slug: cisco-umbrella provider: Cisco Umbrella generated_by: planning/capability-mapping/scripts/classify_capabilities.py model: claude-opus-5 frame: - Telecommunications min_confidence: 0.7 capability_model: source: https://github.com/vincentmakes/turbo-ea-capabilities license: CC-BY-4.0 attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 notice: NOTICE edge_count: 25 edges: - tag: Incidents spec_file: cisco-umbrella-incidents-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.85 evidence: '"List Incidents", "Get Incident", "Update Incident"; schemas "Entity, Policy, Match, Vendor"' reason: Cloudlock CASB security incident lifecycle (list, retrieve, update status) — threat detection and response casework, not customer-impacting service incidents. - tag: Activity spec_file: cisco-umbrella-activity-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.8 evidence: GET /activity/firewall, GET /activity/intrusion, GET /activity/amp-retrospective; schemas "Threat", "Severity", "verdict" reason: Reporting on DNS, proxy, firewall and intrusion events with threat verdicts and severity is security monitoring/detection data, i.e. SOC/SIEM-style threat detection and response. - tag: Cisco Secure Malware Analytics Integration spec_file: cisco-umbrella-cisco-secure-malware-analytics-integration-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.8 evidence: '"Get Samples for Hash Behaviors", "Get Samples for Domain, IP, or URL"; schemas "Avresult", "Behavior"' reason: Malware sample, behaviour and artefact lookups are threat-intelligence/malware analysis used in security detection and incident response. - tag: Top Threats spec_file: cisco-umbrella-top-threats-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.8 evidence: GET /top-threats "Get Top Threats (All)", schema TopThreats reason: Ranked reporting of detected threats in a cloud-delivered security service; this is SOC-style threat detection reporting, not financial-crime or telecom fraud. - tag: Top Threat Types spec_file: cisco-umbrella-top-threat-types-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.78 evidence: GET /top-threat-types "Get Top Threat Types (All)", schema TopThreatTypes reason: Reporting on detected threat types from the security service — squarely security threat detection and response monitoring. - tag: API Keys spec_file: cisco-umbrella-api-keys-api-openapi.yml capability_id: BC-4270.40 capability_id_l1: BC-4270 capability_name: Developer Identity & Credential Management confidence: 0.75 evidence: '"Manage your Umbrella API keys."; POST /apiKeys createAPIKeys; schemas clientId, clientSecret, scopes, allowedIPs' reason: Issuance, refresh, scoping and revocation of OAuth client credentials used by developers to consume the vendor's public API — Developer Identity & Credential Management. Alternative reading as generic IAM is weaker since these are machine API credentials for the platform's API ecosystem. recovered_from: sweep-20260828T235257Z-edges.json - tag: API Usage Report spec_file: cisco-umbrella-api-usage-report-api-openapi.yml capability_id: BC-4270.50 capability_id_l1: BC-4270 capability_name: API Consumption Governance confidence: 0.75 evidence: '"Get the Umbrella API usage reports for an organization."; GET /apiUsage/requests getAPIUsageRequests; GET /apiUsage/summary' reason: Reporting of API request/response volumes per key for an organisation — API consumption analytics, which is the usage-analytics element of API Consumption Governance. recovered_from: sweep-20260828T235257Z-edges.json - tag: Domain Status and Categorization spec_file: cisco-umbrella-domain-status-and-categorization-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: '"Get Domain Status and Categorization" with schemas SecurityCategory, DomainCategorization' reason: Domain security categorization/reputation lookup is threat intelligence used for detection and investigation. - tag: Incident Aggregates spec_file: cisco-umbrella-incident-aggregates-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: '"The Cloudlock API provides data about an organization''s activities, apps, incidents, and policies." — "List Incident Aggregates Policies"' reason: Cloudlock CASB security incidents aggregated by policy, status and user — security incident detection and response reporting, not IT service incidents or telecom service incidents. - tag: Security Information for a Domain spec_file: cisco-umbrella-security-information-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: GET /security/name/{domain} Get Security Score Information for Domain; GET /domains/risk-score/{domain} Get Risk Score for Domain reason: Returns security reputation and risk scores used for threat investigation and response; clearly cybersecurity threat intelligence rather than any other reading. - tag: Subdomains for a Domain spec_file: cisco-umbrella-subdomains-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: '"Threat intelligence data for domains, IPs, and URLs" — GET /subdomains/{domain} Get Subdomains for Domain' reason: The Investigate API surfaces threat-intelligence enrichment (domain risk score, security reputation, related subdomains) used in threat detection and investigation, not any business-domain capability. - tag: Summaries by Rule (Intrusion) spec_file: cisco-umbrella-summaries-by-rule-intrusion-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.75 evidence: '"GET /summaries-by-rule/intrusion getSummariesByRuleIntrusion" with schemas "SignatureListSummary, SignatureList"' reason: Intrusion-prevention signature/rule hit summaries are detection telemetry from the security stack, aligning with threat detection and response monitoring. - tag: Passive DNS spec_file: cisco-umbrella-passive-dns-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: 