important to have a good idea of what your own expectations are for your unique umbrella deployment.11:08So, deployment health. This is kind of an easy way to take a look at what is happening in your environment. E.g., do you expect to see a hundred percent of your active networks up? Do you have backup networks that you don't expect to be running?11:29Or under active roaming clients, do you expect the majority of users to be in the office? If so, then that could result in a large number of inactive roaming clients. Or if you have people in different time zones, the same could apply. If something doesn't match your expectations, then I would recommend clicking in.11:49So that you can begin to investigate further. We'll just show quickly here that you can click right in on there and it'll bring you into a section. Obviously we're just gonna jump right back to the overview page and go in order here, but I just wanted to make sure you were aware that you can click those. Not that.12:09Okay, so most of the data and graphs you see on the overpage, view page are clickable, not just the blue links here, and you see along here, we have a nice little click icon.12:26You can click into active networks as, as I did with the roaming agents and it'll take us to the network status page. We'll come back to the networks page in just a few minutes. So, the next portion of the overview page is for the visualization of your data into various graphs.12:42Again, looking at these graphs, you want to think of in the terms of pattern matching. E.g., in these network breakdown graphs, does this pattern line up with your expectations of your business cycle? Are you expecting a quiet here between 04:00 P.M.?12:59To, you know, 06:00 A.M. as things start to pick up around 05:00 A.M. when the east coast wakes up, most companies in North America expect their traffic to go up. Those are the kind of things that you look for, but obviously as we've said, each instance is unique and you might not have those.13:15So do focus on what you are expecting to see. Okay, if you're not certain what's going on, all of these charts are clickable. So you can select a specific date, click, and this will take you to our activity page.13:32Filtered for that particular data set. We'll just show you here by clicking here. As you see it brings us into reporting, activity search, filtered to that specific time layout for the network traffic or for the traffic. Okay.13:49So, the last section of this page that I just quickly want to go over, you'll notice that there are some security blocked pages here, but there's unfortunately not a lot of data on this dashboard, but here you will see similar graphing to this, but based on these security category blocks. So if you do see them, as you can see here.14:07So with the little blue.you can click into the activity details and see further information on those specific blocks that you are seeing.14:27Yeah, last section here is the app discovery section. This is a snapshot of the app discovery report, which we will go through in a little more depth later. In this section, you want to think about your organization's aups, acceptable use policies.14:36Are the applications or app categories you are seeing something that is sanctioned by your company? Are you surprised to see any apps in here? If so, this is clickable as well, so you can click in and investigate the applications within the report itself. That is it for the overview page.14:56As I mentioned, it's a single pane that lets you connect to the rest of your dashboard in a much quicker manner and give you a, you know, little temperature check of your umbrella environment, provides an easy point entry point to drill down further into each type of report.15:15So even if you have only have a few minutes on your Monday mornings I do suggest taking the time to at least look over this section. We're going to move along into the core identity section of umbrella. So here, if we click under deployments, we can see core identities.15:31So beyond that, we also have a configuration section where you can set settings that affect your core identities. Identities are the objects that policies are enforced against. When looking through this section, you still want to be matching patterns with expectations.15:50And you also want to be on the lookout for warnings or errors. So we're just gonna quickly move over into the network section here. Here we would normally look for errors. As you can see, the three errors that are here or three networks that are here are all active and.16:06Not showing any errors. So, sometimes when you have a network here that's showing as inactive, you might want to go and double check that your networks are properly pointed towards umbrella. You may also notice that.16:26Not all the networks you're expecting are in here. These are quick things that you can see from this point of view to check, hey, that, that registered network, why is it, why isn't inactive? Let's go and make sure that it's pointing to Cisco umbrellas resolver IPs or maybe somehow you accidentally deleted an old network or you didn't.16:45Register it. Coming in and checking this is a good way to confirm that, you know, you've got the right IP addresses still selected. Maybe your company added a new network to a branch office.17:05So, you know, make sure you're looking based on what you're expecting to see. This can get a little bit more complicated when we are looking at the roaming client section though. So let's navigate there and