Cisco Umbrella SIG Health Check Webinar

Alright, let's go ahead and get this kicked off and get started. Welcome to today's webinar on Umbrella Secure Internet gateway.00:11Specifically around a health check. A few health keeps keeping items, 1st we would, we will be using Slido for Q and A and I will also be adding some additional polling questions throughout the webinar. If you have any questions during the webinar, please be sure to submit them into the Q and A box of Slido. To access the Q and A box, click on the three dots located on the lower right.00:19Hand corner of your Webex console and select Slido Q and A we have a ton of teams panelists that will be helping to support you for any of your questions that you may have, so please drop those in that slido Q and A section. Today's webinar will be recorded and the link will be available after the session. And after today today's event, we'll.00:38Also have a a small short survey. Please take a few minutes to answer so we can continue to adjust the content with your feedback. Let me go ahead and turn it over to Cindy.00:58Thank you Chris. 1st of all, thank you all for joining today and we're gonna go ahead and get started. Our focus in today's webinar will be umbrella SIG advanced features. We're gonna spend some time in the umbrella dashboard as well. We're gonna do a walkthrough of those advanced settings.01:10My name is Cindy. I'm part of the adoption customer success Specialist team. We're happy to have you here today for this webinar. Here's the agenda for today. We'll do introductions 1st. We're gonna share tips for peak performance, secure internet gateway overview.01:27We'll explain deployment options you have with SIG and the policy flow. We will jump into the dashboard, go through policy configuration settings. We'll share a few troubleshooting steps that can help drive you to quick resolutions if you run into issues.01:47And we will also share options to get support. Lastly, we will go through the latest cloud security innovations. Amazing. Thank you, Cindy. And looks like we our 1st Slido poll right here.02:04When was the last time you performed a health check or a policy review on your umbrella dashboard? Definitely a wide range of answers from three months to a year to never as well. So definitely looking forward to sharing some insight here.02:20Alright, before we jump in, I want to address the why do a health check. So you've already deployed umbrella, you've made your configurations and customizations, everything is running smoothly. So why would you need or want to go back into the dashboard to see how things are going?02:36You can ask yourself, have I fully completed my deployment? We're constantly coming out with features and updated versions, so it is important to regularly log into the dashboard, check your environment, make sure you have an up to date and healthy deployment.02:51The next reason to do a health check is ensure you are taking advantage and maximizing all the features and entitlements of your subscription. To make sure you're getting everything Umbrella has to offer, it is important to continually review and confirm that your deployment is meeting or exceeding your organization's change.03:08Acceptable use policies. E.g., maybe if you have users that started hybrid work, and that's something maybe you haven't looked at roaming clients for off network protection perhaps it might be a time to begin considering it.03:28It is for these reasons that we encourage you to familiarize familiarize yourself with the health check process and that way you can ensure your umbrella deployment is serving your organization's needs to the highest degree possible.03:43To get started, here is a SIG overview graphic. So on the left side, you see the redirection methods you have available with secure internet gateway. So you see tunnel, secure client with the SWG module, pack file, proxy chaining.04:01Starting with tunnel, you can create an IPsec IPv two tunnel from your device to the umbrella cloud. And if you use this method, you can see here in the middle section, you're gonna be able to use the cloud delivered firewall policy. That's the only deployment method that allows you to use the firewall rules and in the.04:18These firewall rules, you can do layer three, four, and seven inspection. Also, there's the option to do adding or enabling IPS settings to that configuration. And after the cloud delivered firewall rule is checked, we have to.04:37Possible paths. If you are sending non web traffic to the cloud, we not it to one of these ranges you see here on the right. So we're sending that traffic to destination. If it's web traffic on ports 80 and 443 and the traffic is allowed by the cloud delivered firewall, we send it to the SWG engine.04:54We check any policies you have there, we enforce any HTTPS policy you may have in the configuration, e.g., if the traffic is allowed, then we have two possible options. We can send the traffic to the RBI or remote browser isolation.05:14We will talk more about this later today. You can also send the traffic to the data loss prevention engine. We are actually going to go through the settings that we have in the data loss prevention policy. So here we block any possible traffic that maybe violating your DLP policies. And after that, if.05:31If the traffic is allowed in the OP, we not it and send it out the internet. Also with DLP look here on the right side, we do have, so we do have the inline DLP and the out of band DLP and with the out of band, what we do is we connect to your cloud tenants