Accepted Solutions
You can absolutely do this with the API, but it's going to take a little bit of massaging of the output to put it into the format you're looking for. The '/activity' endpoint on the Reporting API is what you'll be using. If you're newer to this, you can do it in Postman using the the provided collection. There's essentially two calls, one to get your bearer token using your key and secret generated Admin -> API Keys :
Then you take the generated key and secret and auth to the service using something like the below:
import requests
url = "https://management.api.umbrella.com/auth/v2/oauth2/token"
payload={}
headers = {
'Authorization': 'Basic {{key}}:{{secret}}'
}
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)
This will return your bearer token you can then put into something like:
import requests
url = "https://reports.api.umbrella.com/v2/organizations/{{your org}}/activity?from=-30days&to=now&offset=0&domains=cisco.com"
headers = {
'Authorization': 'Bearer {{bearer}}'
}
response = requests.request("GET", url, headers=headers, data=payload)
print(response.text)
The 'from' parameter can be set to how often you are running the script and domains can either be one domain or a .csv file containing a list of domains. Additional parameters can be found here. If you're only interested if a particular domain has been accessed, not all of the individual accesses, you can just do a ?limit=1 parameter and see if the script returns anything. If the domain wasn't accessed in that time period it you will get a null data set back.