walk through.17:17You'll notice that I didn't step into the network devices section. It's a rather specific setup, and we're not gonna go over it in today's health check. If you have more questions about network devices, please feel free to ask in the chat or, you know, our our documentation does go over it in detail as well.17:36Okay, here we are in the roaming computers tab. Again, once we navigate here, we are looking for errors and we're matching this data to our own expectations. I recommend changing the view on the page to show more than ten devices at a time as it unfortunately does start.17:57Quite small. Normally I suggest going with the maximum and looking for that from there when that's about a hundred devices at a time. Couple of quick things to keep in mind. A roaming client may not have recently synced or it may have been seen offline.18:15As simply offline because a laptop is off. So if you do see that, you know, your, your device hasn't synced in a little bit or it's not showing as protection, please keep that in mind. This is one of the reasons that I recommend starting with clients that haven't synced for, you know, more than 30 days. Here we'll see.18:32See the last sync category, do this being in a test environment. The devices all show is syncing 17 min ago, but you can look through this based on last sync by changing, you know, just with the clicks here, setting it up and looking for what's newest and what's the oldest. And then you can, you know, find out if somebody's laptop is broken or if.18:52They're having some network connectivity issues with the roaming aid the secure client and go from there on either reaching out to TAC or figuring out on your own end what's going on.19:12Okay, so we're just gonna quickly kind of take a look at one of the devices just to show what kind of information shows up in here. You can see the identity name as Cisco sees it, which is generally the host name. You can see an original host name, your OS version, and.19:29Client type. In this demo, unfortunately it does still show the umbrella roaming client. This is NO longer available as it is a standalone product. Most of you will see your Cisco secure client versions. This is a quick place to check, you know, hey, why am I seeing an outdated secure client version?19:46Right now we're in the fives. If you're seeing any connect or something like that, you're seeing a relatively old device that hasn't synced back in. We can also see quick checks on the protection status for IPV four and IPV six as well as what their last active policy was.20:05You can also search up here for specific version numbers to make sure that your versions are as expected, as well as, you know, operating systems or any other further information that you're interested in.20:25Okay, so we're gonna move on to the next section of our users or our core identities. We're gonna move down into users and groups.20:44I saw a question that's specific here. I'm going to take a minute to answer that. It was around roaming agents that are out of date or haven't checked in in a long period of time. We're just gonna pop over to another dashboard I have open here because unfortunately the other one is set to.21:03Be read only. As you can see, we're here in roaming computers. We're just gonna click here. We can see settings in the top right. If you click that, you end up on our global settings page. Here, the very 1st thing you're gonna see is auto delete inactive roaming computers. So.21:20Obviously, if this is disabled, they will stay around as long as the as you've had them there. Looking in here, you can set it to do not delete, you can set it to 30 and 90 or a hundred and 80 days. There are NO custom options unfortunately beyond that.21:39We're just gonna quickly go through the settings here. You can make sure that you're seeing active directory users and groups for policy enforcement for the roaming agents in client settings. You can set your DNS protection settings levels. You'll see limited protection, which is IPV four and dual stack IP.21:57IPV four and IPV six or full protection, which is, you know.22:17Dual stack single stack, for both. You'll notice that it lets you know you need a certain secure client version for this. Please ignore the sections below here that go for secure web gateway. This specific instance has SIG enabled. You can also go in and do back off settings.22:21Or if you have virtual appliances deployed or you have a, a trusted, a trusted network domain set so that if a device sees that domain and can resolve it to a certain.22:41My internal IP address, then your roaming agent will back off and NO longer function. I do suggest going into the documentation and reading through for these DNS back off settings for more information on this because it's quite specific. Okay, back to users and groups.22:53So, this is where you go to provision users and groups for your identity provider for use in umbrella. My apologies, my microphone died there, groups from your identity provider for use in your umbrella policies or.23:13For your user attribution within reporting.23:33Again, we are matching the status with expectations. Are the right things enabled for your organization? If not, go ahead and investigate as to why that is. So when I say that I mean like, do you have active directory as you expected? Is it empty? Do you expect to see.23:35More users or groups, those kind of things.23:55I thought I saw some questions around mobile devices and Chromebook users. It's much the same