Integration

Cisco Umbrella integration

Cisco Umbrella cloud security API: manage the destination lists that allow or block domains, URLs and addresses, read the DNS and web policies those lists feed, inventory roaming computers, networks, sites and network devices, and query the reporting service for DNS and proxy activity, traffic summaries and the busiest identities. Access uses an Umbrella API key and secret exchanged for a bearer token that lasts one hour.

Connect Cisco Umbrella How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Cisco Umbrella.Built from the 17 Cisco Umbrella tools below, on the connection you add once.

Common Cisco Umbrella use cases

checking whether a specific laptop is still protected
checking which sites have virtual appliances deployed
blocking every domain extracted from a phishing campaign
auditing which office networks are registered and verified
unblocking a domain that turned out to be a false positive
reporting how many requests were blocked over the last week
cleaning up a temporary block list once an incident is closed
renaming a list so it reflects the incident it was created for
checking how many entries a block list holds before adding more
finding roaming laptops that have stopped syncing with Umbrella

What you can do with Cisco Umbrella

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Destination list, 5 operations

create_destination_listCreate destination listPOSTCreates an Umbrella destination list that policies can then allow or block.
delete_destination_listDelete destination listDELETERemoves an Umbrella destination list and everything in it.
get_destination_listGet destination listGETReturns a single Umbrella destination list with its counts.
list_destination_listsList destination listsGETReturns the Umbrella destination lists that allow or block domains, URLs and addresses.
update_destination_listUpdate destination listPATCHChanges the name of an Umbrella destination list.

Destination, 3 operations

add_destinationsAdd destinationsPOSTAdds domains, URLs or addresses to an Umbrella destination list so policies start enforcing them.
list_destinationsList destinationsGETReturns the domains, URLs and addresses held in an Umbrella destination list.
remove_destinationsRemove destinationsDELETERemoves specific domains, URLs or addresses from an Umbrella destination list.

Activity, 2 operations

get_activity_summaryGet activity summaryGETReturns Umbrella traffic totals for a window, such as how many requests were allowed and blocked.
list_activityList activityGETReturns the Umbrella activity log for a time window, filtered by domain, identity, category or verdict.

Roaming computer, 2 operations

get_roaming_computerGet roaming computerGETReturns a single Umbrella roaming computer by its hexadecimal device identifier.
list_roaming_computersList roaming computersGETReturns the Umbrella roaming computers with their protection and last sync state.

Identity, 1 operation

list_top_identitiesList top identitiesGETReturns the Umbrella identities ranked by request volume for a time window.

Network, 1 operation

list_networksList networksGETReturns the networks registered with Umbrella, with their address, prefix and verification state.

Policy, 1 operation

list_policiesList policiesGETReturns the Umbrella policies of one kind, either DNS or web, in priority order.

Site, 1 operation

list_sitesList sitesGETReturns the Umbrella sites, the containers that group networks and virtual appliances.

User, 1 operation

list_admin_usersList admin usersGETReturns the Umbrella console administrators with their role and last login.

Use Cisco Umbrella from Claude Code, Cursor or Codex

Connect Cisco Umbrella in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Cisco Umbrella operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Cisco Umbrella

Create your workspace
Sign up free. Nothing to install.
Connect Cisco Umbrella once
Add your Cisco Umbrella connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Cisco Umbrella integration FAQ

What can you do with the Cisco Umbrella integration?

LiveContext exposes 17 operations on Cisco Umbrella, covering destination list, destination, activity and roaming computer. Common uses include checking whether a specific laptop is still protected, checking which sites have virtual appliances deployed and blocking every domain extracted from a phishing campaign.