via API calls, which is also something we plan to cover later today.05:51And then for the other three redirection methods you have here on the left, you can see all three methods use H HTTPS redirection, so we redirect HTTP and HTTPS traffic to the cloud. For those deployments, we.06:11Just apply the SWG, policy or the web policy. We wouldn't do the cloud delivery follow for this, and then we can send the traffic to RBI or DLP. Those are optional if you have the feature, you can use it or if you don't have it, then we move traffic from the SWG policy.06:27See to the NAT and out the internet.06:47Here is an explanation of the umbrella policy flow. 1st, we check the DNS policies. If the traffic is allowed, we go to the next policy. If traffic is blocked, we drop the traffic in there. The next policy, this is just for traffic to source from IPsec tunnels.06:55We will go through the Cloud delivery firewall. We do the IPS inspection, any traffic that's on port 80 and 443 that's not blocked goes to the next layer, which will be the web policy. Any traffic that's not blocked here, we send it to DLP or RBI, and finally we render the destination.07:12Question if the traffic in DLP is allowed or we render the destination in a cloud to the browser if it's RBI.07:32So now let's move into the dashboard. We will do a walkthrough of the settings for the policies we mentioned. We'll start with the configuration setting for cloud delivered firewall policy with the IPS settings. We will move to the web policy. Within the web policy, we'll check the RBI configuration.07:43That remote browser isolation I mentioned, and then we'll move to the data loss prevention policy, also the reporting. Let's start with the firewall policy.08:00So on the left pane policies firewall policy. With this we can do layer three, four and seven on standard and non standard ports. To demo those settings, we can go to this here and we're gonna edit this 1st firewall rule. So you can see here this rule is enabled. This.08:17This is a app blocking rule. The priority is number one.08:37A description is optional and for the rule you can define if you want to allow the traffic or block the traffic. So in this case this is set to block the rule criteria, this is set at any protocol that it can be TCP.08:42UDP ICMP, the sources here, this is where we were mentioning previously, you do need to have the tunnels to be able to use the firewall policy, so we do have tunnels configured in this case it could be any or we specified.08:58This tunnel that we have. And then the IP addresses for the sources, it could be any, you could also specify an IP and it's very quick to add e.g. ports also similar any or you specify the port.09:15Destination IP and ports is the same. It could either be any or you specify. Then the applications, here you can see you can block specific applications from the list we have. So here there's a few P2P that have been selected.09:36Then there's the rule schedule optionally. You can set this to not expire if you check the box or set a start, and end. And then they hit counter, you can set this from the last 5 min to the last 30 days, e.g., depending.09:56On what you need to see. Lastly, also the logs for the policy, most likely you will wanna have that enabled, so that way you can see that in the activity search report. And then here once you have this configured, you can save the changes.10:14I'm gonna go back to the main page where you can see all the rules I have, so e.g. we can see the name, the status that is enabled, the action, protocol and source criteria, as well as destination criteria. So a summary of what we have along with our hit count.10:31And then you can also see here in the more actions, this is where you could quickly disable, disable the login or change the action as well. And we did mention the intrusion prevention system. So in your dashboard, you'll see that option on the upper right corner.10:50So I will go to that page and I can see it is currently enabled and there are two modes here that I can select. So if I go with the detection option, essentially you are monitoring your traffic for IPS signatures.11:08And if we do the protection like it is enabled here, then we're blocking the traffic we find in match with the signatures we have in the signature list. Which signature list? These ones here, we have four currently here by default?11:23So we can see here starting with connectivity over security, you can see it is blocking a few logging a few and ignoring most. If you go back down to balanced security and connectivity, you can see there's blocking more, logging more and ignoring view and same logic for the ones that continue.11:39Down the list. Also something worth mentioning is you can create your own signature list based on these templates that we saw. So for this, you could actually go to the policy components, IPS signature list.12:00And you can see the ones we have, the one that's active that we selected, and then to add a custom IPS signature list, you can go the upper right corner, add, give it a meaningful name for you, and you can select the template out of the ones we have here selected. So e.g., maybe if.12:17You wanted to change the signature from block to.12:37Maybe log only, you could do that, you can move it. And then once you save this, what will happen is that this custom IPS signature list, if you are back in your IPS settings, it will actually be one of the options from the signature list that you'll be able to select.12:42So we've covered the firewall policy, the IPS settings. The next thing