as looking for roaming computers. We can just take a quick pop in here, but I don't think there are any deployed in the test environment. Oh, there are. Okay, so you you would just want to go in and look for the app version, you know, see what.23:59Type of device it is, as well as the serial numbers, last sync, that kind of information.24:19For Chromebook, unfortunately we don't have anything set up. We do just have identities that show up in here. Okay, so we're gonna move on to the configuration section. I wanna focus on the sites in active Directory section as this tends to cause some confusion.24:24And for users.24:44When performing a health check, you want to look for the three green checks, I clicked in there in the status column, if you see red or yellow here, right along in here, you'll want to investigate as to why a VA or has an error or why your AD connector is not.24:47Working.25:07If you find that your AD connector is not in an ok state, 1st you'll want to, you know, double check your firewall or ACL requirements listed in our documentation to ensure that your AD connector or virtual appliance or any one of the other one of the AD components is able to communicate with our umbrella cloud. If you find that they are compatible.25:08And you think everything is being met, I do suggest going ahead and opening a support ticket with TAC.25:28So it's just some quick reminders on how things must be configured. We do so we do recommend deploying virtual appliances and pairs as well as having a preference of one active directory connector per umbrella logical site.25:35As listed here in the site column, when you use sites that allows them to be separated out so that devices don't communicate with each other, for instance, if you had two offices that you didn't want to use the same virtual appliances because they had different.25:50Active directory, you know, setups. We don't want you to keep them in the same site as that would cause problems. So this is a logical container within the umbrella dashboard to separate those out so that they can't communicate with each other.26:10Okay, we're gonna move on to the most important stuff that I find for checking your dashboard and that's navigating over to your policies. Alright, so.26:27In the all policy section, this is where we build our defenses and make sure that everyone is getting access to the things that they are expected to have access to. Let's take a good look at our policies from a perspective of do I need to do anything to change this policy or is it.26:48Healthy and good to stay the same.27:06There are three questions you want to ask concerning your policies during a health check. When was the policy created? And is it still relevant? Sometimes when working with customers, I see that, you know, they've removed all of the identities from a policy because they don't want it anymore. They've decided that this policy isn't, you know.27:09Something that's needed. It was a temporary policy say for something like FIFA.27:29So, you know, make sure you're coming in here and keeping up to date on your policies, making sure that you delete them as necessary or add new users or groups. So if we click into edit identity here, you can see that there are 80 computers, 80 groups, 80 users, we've got.27:35Chromebook identities that can be clicked, any type of identity or even logical sites can be used to select for, you know, the identity that a policy affects. So.27:53Another thing to check would be when was the last modified date for a policy? You know, if you see a policy that's three years old and nothing's changed on it, you, you might wanna go in there and see, you know, if there needs to be any updates made, do we need to add new destination lists or maybe the security settings that have been applied are NO longer.28:07Longer what your company considers acceptable. Maybe you have new categories to block.28:27And obviously, as I mentioned in the beginning, you just wanna make sure that you know the correct identities are are associated with a policy. You know, a policy that affects your, your executives should be updated specifically for them if you see somebody's in in there that shouldn't be want to look into that and see why that happened or what changed to.28:34To bring that in and we do have the the ability to do that within our our dashboard and we'll we'll we'll go into that a little bit later.28:54So following the rules that I just laid out, I'm going to look at when these policies were last modified and if the settings are still relevant. Perhaps there are older test policies, as I mentioned, you gotta, you can safely delete those when you're certain that you've removed all the identities and, you know, checked that nobody is getting improper access to things.29:01So something to keep in mind when looking at these is that Umbrella applies DNS policies in a top down method. This means if you're getting hit by the 1st policy here, you won't then get also attached to a policy number eight. So the 1st policy you're hitting is the policy that you.29:23You will get applied to. And so this can occur, this is important to note when you have network identities and roaming identities. If you don't have it set for roaming identities to back off, you'll generally be seen as the roaming identity at all times. So knowing what order.29:42You're attaching policies to things on based on whether they're roaming agents or networks is important. And just a quick note here because we just want to make sure you know