This article explains how to connect Cisco Umbrella to Workbench.

Step 1: Enable console access


Expel secures all login information our SOC analysts need about your devices in a MFA password product. Access to this login information is protected using our internal MFA processes. To learn more about the IP addresses all Expel traffic comes from, go here.

  1. Navigate to Admin > Accounts and click Add.

  2. Add user’s email address soc+<Your_Organization_Name> and select Read Only User Role for the account.

  3. Click Send Invitation. Expel completes account registration after the registration email is received.

Step 2: Generate API credentials

  1. Use your admin account to create an API Key. This can be found under Admin > API Keys.

  2. At the prompt, set an API Key Name, select the appropriate Key Scope(s), and set the Expiry Date.

    • For the API Key Name, set to your organization's preference or something like Reports Key.

    • For the Key Scope, select the following depending on the type of tenant you have: 

      1. Reports > Read-All: all customers must select this.

      2. Admin > Customers: only if you have a Multi-Organization Umbrella console.

    • For the Expiry Date, set to Never expire. 

  3. Copy both the Key and the Secret provided.

    Use these to configure your technology in Workbench in the next step.

Step 3: Configure the technology in Workbench

  1. Login to

  2. Navigate to Settings > Security Devices.

  3. At the top of the page, click Add New Device.

  4. Search for and select your technology.

  5. Complete all fields using the credentials and information you collected in Step 1 and Step 2. To complete the Console login, see the steps below.

  6. You can provide console access now or set it up later. Use the instructions below to set it up later.


This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!