SecureX Orchestration Workflow - Umbrella Brand Watch
A workflow for automating the discovery of imposter domains to detect typosquatting, brandjacking or similar attacks.
The original idea and python version:
Features
- Automatic Regex brand generator based on https://github.com/brad-anton/brand_watch
- Ability to exclude domains
- Queries Cisco Umbrella Investigate API with adjustable settings
- Possibility to run scheduled every day
- Possibility to feed into your SOC / SIEM / TIP / ..
Based on the brand you are monitoring, you can adjust the frequency and maximum results returned.
Installation
- Browse to your SecureX orchestration instance. This wille be a different URL depending on the region your account is in:
- Click on IMPORT to import the workflow.
- Click on Browse and copy paste the content of the json file inside of the text window.
-
Click on IMPORT. You will get an error, however please click on UPDATE to get everything sorted.
-
Next we need to enter some variables in order for this workflow to run properly. You can either click on RUN in the top right and fill in all the variables, or you can alternatively also do that in the right global properties pane.
-
You will need at least your Umbrella Investigate API key, to do the lookups. Please follow these steps to obtain yours: https://docs.umbrella.com/investigate-api/docs/about-the-api-authentication
-
Optionally you can also add domains to exclude from your results (i.e. domains that you know are safe and not imposters). Please add them, separated by commas.
-
You can also add Webex Teams details to get notifications of new findings. For that you will need:
- You can also enable a trigger so that your workflow runs every day. It is recommended to enable the trigger so that the workflow runs every morning at 7AM. The investigate API will be queried for the past 24 hours per default, but both the trigger and the interval can be adjusted. To enable the trigger, click on the hyperlink
Every Day
below and uncheck the DISABLE TRIGGER checkbox. This can be found in the workflow properties in the right menu pane. Make sure not to select an activity when looking for the global workflow properties.
- Finally you can now run your workflow, by clicking on RUN in the top right corner.
Notes
- Please test this properly before implementing in a production environment. This is a sample workflow!
Author(s)
- Bart Bruninx (Cisco)
- Christopher van der Made (Cisco) (Documentation and Testing)