that there's a catch all at least. If there's NO policy explicitly set for it, you will always hit the default policy at the end.29:59So, most restrictive policies I generally tend to say should be at the bottom and your most specific policies that target you know one to ten identities or maybe larger groups as well towards the top so that you know you're catching those who are, are important like a CEO or a CFO before anybody else.30:23So their policies that are are less limited and it catches them before getting them down into other policies. You don't wanna, you know, have those people get into the wrong policies and get blocked.30:43It's usually pretty straightforward except when you have, you know, users who could potentially qualify for multiple identities as I stated. So, you know, keep an eye out for that when you have roaming clients and networks and AD users. For that we do have our policy tester.30:55Click on that here. Let's say I think Adam MacKenzie is a identity on here. Whoops. Yeah, we'll grab that and you know he's trying to, you wanna see if he can get the internet bad guys.com. We do have the.31:14Option to, you know, verify this through the policy tester. We select.31:34The user or network, and then we also select a domain, and we just quickly run our test. In this case, internet bad guys.com is a test domain that Cisco has or Cisco has through its old connections with open DNS.31:38What umbrella originated from to test as a, you know.31:58Benign malware block. So we will see that this is blocked due to a security setting. And you can see also which policy was applied right down here. If that policy didn't apply.32:01You will see which other policies could have been applied to it, that identity and what the result would have been. Within the policies, I just want to make a quick call out to destination lists. Depending on how your destina, your organization uses destination lists, it maybe a good idea to review these lists and confirm that specific lists are.32:20Actually up to date or if they should be attached to a specific policy, so we'll just take a look at that here within a specific policy components. You can create allower block list here or you can create them within the all policy section as well. There we go, just reset that so it's not showing up.32:41Okay, we're going to move into our reporting section. Each of these, before we do that quickly, each of these policy components besides destination lists such as, you know, your content categories, your security categories.33:03And the various ones you see here are clickable within the policy component section of the policies and can be individually configured and then reattached to your policies as necessary. Okey doke reporting.33:19This whole section is about making sure your data is actionable and helpful for investigations. So we're gonna go through our four core reports today and I'll also kind of talk about scheduling reports that have predefined filters. So.33:381st core report you will come across is the security activity report. The security activity report highlights security events generated by your organization's identities who have visited destinations that have been flagged but not necessarily blocked by our threat intelligen.33:54Intelligence organization Talos.34:14This includes security events filtered through the intelligent proxy and file inspection. When performing a health check, I think it is best to look at what security activity was allowed since the last time you logged in. So we're just gonna quickly grab that to show you what it is. Unfortunately, as I.34:16Mentioned earlier at the beginning, there's, this, this test environment is a little bit out of date. It unfortunately has some issues loading the data that is normally here. But if you use these categories on the side here, you can also go in and select specific categories if you don't care about phishing and you only want to look into malware or crypto mining or.34:36Any of the other categories, you can go in there and specify that.34:56So make sure you take a look when you're doing this to look at your specific environments needs for checking. So like other graphs in our dashboard, this one is also clickable and allows you to quickly dive into a specific data point for more information.35:03So say for instance, you saw a spike in security events here where we don't see anything right now. There would be a clickable section here. Unfortunately, due to the nature of the dashboard that we have up here, we don't have a clickable point. I apologize for that, but it would just show up like the other graphs you saw on the security over or on the overview page and you just click in there and it will.35:21Will take you into your activity search, which is our more granular searching platform.35:41So, if it's an allowed malware destination, you, you might want to check, make sure that that's not an A record or something else that somebody can go into and actually look at things, you know, you can confirm in our activity search what type of record some.35:47Thing was, and we'll take a quick look at that when we move into the activity search, which is what we're going to do next.36:07So, you can think of this as your logs in a reporting view. You can filter by just about any parameter that the umbrella dashboard has. This is a great place to come if you're investigating or researching a specific event or suspected trend. This is also where you will be taken when you click.36:14On a graph on the overview