Collect Cisco Umbrella Cloud Firewall logs

This document explains how to ingest Cisco Umbrella Cloud Firewall logs into Google Security Operations using Amazon S3.

Cisco Umbrella Cloud Firewall (CDFW) provides cloud-delivered firewall protection that inspects and controls network traffic based on IP addresses, ports, and protocols. CDFW enforces firewall policies for users connecting through IPsec tunnels or roaming clients, blocking malicious traffic and unauthorized applications, while providing detailed visibility into network activity with comprehensive logging of all firewall events, including packet counts, byte transfers, application identification, and posture information.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to Cisco Umbrellaconsole with Full Admin role
• Privileged access to AWS(S3, Identity and Access Management (IAM))

Configure Cisco Umbrella for S3 log export

Cisco Umbrella supports two S3 export options: Cisco-managed buckets and self-managed buckets. This guide covers the Cisco-managed option for simplified setup.

1. Sign in to the Cisco Umbrella Dashboardat https://dashboard.umbrella.com
2. Go to Admin > Log Management.
3. In the Amazon S3section, click Use a Cisco-managed Amazon S3 bucket.
4. In the Select a Regiondropdown, select the AWS region closest to your location (available options: US East (N. Virginia), US West (Oregon), EU (Frankfurt), AP (Sydney)).

5. In the Select a Retention Durationdropdown, select your preferred retention period ( 7 days, 14 days, or 30 days).

6. Click Save.

7. Click Continueto confirm the configuration.

8. Wait for Umbrella to provision the S3 bucket. When it is complete, the Amazon S3 Summarypage displays.

9. Copy and securely save the following credentials:

   • Access Key(displayed in the Accessfield)
   • Secret Key(displayed in the Secretfield)
   • S3 URI(displayed in the S3 URIfield, in the format s3://cisco-managed-<region>/<organization-id>/ )

10. Select the Got itcheckbox.

11. Click Continue.

    Umbrella begins uploading firewall logs to the S3 bucket every 10 minutes in gzipped CSV format.

S3 bucket folder structure

• Umbrella organizes Cloud Firewall logs in the S3 bucket using the following structure:

   s3://cisco-managed-<region>/<organization-id>/firewalllogs/YYYY-MM-DD/YYYY-MM-DD-HH-MM-<xxxx>.csv.gz 
  

  For example:

   s3://cisco-managed-us-west-2/1234567890/firewalllogs/2026-02-03/2026-02-03-14-30-0001.csv.gz 
  

Configure AWS S3 bucket and IAM for Google SecOps

Since Cisco manages the S3 bucket, you must create an IAM user with read-only access to retrieve logs for Google SecOps ingestion.

1. Create a Userby following this user guide: Creating an IAM user .
2. Select the created User.
3. Select the Security credentialstab.
4. Click Create Access Keyin the Access Keyssection.
5. Select Third-party serviceas Use case.
6. Click Next.
7. Optional: Add a description tag.
8. Click Create access key.
9. Click Download .csv fileto save the Access Keyand Secret Access Keyfor future reference.
10. Click Done.
11. Select Permissionstab.
12. Click Add permissionsin the Permissions policiessection.
13. Select Add permissions.
14. Select Attach policies directly.
15. Search for the AmazonS3ReadOnlyAccesspolicy.
16. Select the policy.
17. Click Next.

18. Click Add permissions.

Configure a feed in Google SecOps to ingest Cisco Umbrella Cloud Firewall logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. Enter a unique name for the Feed name.
5. Select Amazon S3 V2as the Source type.
6. Select UMBRELLA_FIREWALLas the Log type.
7. Click Nextand then click Submit.

8. Specify values for the following fields:

   • S3 URI: Enter the S3 URI from step 9 of Cisco Umbrella configuration (for example, s3://cisco-managed-us-west-2/1234567890/firewalllogs/ ).

   • Source deletion option: Select Do not delete transferred files.

   • Maximum File Age: Include files modified in the last number of days (default is 180 days).

   • Access Key ID: Enter the access key from step 9 of AWS IAM configuration.

   • Secret Access Key: Enter the secret key from step 9 of AWS IAM configuration.

   • Asset namespace: The asset namespace .

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Nextand then click Submit.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.