'GET /pdns/ip/{ip} ''Get Resource Records for IP''; description: ''Threat intelligence data for domains, IPs, and URLs''' reason: Passive DNS resource-record lookups used for threat investigation and intelligence enrichment — threat detection and response tooling. - tag: Related Domains for a Domain spec_file: cisco-umbrella-related-domains-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: '"The Umbrella Investigate API provides a complete view of domains... Threat intelligence data for domains, IPs, and URLs" — GET /links/name/{domain} "Get Related Domains for Domain"' reason: Threat-intelligence lookup of co-occurring/related domains used in investigation, which sits under threat detection and response. recovered_from: sweep-20260828T235257Z-edges.json - tag: WHOIS Information for a Domain spec_file: cisco-umbrella-whois-information-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.72 evidence: '"The Umbrella Investigate API provides a complete view of domains ... Security reputation of a domain * ... Threat intelligence data for domains, IPs, and URLs" — GET /whois/{domain}/history getWhoisHistory' reason: WHOIS lookup and history within the Investigate threat-intelligence API, used for security investigation and enrichment of domains/IPs — threat detection and response tooling. - tag: AS Information for a Domain spec_file: cisco-umbrella-as-information-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: '"Threat intelligence data for domains, IPs, and URLs"; GET /bgp_routes/ip/{ip}/as_for_ip.json ''Get BGP Route Information for IP''' reason: Investigate API lookups of ASN/BGP routing and reputation data for domains and IPs are threat-intelligence enrichment used in detection and investigation, hence Threat Detection & Response Management. Slight uncertainty because the two operations themselves are pure routing lookups. recovered_from: sweep-20260828T235257Z-edges.json - tag: Co-occurrences for a Domain spec_file: cisco-umbrella-co-occurrences-for-a-domain-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: '"The Umbrella Investigate API provides a complete view of domains ... Threat intelligence data for domains, IPs, and URLs"' reason: Threat intelligence lookup of co-occurring domains supports security threat detection/investigation; single generic recommendations endpoint keeps confidence moderate. - tag: Destination Lists spec_file: cisco-umbrella-destination-lists-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: '"Create and manage destination lists and destinations" with operations createDestinationList / deleteDestinationList' reason: Destination lists are allow/block policy objects for DNS-layer security enforcement — cybersecurity control configuration; specific L2 is unclear (policy/governance vs detection). - tag: Destinations spec_file: cisco-umbrella-destinations-api-openapi.yml capability_id: BC-620 capability_id_l1: BC-620 capability_name: Cybersecurity Management confidence: 0.7 evidence: '"Add Destinations to Destination List" / "Delete Destinations from Destination List"' reason: Managing blocked/allowed destinations within security policy lists is cybersecurity control management; L2 ambiguous between governance and detection. - tag: IP Libraries spec_file: cisco-umbrella-ip-libraries-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: '"List IP Suspicious Entries", "List IP Entries" (trusted), "Import CSV Entries"' reason: Maintaining suspicious and trusted IP lists for CASB detection is security threat detection/response tuning; moderate confidence as it is partly list configuration. - tag: Incident Entities spec_file: cisco-umbrella-incident-entities-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: 'GET /incident_entities/{id} "List Incident Entities"; schemas: "Entity, IncidentEntity, Vendor"' reason: Entities associated with CASB security incidents; part of the security incident response surface. Thin surface (one read operation) so confidence is moderate. - tag: Roles spec_file: cisco-umbrella-roles-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Manage the Umbrella user accounts and roles." — GET /roles "List Roles", schema RoleObject' reason: Administrative role definitions governing user access to the console, i.e. role-based access control under Identity & Access Management. recovered_from: sweep-20260828T235257Z-edges.json - tag: Tagging Timeline spec_file: cisco-umbrella-tagging-timeline-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: '"Get Tagging Timeline for Destination" within Investigate — "Tagged timeline of a domain, IP, or URL"' reason: Historical security-categorisation timeline for a destination is threat-intelligence data used in detection and investigation workflows. - tag: Top Files spec_file: cisco-umbrella-top-files-api-openapi.yml capability_id: BC-620.30 capability_id_l1: BC-620 capability_name: Threat Detection & Response Management confidence: 0.7 evidence: GET /top-files getTopFilesProxy Get Top Files (Proxy); schemas TopFile, sha256 reason: Reporting of files observed through the secure web proxy keyed by SHA-256 hash — file/malware inspection telemetry supporting threat detection and response. recovered_from: sweep-20260828T235257Z-edges.json - tag: Users spec_file: cisco-umbrella-users-api-openapi.yml capability_id: BC-620.20 capability_id_l1: BC-620 capability_name: Identity & Access Management confidence: 0.7 evidence: '"Manage the Umbrella user accounts and roles." — POST /users createUser, POST /passwordResets/{customerId} createPasswordResets' reason: Administrative user account, role and password-reset management for the platform — identity and access management. Could alternatively be read as tenant admin plumbing, hence moderate confidence.