page. So say that you saw a large spike in security blocks on your overview page. Well, we can go in and see where these blocks are coming from and why they are being blocked. So we'll just click up here and set to blocked just so that we can show you that.36:34So in specific you can see the identities, the policy or rule set that it was attached to, that, that caused it to be attached to a policy, the destination in particular depending on what you're looking at, you can even see internal IP addresses.36:53And the specific action as well as what category may have been blocked. Now, something quick and important to check, as I mentioned earlier, sometimes you see a.37:12Allowed, malware domains. It's not super common. It does happen. Specifically we see it when there are different DNS type or you know records being used. So if you see a text record or TXT record, but it's categorized as a malware domain, it will still be allowed.37:27Cloud because we do not action or block those type of, records. It's not going to cause a problem with you in your, in your environment. It doesn't resolve through that record. So in the case of DNS, there's NO need to block that. And so.37:47So we do not block it as I would add extra overhead.38:07So here we can see where the blocks are coming from and why they are being blocked. All right. So one of our more recent features though at this point I would say it's been around for quite a while, is to be able to save your search.38:11Or restore the default layout. And from there, you know, you can.38:31Save your search up here in the saved searches section. So if you have a search that you are constantly going in for, maybe you want to check, you know, malware specific blocked identities. Here we are seeing that none of the ones that were listed before were malware.38:35They were largely content category blocks, that's fine.38:55But if you did have those, you could save this search and it would show up here in the saved searches section. Okay, so, you know, make sure that you take advantage of that because it saves a lot of time having to go through, not having to go through and click all the.38:59There's different settings every time you wanna come in and check them. If you look at our content categories, for instance, there, there are quite a few here and having to scroll through and select what you're looking for every time can be a bit of a pain.39:19We're gonna move on to our next core report, which is the app discovery report. We talked about this a little bit on the overview page. So we're just gonna quickly go through that. So this report allows you to monitor the cloud apps in use in your environment.39:30To effectively reduce the risk introduced by apps, a good approach is to look for a reduction over time in the number of requests made by apps with high and very high risk assessments. Here we just scroll down and we can see our apps by risk.39:45So there is a little bit of a lag in this report. We apply application categories after request is made, just for the purposes of the short, that's why you might notice a steep drop off here. So when performing your health check, start with the high risk apps or very high risk apps to narrow down what is deemed acceptable by your organization and what is not.40:03One key thing I want to note here is that labeling an app as not approved does not block the application from use within your organization for this specific dashboard area. It's simply a visual tag to help you keep track of your own review process. If you'd like to block an app from use, you need to do so in the application settings with.40:21In a policy.40:41And the final core report we wanna go over here is the top threats report. So this is an important report, and normally it's a little bit more populated than this. We'll see if opening it up to 30 days changes it. No, unfortunately this is a bit of a.40:43Odd behavior in our test environment here, but normally you'd be able to see the domains that you saw were seeing the most recent callouts to from a malware perspective. For instance, this can be incredibly useful if you have something making constant callouts in your environment to a specific domain that we have tagged as.41:02Malware you'll see hundreds of requests out to that if it's in that number or you know any any specific number that's happening.41:22With this I I suggest taking advantage of our scheduled reports feature up here, you can schedule just a regular blank report or you can schedule your, specifically set up reports if you went ahead and selected any specific.41:32You know, seven days, 30 days, allowed blocked content category stuff, whether it be in any of the last four core reports we've gone over, you can set that up for specific delivery times, you can make it weekly or monthly. It's, it's important to take advantage of these scheduled reports so you don't have to think about.41:51So if you do come in here, you can select that, you can name your report and set the emails and then hit save here to make sure it so that the people who are within this email list will get that report sent to them. Oh wait.42:12So, we're gonna move on to our final section of the umbrella dashboard for this walkthrough, and you'll notice that there we we've left a bunch of the additional reports. Unfortunately, we, we don't have time in this this webinar to go through each of these, but.42:32Take advantage of our documentation to give yourself a quick overview of this. They're pretty self explanatory based on