we want to do is check the web policy, and for this we'll go back here to the pane on the left down to web policy.13:02So here, I want to start with the global settings. This is here on the upper right. This is important to cover. So this here you have a few, here we'll start with the 1st one certificate error handling. What this setting does is you're able to ignore a specific certificate error.13:21When the traffic travels through the proxy. So if you enable it here, you can see I have the option to add a domain. So let's say an example user wants to go to domain.com, that traffic travels through the proxy or decrypting the traffic, and then we see we block the access with the certificate error.13:39But you want to bypass that certificate error. Maybe it could be because it's an expired cert cert, a mismatched host name or maybe an unrecognized certificate authority, so you could instruct it to ignore. There's an ignore option, which means we allow the traffic if we see an error message.13:57Like expired cert. So this is what this setting will do. Microsoft 365 compatibility. Microsoft does recommend you bypass specific destinations or you do not decrypt or inspect the traffic.14:17Microsoft does have a list of domains you would want to ignore if you're using a proxy, and if this setting is enabled, you don't have to add a list manually in the umbrella exceptions list. This is something we normally suggest you enable, so you maximize micro Microsoft 365 performance.14:34Then we have protected file bypass, and this is disabled by default. Umbrella blocks access to protected files because they may contain undetectable threats. So if you enable the setting, it allows access to protected files.14:53It is worth noting, we can do exceptions for a specific destination if you trust that specific destination. So Umbrella would allow to download files from, from that destination, but this is a global setting here and we can look later into the web policy how to do that specifically for a destination.15:08Pack files, this is one of the four deployment options we have to send your web traffic to the secure web gateway. It's just a matter of copying this URL destination into the user's browser and once you have completed the changes here in the global settings, you make sure you click save, and then that.15:29That way this applies to the web policies you have here.15:48Looking at the web policy, let's look at this one here. So within a web policy, we have two sections. We have the rules and rules and then the rule set settings. We might have to look at this one.15:53Okay perfect. So we have the rules and rules and the rule set settings. Alright, so for the rule sets settings, let's let's start with that. We can see this as the name we set for it. We can obviously change that at any time. Then we have the rule set identities.16:12Here we have AD groups, users, and a few tunnels selected. So these are the users that are gonna match that policy. Then we have the block and warm pages, so you can create your own block page or use the default one from umbrella.16:31Tenant controls. So you can see here, this provides control over user access to approved corporate applications while blocking access to other instances of those same applications. To edit this list, you do have to go to your policy components.16:53Tenant controls over here on the left. This is where you'd be able to edit this actually. So you can see here the domain was added. So that's how what you do. You add your company tenant in the domain, and when the user tries to access a different tenant, it could be a personal tenant.17:12For another company's tenant, we block that traffic because we're just allowing this specified tenant.17:32We're gonna go back to the web policy and we were looking at the rules of settings, we covered attending control.17:40Controls and it reloaded. So I'm gonna go back to that So we covered tenant controls and next we have file analysis.18:00So we inspect files looking for malicious behavior, so we send it to a sandbox where we run threat intelligence settings and we find if the file is malicious or not. This one is actually disabled by default. We normally suggest enabling it and enabling this is a quick win so you're maximizing your security.18:19Assessment.18:39We also have file type control. This is for our downloads, so think users downloading these types of files, so here we have executables and you can block the type of file that's that you see here too from the list. So in this case, this is getting blocked executables.18:42We have HTTPS inspection. Normally, this is something you want to enable because with the web policy, we want to inspect this traffic, so you enable the inspection here, then we can decrypt the web traffic in the umbrella cloud.19:04Also, once you enable the inspection, you can accept some traffic from being inspected. That traffic goes through Umbrella Cloud, but we don't decrypt the traffic. There are some cases where you'll need to do those exceptions and that you can do it here as you can see by categories, applications or domains.19:19The, the lists here, you can edit those also under policy components, you will see here selective decryption lists. And a key part of maintaining a healthy deployment is also ensuring your exceptions are up to date.19:38And then you have the rule set logging, so here we normally want to log everything, but if that's not the case and you just want to log security events, there is the option. That means we're not gonna log all requests, just those related to security. So