---
url: https://docs.realmsec.info/integration/umbrella.md
---

# Cisco Umbrella

Cisco Umbrella supports sending logs to a Cisco owned S3 bucket as well as to a Customer owned S3 bucket. Realm supports reading logs out of either bucket.

## Important considerations

* Umbrella requires that the organization [rotate the IAM keys](https://docs.umbrella.com/deployment-umbrella/docs/cisco-managed-s3-bucket#best-practices-rotating-s3-key) on the Cisco-managed S3 bucket every 90 days. This means customers will have to get the new keys and update them in the Realm console every time they change. If your organization is unable to rotate the IAM keys on their Cisco-managed S3 bucket, Umbrella recommends using a self-managed Amazon S3 bucket.

* Umbrella [best practice](https://docs.umbrella.com/deployment-umbrella/docs/cisco-managed-s3-bucket#best-practices-download-files-from-the-s3-bucket) recommends not downloading log files multiple times. Customers should pause and think before setting up multiple integrations to read from the same Umbrella S3 bucket simultaneously.

## Using Cisco Owned S3 Bucket

### Cisco Umbrella

Configure Umbrella to send logs to a Cisco Owned S3 bucket — [Umbrella docs](https://docs.umbrella.com/deployment-umbrella/docs/cisco-managed-s3-bucket).

### Realm Console

1. Create a new Source.
   > **Name:** `Cisco Umbrella`
   > **Format:** `Cisco Umbrella`
2. Add a new Input feed.
   > **Type:** `AWS S3 Poller`
   > **S3 Bucket Name:** Enter the Cisco owned S3 bucket name
   > **AWS Region:** Enter the AWS region
   > **AWS Access Key:** Enter the AWS Access Key
   > **AWS Secret Key:** Enter the AWS Secret Key

## Using Customer Owned S3 Bucket

### AWS Console

1. Create a SQS Queue for S3 event notifications.
2. Create a S3 bucket for Cisco Umbrella to send logs to.
3. Enable create item notifications for the S3 bucket to be delivered to the SQS queue.
4. Create an IAM role for Realm granting read permission to the S3 bucket and SQS queue.
5. Create an IAM user for Realm and assign the above policy to it.
6. Configure **Security Credentials > Access Keys** for the IAM user. These access keys will be needed when configuring the input feed in Realm console.

### Cisco Umbrella

Configure Umbrella to send logs to your own S3 bucket — [Umbrella docs](https://docs.umbrella.com/deployment-umbrella/docs/setting-up-an-amazon-s3-bucket).

### Realm Console

1. Create a new Source.
   > **Name:** `Cisco Umbrella`
   > **Format:** `Cisco Umbrella`
2. Add a new Input feed.
   > **Type:** `AWS S3`
   > **AWS Access Key:** Enter the AWS Access Key
   > **AWS Secret Key:** Enter the AWS Secret Key
   > **SQS Queue URL:** Enter the SQS Queue URL

## Event Metadata

The following additional metadata fields will be included with the events.

| Field Name | Value |
| ---------- | --------------- |
| \_sourceCategory | `cisco/umbrella`|