their titles, total requests, top destinations, top identities, top categories, that kind of thing. We're gonna go into our admin section.42:49So once you're done with reviewing your policies and reporting and have made all of the necessary adjustments, you should look at the administration section of your dashboard starting with accounts. We suggest doing this because, you know, at companies, people come in, new users, old users leave, so you want.43:06Want to be checking to make sure that, you know.43:26These people are the people you expect to see within the dashboard environment. So just make sure that you're keeping up to date on that as necessary. Under log management, you can check that your storage location is where it needs to be. It's an easy way to make sure you aren't violating any local or state.43:28Laws like having a European data center comply set to comply with GDPR regulations. You also have the option to set up your own S3 bucket and integrate it with umbrella.43:48You can find those instructions in our documentation. Another quick and useful one to go through here is our licensing tab. So, here you can kind of see what your queries are like for your environment, as well as what package you have.43:59And it's, you know, start date and end date. Okay, that is everything so far for our walkthrough. We're gonna go back to our slide deck for a short period of time here and just walk our way through the last few slides we have.44:19My apologies, just give me 1 s while I switch things back over here, ok, so what happens when you, if you run into problems?44:401st, you want to define the problem, and you can ask yourself, who, what, when, and where. E.g., maybe you're seeing some blocks that you don't expect, you want to know who is being blocked, what are they being blocked from?44:58When do these blocks occur and where are they occurring? You want to find any and all commonalities to help isolate the issue. And before you ring the alarm or open up a support ticket, take some time 1st and take advantage of all the resources that are available to you.45:13So, let's say you did your homework and you weren't able to solve whatever issue you maybe facing and you're ready to submit a ticket. You have a few options here. We are unfortunately decommissioning our email channels for.45:31Opening up service requests for TAC cases. So we do suggest that you take advantage of our submission processes, including the support case manager or clicking the support platform in the umbrella dashboard. We made these changes to enhance faster triage, make sure those.45:49Make sure that, you know, customers feel more confident using these resources and that we have, you know, a secure and consistent way of accessing our support management pages.46:09You do need to make sure that you have a Cisco customer identity or cco ID to access the support case manager. If you're having any issues with this, I do suggest reaching out to your contacts at Cisco, whether that be your account manager or an SE you have worked with.46:21Okay, so when you're submitting a ticket, please do yourself and us a favor and include the following information. The more information and details you can provide, the quicker our engineers can help resolve your issues. So when you get the, when you open a ticket.46:42Get the ball rolling here. If you are vague in opening a ticket, you will get asked questions that might seem rather simple in nature because we are trying to figure out, you know, what's going on. So try to give us a summary of the issue, scope and impact around, you know, types of devices, how many out of your fleet, when.46:58This occurred, you know, if you've made any changes like to your firewall rules or anything like that try to let us know about those things as well. Obviously we can't you won't be able to catch everything. This is at your best effort kind of thing.47:18Let us know what kind of troubleshooting you've performed, if any steps, as well as if you found a workaround, please let us know that you have put a work around in place. Is that, you know, is something that it's useful to know ahead of time. If you get a chance, please also run some form of our diagnostic tool based on what product.47:32That you're using in your environment. In this case, you know, the diagnostic tool for DART for secure client would be great to run ahead of time and provide to TAC based on there.47:52The situation. So we have an extensive library of knowledge based articles and documentation, where you can go through our technical users guides. If you're just getting started with us, you can go to the deployment hub and see a five to 10 min videos to get you acquainted with the dashboard and all its features ok entry.48:03Capabilities or if you have a new user, this page here is helpful to make sure that you can, you know, get them started on going through umbrella.48:23So what's new? Before we jump into our newest features in umbrella, I just wanted to share with you that, you know, we have this, sorry, we have this umbrella certificate transition update that we need you to be aware of.48:35The transition from DigiCert to identtrust, certificates has been postponed until October second 2026. There is a small action required here, you know, please complete the following verifications before the new deadline. Verify your root certificate ensure that the identrust root certificate is installed in.48:51Your device trust store.49:11You know, most things do keep up to date on this, but we do recommend