think about malware, phishing, e.g..19:55Then we have safe search. So if we enable this, oh, what is safe search? That's a search engine filter, it blocks search results for explicit contents like chronography, offensive adult content. So if you enable that, someone enters a potentially inappropriate or a suggestive phrase in the.20:15Search engine, then what the search engine will return is a family friendly result.20:35We have SAML. You can do SAML authentication for users that are sending web traffic. When the user tries to access the website, also before the user's able to access the website, they get the SAML challenge that they need to log in. Once they pass the authentication process, they have access to the destination.20:43That authentication interval is selectable, that could be done daily, weekly, monthly. We have also security settings, as we mentioned, the malware, command and control callbacks, phishing attack, potentially harmful domains.21:03So these are the rule set settings that apply to that traffic that gets this policy applied. Now, I also mentioned we have the rule set rules. So these are where we can get very granular with your configuration, and this is where we can define in the traffic that's going to be allowed or blocked. E.g., the traffic is.21:22Match from top to bottom and match again three specific things. You can see identities, destinations. There are some optional rule configuration as well.21:42And since we match the traffic from top to bottom here, the suggestion is you create your block or catch all policies at the bottom and from there you build your exceptions from the top, and now crucial health check tab is also making sure you're auditing your rule orders, you're getting the expected outcomes. Let's actually.21:54Review this block rule here. We can see it's called an application block. So from the list of actions, we selected block, it is applying to roaming computers and we can see there's, it is applied to one application settings list.22:14Here we looking at the rule configurations we mentioned, we can see this does have the option to set a schedule. So maybe if we only wanted this applications to be blocked, let's say from 08:00 A.M. to 05:00 p.m..22:34Then that way 05:00 P.M. is just not enabled and then it's active again the next work day ATM e.g.. But this isn't enabled for this one. There's also the option to do the protected file bypass. This is the option I was mentioning before. So if we enable this or here, it means.22:50It's the destinations we configured here, the user's gonna be able to download protected files from those destinations.23:10And then the other last optional rule configuration, we have the block and warm pages, so you can see it could be the default appearance or it could be a custom page as well.23:19Here we also see there are some sites to warn. So here, e.g., we can see the action is warned and this is applied to a list of categories. Really, we'll cancel here really quick so we can look at this one. This is applying again to roaming computers.23:36There's a category list applied to this one so that way it is getting applied to some of the categories over here. And then for the rule set rules finally, I also wanted to cover the isolate option.23:56So I will open this one here. So you can see this is isolate destinations. That's the action that was selected here or this is an option here that you have to inherit rule set identities. Nothing was selected from here because what we're doing is the rule set identities from the rule setting.24:16That's what it inherited, and you can see there's a destination list of.24:35Destinations that we want to isolate. And this is the remote browser isolation. What this does, it protects your users by rendering the destination in a cloud based host. So instead of blocking it, the end user's device will render when they want to go to that destination and.24:40We put the rule action in isolate, we render the website in the cloud.25:00The end user's device will not be compromised. And this is something normally it's for specific destinations or specific scenarios you likely don't want to isolate everything. And with that we finish the web policy review. The next we're gonna move into the data.25:05The loss prevention policy, so this one would be right under the web policy.25:25Data loss prevention policy, and with DLP we have two options. We do have the real time rule and the SAS API rule. Now real time is for traffic that travels through the proxy, so think of it, any user, any device to the cloud that's using any of the forward direction.25:30Methods we mentioned, it could be tunnel secure client with the SWG module, pack files, proxy chaining. So the traffic comes from those options and we can match this real time rule.25:50SAS API. This is when you connect Umbrella to cloud tenant. You authorize Umbrella to connect, e.g., to Dropbox and Umbrella communicates to Dropbox via API calls. We monitor your traffic via those API calls and if we find a violation, then we can take action.26:03On those specific files.26:22Before creating a policy here, you do want to make sure you configure data classifications. So this will be here on the pane on the left policy components, data classifications. And this is gonna be where we will define the type of file or the type of data we're gonna monitor with the DLP policy.26:26Policies. We do have some built in pre configured data classifications for you as you can see in the names. And then e.g. if you want to look at this one for privacy, you can see it shows us