Skip to main content
Connect Cisco Umbrella so Myrmex can read your DNS-layer security data in real time — activity, top domains, and blocked or flagged requests — for investigation and analysis. Myrmex connects over the Umbrella API (api.umbrella.com) using an API key and secret (OAuth 2.0 client credentials).

​
What Myrmex Can Do

DNS security visibility

Read DNS-layer activity, security events, and blocked requests, on demand.

Investigate domains

Pull top domains and identities into investigations in the Workspace.

Analyze activity

Query DNS activity in real time to support your analyses.

Correlate

Cross-reference DNS events with data from your other integrations.

​
Before You Start

  • A Cisco Umbrella account with dashboard access.
  • Permission to create API Keys in the Umbrella dashboard (Admin → API Keys).
  • The scopes appropriate for what Myrmex should read (read scopes such as Reports are enough for analysis).

​
Step 1 — Create the API Key in Cisco Umbrella

1

Open API Keys

In the Umbrella dashboard, go to Admin → API Keys.
2

Create a key

Click Add to create a new key, name it, and select the scopes Myrmex needs (read scopes are enough for analysis).
3

Copy the key and secret

Copy the API Key and Key Secret. The secret is shown only once — store it securely. You’ll enter both in Myrmex.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Cisco Umbrella, then fill in:

​
Connect

Click Connect. Myrmex requests an access token from the Umbrella token endpoint (/auth/v2/token) using your key and secret, validates the connection, and finishes. Umbrella then appears under Environment → Integrations.
Myrmex handles the OAuth 2.0 client-credentials exchange for you — you only supply the API Key and Key Secret. Data is read in real time when you ask; nothing from Umbrella is stored on the Myrmex side.