manual verification for networks and virtual appliances just to make sure that NO issues happen here. You can use the con confirmed connectivity links below to verify that your devices can connect to the following identity.49:14Endpoints.49:34So please consider this as October approaches. So in the spirit of what's new or next, we wanted to carve out just a minute or two here to introduce, Cisco secure access. You know, we've been providing cloud security for over a decade.49:35And we're currently protecting a a large number of customers and mills hundreds of millions of endpoints or more.49:55We've converged our proven cloud native security capabilities from Umbrella and our other Cisco security offerings into one cloud service known as Cisco Secure Access. All the capabilities of these, of many of these of the products listed are.50:03Integrated into a single dashboard which can intelligently direct and, you know, protect traffic through a single client and is controlled through our unified policy management on the secure access dashboard. So here we just kind of have a visual of, you know.50:20Instead of setting everything up individually and different tunnels or connections to different things from, for different types of devices, with secure access we have set things up so that as things go through, everything gets connected from all the different end users out to wherever they need to go whether or not.50:38Be the internet.50:57SaaS or AI applications, traditional private applications or modern private applications. So as I just mentioned, we do have a new family member to the security service edge product lineup, and that is secure access. So we started with our Cisco secure access DNS layer security, providing our customers a very.50:59Cost effective, quick and easy way to add a basic layer of security to their environment in a very short period of time. We introduced the market secure.51:19Cisco Secure internet Gateway that provides our customers with the security service edge internet access layer protection. And now we've launched Cisco Secure Access for our customers who are looking to go beyond just internet access layer protection, but are considering upgrading or consolidating their private access security layer protection as well.51:28With secure access we now have a complete security service edge solution with both internet access and private access security protection and capabilities. Everything that is in our Cisco secure access offer plus the addition of ZTNA VPNS service, you know, thousand eyes, experience enterprise insights, user monitoring, and so.51:48Some of our AI assistance products are integrated here.52:08My apologies, my slide appears to have frozen. There we go. So, you know, we just want to make sure that you're aware that there are a few different ways to access our secure access portfolio. Obviously you guys are DNS defense or DNS customers, so it would be quite the lift.52:15To, you know, move into something that adds the features of SIG and more. So as an entry point to secure access, we do have a DNS defense specific.52:34Option to migrate from, and that that is a great starting point for our umbrella DNS users. You can migrate your dashboard in most cases over to the secure access DNS defense dashboard with a wizard that we provide as well as, you know, instructions and videos on how to do so. Or if you.52:47You're looking to make the plunge, you can move straight into secure internet access and either one of these can have secure private access added to them, which is.53:06More focused on application security and ZTNA. Yeah Brett and real quick, just wanted to let everybody know I added a Slido also that has a couple questions around secure access too, so.53:15If you would like to answer any of those, we can definitely provide some additional information for you guys. Perfect. So just one quick note here on how we want things to work here with our users with.53:33Zero trust and secure access, we want things to be much simpler. Once everything is set up in the secure access dashboard, we want you to be able to take your end users, have them authenticate, and then from there, there's nothing they need to do to figure out where they're going Instead, our product.53:50Does the, as we like to say, the plumbing for them and assigns them to what they need based on what they're trying to access. So it's a much tidier application process in that way. That is all the time we have for today's.54:07Webinar. Thank you so much everyone for attending. Any last questions you have to or would like to bring up, we would happily answer those either before the webinar ends or afterwards we will answer them and send them out to you.54:27Yeah, thank you so much, Brett. It was a fantastic presentation. Thank you Harm Hillary and Rachel for managing the chat, the chat and the Q and A and a special thanks to all of you for joining today. So, today's DNS health check webinar, please submit any final questions that you guys may have for our technical specialists, we'll make sure we'll get you guys the slide deck. We'll make sure we're.54:45To get you guys the answers to any questions that we answered. And then there's also a short survey that at the end of the presentation, you know, please take a few minutes to answer and be on the lookout for our next webinar, which is gonna be an umbrella to secure access migration deep dive so may have some interest for some of you guys and look forward to seeing you guys on the next webinar.55:05