what are the included data identifiers.26:46We could actually click on any of those let's do credit card, and it gives us a description. So this one essentially it's saying it's gonna verify potential credit cards that match 15 to 16 digits, and it goes through an explanation of what it's gonna be doing for you.27:02You can, you, you could use that as it is or, this could actually be copied and customized. So you can see this identifier, you would essentially give it a name and a description is optional. And here you could.27:22If you need it, you can modify the threshold, which is the number of instances you want to match before triggering the rule. Also, proximity, it could be also keywords to match with this. And then here also we could copy this.27:39Data classification too. There's the option to copy it. If I decided to do that I can see what are all the included data identifiers and it actually allows me to customize this. So if I don't want to include this one, I could uncheck those.28:00Something also worth mentioning for the include data identifiers here if I select or that means at least one of the data identifiers included must match during rule evaluation and will be.28:16All data identifiers must match during rule evaluation and I'll cancel this here. You can also even add a custom identifier too if you wanted and we already mentioned well the threshold and proximity.28:32This also allows you to enter a, a term so this you could use it, think of it for maybe words you're looking in maybe a files that those terms are not listed in the pre configured classifications, so you could add your own words here.28:48And in the thing here for the entry type, it could be a term, a word or a phrase, and then the pattern that would have to be reg regular expression. In the data classifications besides the here, we also have exact data matches.29:06That's more focused on fingerprinting structured data that's organized in a table format, that is designed to handle data with a specific structure, it could be like a databases or spreadsheets. That's something that can be used to fingerprint like a corporate credit card table that way.29:25Only those corporate credit cards are monitored and protected. And then we also have indexed document matches, so really quick, that's for indexing and fingerprinting documents that have unstructured data that don't follow a specific format, so that could process some fingerprint documents that are not organized.29:44In a table like structure, it could be a text file, a PDF, a Word document, that could be used for fingerprinting and safeguarding intellectual property. It could be.30:04E.g., code repositories and with the data classification ready, we could actually move to the data loss prevention policy. Let's start with the real time 1st. I'm gonna edit this rule I have here. So you can see the rule name and the.30:15Description which is optional.30:36Then we have severity, and that's really for your own view and for the logs, it won't matter what you select, the policy works the same. Here we have the data classifications, so this is what we were configuring a few moments ago, right? Here there are a couple data classifications of.30:37And also worth mentioning here, you can actually preview.30:59What's in here for this data classification? Also, you can see it's asking you where to search for the selected data classifications. So content, it would really be just a content, so just it won't look at a file name. File name will.31:04Maybe just that, right?31:24And then we have a final 3rd option which is both content and file name. Here in files control, we do have file labels, so if you use file labels in your files, we can monitor that. Maybe if someone uploads a file with a it could be a column.31:26Confidential label, e.g., you add that here, you can take action.31:46Then we have the file size, so this is basically whether including or excluding files based on their size file type, this enables us to scan specific file types from the list of files.31:51File types we have.32:10Unclassified files, that's something that can be enabled when file labels is disabled, so we can enable this and we scan and log files with NO labels essentially. Then the identities.32:15Here we do see AD groups are selected for this policy. Then also we can select identities form exclusion. So here a specific AD user was excluded here. For the destinations, couple of options here we have all destinations.32:31Which can be here file uploads and form data or file uploads and form data of that applications. Only the other option we would have for the destinations would be either selecting a destination list you have or created or or some of the application categories like here you can see e.g..32:51Or open AI chat GPT was selected and also pay spin.33:11There is also the optionally you can select destination list and applications for exclusion. The action here is this is set to monitor. We also have a block, so monitor we just lock the.33:18Traffic in the reporting section.33:36So if you're starting with the DLP policy, you can begin and monitor, and I mean if you haven't deployed DLP yet, it's a great health check exercise, you could set up a rule in monitor mode. It allows you to audit your traffic for sensitive data without impacting your users. And then maybe you can adjust your policy if, if something's not.33:38Alright, you can make changes and once you're comfortable and it's working the way you expect, that's when you can.33:58Do the block action. So then that blocks content uploads and posts