Cisco Umbrella DNS Denylisting
Description
Accepts a domain or list of domains and block them in Cisco Umbrella. Generates a list of observables with the blocked domains.
- Type: Response
- Product: Splunk SOAR
- Apps: Cisco Umbrella
- Last Updated: 2023-07-14
- Author: Patrick Bareiss, Splunk
- ID: 3705f371-f355-46d7-979a-3bc4c26e2208
- Use-cases:
- Phishing
- Endpoint
Associated Detections
How To Implement
This input playbook requires the Cisco Umbrella connector to be configured. It is designed to work in conjunction with the DNS Denylisting Dispatch playbook or other playbooks in the same style.
D3FEND
| ID | Technique | Definition | Category |
|---|---|---|---|
| D3-DNSDL | DNS Denylisting | Blocking DNS Network Traffic based on criteria such as IP address, domain name, or DNS query type. | Network Isolation |
Explore Playbook
Required field
Reference
source | version: 1