through the destination and identity traffic. Lastly, here we have the user notification. So this is enabled, so that means we send email notification to the user that's violating the policy.34:06So maybe they upload traffic that's being monitored for DLP, traffic is blocked. We select this, they get an email notification, and we do have a default email which provides details related to the violation like time and information.34:25And then also you could also do your own, email custom email. And then you make sure you save your changes, of course. Next, the SAS API rule here, I'm gonna edit this one and I can show you. So this one, something important.34:42And actually before we even begin configuring this is I do need to mention this. You want to make sure you go to.35:02Admin, authentication, and if you scroll down to the SAS API platforms, here's the list of the ones we have. So I enabled a dropbox. You can see it is authorized. It's actually very quickly.35:11I'm able to revoke this if I need it at any time. Also I did need to do this as an admin user from Dropbox. So this is always good to know. Also, go to going back to the data loss prevention policy.35:29So looking at the SAS API, going to edit this rule, and it's it's the top part is very similar to the real time rule. You can see the name and the severity, the data classifications as long as, as well as what.35:48What are we looking at here? But then we get to platform and this is where I have the one here that which is Dropbox that I had already enabled. Then we go back to file control, which is also similar. Then we get to include and exclude.36:07Section over here, this is the users whose files are included or excluded from scanning for this rule, so we can see this email here included and also it.36:26Non excluded, but it's an option we could configure. Then the exposure, and that's something that's also different from the real time rule. This is one of the conditions we can use to match the traffic or match the rules for the criteria we're looking for under the data classifications so.36:41Maybe for looking for some type of file that has certain type of data and if that file was shared with some specific users like this one here, we take action on that file. And then you also have a few other different actions that we could choose.37:00Then we get to the action. This is also a little different. We have monitor, but we also have quarantine, isolating the file to quarantine folder, and then revoke access. If that is selected, there's a few different options.37:19For revoking access. We have user notification too, very similar, but here we select who's notified. So here we have the file owner, the event actor, and also we mentioned right it could be that default email or it could be a custom one as well.37:35So that covers the data loss prevention policy. Also I want to cover a bit of the reporting, so we're gonna go to the reporting on the pane on the left, and so reporting, you do have the core reports, the additional reports, management reports.37:56Today we're gonna focus more on the core reports so security activity. Here notice this is set to the last 24 h. This is a schedule a report sorry you can schedule, and we have filters, so this is filtering at what was blocked, and we can really see the.38:16Times that a domain, e.g., that's malicious has been allowed or blocked, e.g.. We can see different security categories here that have been blocked. And then we have the activity search.38:36So this is gonna be a breakdown of all your requests. Here you can see the different columns we have with the information. This is something you can customize, and also here we can see the types of, we can see everything or we can filter by DNS, web firewall, IPS, e.g..38:53Also, this is also we're looking at the 24 h, last 24 h. This one can also be scheduled and exported as a CSV. Look at the filters on the left side too. It allows us to select different filters here. So maybe if I want to see more of like.39:14This type of security categories and I select that filter. I haven't seen any in the last 24 h, but if I schedule this, it does apply that is one of the filters I see in my report, e.g.. And there are several different other filters as well from the response to.39:30The page, the behavior, IPS, protocol, event type, identity type, the security categories, content categories, so lot different filters we can select for to look at what we need.39:48We have app discovery and this one shows cloud apps, so the types of apps that are being used in your environment. We can see here, e.g., there are a few generative AI that are categories that are being flagged. It will also show us apps that have been discovered.40:06And keeping mind there are different labels here, so like I'll show you this one, this says not approved, but please make sure that in keeping mind, if you set an app here with a not approved label, it does not automatically block it. Here you would actually need.40:22To take this action from the policies or from here you can say block this app and you can do it from the DNS application settings or the web application settings if you have that enabled.40:42Something you could do here to filter this list. It could be done by risk, maybe very high and high, e.g.. You can also filter as well by the little web traffic. We can sort.40:56Through that and see the higher at the top and that way you can decide if that's something you want to take control of action of. Top threats, again looking at last 24 h, but I can change this.41:12And this is showing me here, in this case I'm looking at either any blocked or allowed threats the organization may have been exposed over a selected period of time which is the 24 h and we can see top active identities, and then if I wanted to look at.41:29Some top malicious domains, top identities, it does show me those details. Perfect. So with that, we end the demo. I'm gonna go back to the.41:48Presentation, over here. All right, so here is few different tips for umbrella support and resources that we wanted to share with you. So all new cases need to be submitted via support case manager or the support platform.42:07Link in the umbrella dashboard, you did need to make sure you have a Cisco customer identity or CCUID and access to the support case manager.42:27And here is some information, some best practices for opening a tax support case. So 1st you are gonna want to define the problem and you're gonna want to ask yourself who, what, when, and where. So, e.g., maybe if you're seeing some blocks you don't expect, you want to know who is being blocked, what are they being blocked.42:42Blocked from, when do these blocks occur, from where are they occurring? You want to find any and all commonalities to help isolate the issue?43:02Also, when you're submitting a ticket, we do recommend including this important information. That way the more information and details you can provide at the beginning, it is quicker for eliminating that back and forth if we start by providing this information. So you again want to include any information on.43:10Scope and impact, the timeline when it started, any changes that may have recently happened, all the troubleshooting steps you've done.43:30If you've done any work around temporarily and also any diagnostic data would be even better Dark bundled if you have it. And then also, going into support and documentation, we do have an extensive library of knowledge based articles and documentation.43:40That you can read through, or maybe if you even have a new person join your team, it's a great jumping off point if they're completely new to umbrella.44:00And what is new? So we do have an umbrella certificate transition update from DigiCert to Identrust. That was actually postponed to October second, 2026. So as far as action, there's two things you wanna do before the new deadline.44:12One is you want to ensure the identrust root certificate is installed in your device trust store, especially for network and virtual appliances, and then confirm that your devices can connect to the identrust endpoints as well.44:29What's next? So Cisco is evolving its security portfolio by transitioning from Cisco umbrella, SIG and DNS to our unified cloud native Cisco secure access platform. This shift supports our broader unified sassy strategy.44:48Designed to simplify operations and enhance protection for our customers. So our customers may continue to purchase new Cisco umbrella subscriptions through the end of sale, which is January 2027. Renew existing subscriptions through the end of renewal, which is a January 2028.45:06And also end of support is January 2029.45:26So before we wrap the health check session, I do want to give you an exclusive look at how Cisco umbrella's evolving. So as we mentioned, here Umbrella DNS will migrate to Cisco secure access DNS defense. Customers may elect to migrate to full secure access to begin deriving value from the.45:33Standard security protections of security service edge.45:53Umbrella SIG will migrate to Cisco secure access. So also something worth notice mentioning is we have an automated migration wizard, which translates your existing umbrella policies into secure access rules.45:57It provides you a dual view. You would, you can access both Umbrella and secure access from a single interface. And I would also like to share, we do have a webinar on 8 October, which will cover the Cisco umbrella SIG to Cisco Secure Access migration. This is gonna be a technical overview, a walkthrough of the.46:17To a migration workflow from Cisco Umbrella to Cisco Secure Access.46:37Now a little bit more in secure access, we did start with umbrella DNS layer security, which provided our customers a quick and easy way to add DNS layer security to their environment. Cisco later introduced to the market, the secure internet gateway, providing our customers with internet access layer security protection.46:46Now with secure access, we have complete SSE solution.47:05Which has both internet access and private access protection and capabilities. So everything that's in umbrella plus the addition of zero trust network access VPN as a service, Cisco assistance, and more. Cisco secure access is available as a full SSE solution. It is delivered in a.47:09Single subscription, it's a single policy set and a unified dashboard.47:29Secure access offers various packages to suit specific needs. There's DNS defense for DNS layer security, secure internet access or SIA to protect access to the internet and SaaS applications. That also includes DNS defense capabilities.47:38And secure private access or SPA to secure access to private applications. Thank you for attending the webinar. It was great to have you here today. There will be a survey you can complete regarding the session. We also have a web.47:54Community you can join and you can always check our announcements page.48:14Cindy, awesome job. Thank you so much. Really appreciate all the information and all the detail. And everybody on the call, I really appreciate all your guys questions and definitely thank you to our panelists today.48:20