Tutorial

Deploy and manage Cisco Umbrella roaming clients across your Roundfleet with enterprise-grade security DNS protection, automated deployment workflows, and comprehensive monitoring capabilities. This tutorial transforms the basic deployment process into a robust enterprise security solution.

Understanding Enterprise Cisco Umbrella Management

Enterprise Cisco Umbrella deployment requires more than basic client installation, demanding:

• Automated deployment workflows with organization-specific configurations
• Centralized security policy management with DNS filtering controls
• Real-time monitoring and reporting of security threats and activities
• Certificate management for advanced security features
• Compliance tracking for security posture management
• Integration capabilities with existing security infrastructure

Core Cisco Umbrella Deployment Process

Basic Deployment Components

1. Configuration Push - Deploy OrgInfo.plist with organization parameters
2. PKG Installation - Install the Umbrella roaming client application
3. Certificate Distribution - Deploy root certificates for advanced features
4. Policy Application - Configure security policies and monitoring

Core Configuration Script

# Basic configuration script
mkdir "/Library/Application Support/OpenDNS Roaming Client/"
cat <<EOF > "/Library/Application Support/OpenDNS Roaming Client/OrgInfo.plist"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>APIFingerprint</key>
    <string>xxxxxxxxxxx</string>
    <key>APIOrganizationID</key>
    <string>xxxxxx</string>
    <key>APIUserID</key>
    <string>xxxxx</string>
    <key>InstallMenubar</key>
    <false/>
</dict>
</plist>
EOF

Enterprise Cisco Umbrella Management System

#!/bin/bash

# Roundfleet Enterprise Cisco Umbrella Management System
# Comprehensive security DNS deployment with enterprise controls and monitoring

# Configuration
SCRIPT_NAME="Roundfleet Cisco Umbrella Manager"
VERSION="1.0.0"
LOG_FILE="/var/log/roundfleet_umbrella.log"
AUDIT_LOG="/var/log/roundfleet_umbrella_audit.log"
CONFIG_DIR="/Library/Application Support/OpenDNS Roaming Client"
UMBRELLA_CONFIG="$CONFIG_DIR/OrgInfo.plist"
CERTS_DIR="/etc/roundfleet/umbrella/certificates"
POLICIES_DIR="/etc/roundfleet/umbrella/policies"
TEMP_DIR="/tmp/roundfleet_umbrella"
BACKUP_DIR="/var/backups/umbrella"
MONITORING_INTERVAL=300  # 5 minutes
HEALTH_CHECK_TIMEOUT=30
ORGANIZATION_NAME="Roundfleet Enterprise"
DEPLOYMENT_MODE="enterprise"
ENABLE_ADVANCED_FEATURES=true
ENABLE_THREAT_MONITORING=true
AUTO_CERTIFICATE_RENEWAL=true

# Umbrella Configuration Parameters (to be customized per organization)
declare -A UMBRELLA_CONFIG_PARAMS=(
    ["APIFingerprint"]=""           # To be populated from Cisco dashboard
    ["APIOrganizationID"]=""        # To be populated from Cisco dashboard
    ["APIUserID"]=""                # To be populated from Cisco dashboard
    ["InstallMenubar"]="false"
    ["EnableLogging"]="true"
    ["LogLevel"]="INFO"
    ["UpdateInterval"]="3600"
    ["BackupDNS"]="8.8.8.8,1.1.1.1"
    ["EnforceSecureDNS"]="true"
    ["BlockMalware"]="true"
    ["BlockPhishing"]="true"
    ["BlockAdware"]="true"
    ["ContentFiltering"]="true"
    ["SafeSearch"]="true"
    ["YouTubeFiltering"]="strict"
)

# Security Policy Templates
declare -A SECURITY_POLICIES=(
    ["executive"]="high_security_minimal_blocking"
    ["standard"]="balanced_security_moderate_blocking"
    ["guest"]="basic_security_extensive_blocking"
    ["developer"]="medium_security_minimal_blocking"
    ["kiosk"]="maximum_security_extensive_blocking"
)

# Create necessary directories
mkdir -p "$CONFIG_DIR"
mkdir -p "$CERTS_DIR"
mkdir -p "$POLICIES_DIR"
mkdir -p "$TEMP_DIR"
mkdir -p "$BACKUP_DIR"
mkdir -p "$(dirname "$LOG_FILE")"
mkdir -p "$(dirname "$AUDIT_LOG")"

# Set secure permissions
chmod 755 "$CONFIG_DIR"
chmod 700 "$CERTS_DIR"
chmod 750 "$POLICIES_DIR"
chmod 700 "$TEMP_DIR"
chmod 750 "$BACKUP_DIR"

# Logging functions
log_operation() {
    local level="$1"
    local message="$2"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local admin_user=$(whoami)
    echo "[$timestamp] [$level] [$admin_user] $message" | tee -a "$LOG_FILE"
}

log_security_event() {
    local event_type="$1"
    local details="$2"
    local severity="$3"
    local admin_user=$(whoami)
    
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local source_ip=$(who am i | awk '{print $5}' | tr -d '()')
    echo "SECURITY|$timestamp|$event_type|$severity|$admin_user|$source_ip|$details" >> "$AUDIT_LOG"
}

# Validate Cisco Umbrella configuration parameters
validate_umbrella_config() {
    local errors=()
    
    # Check required API parameters
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" ]]; then
        errors+=("APIFingerprint is required")
    fi
    
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIOrganizationID]}" ]]; then
        errors+=("APIOrganizationID is required")
    fi
    
    if [[ -z "${UMBRELLA_CONFIG_PARAMS[APIUserID]}" ]]; then
        errors+=("APIUserID is required")
    fi
    
    # Validate fingerprint format (basic check)
    if [[ -n "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" ]] && [[ ! "${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}" =~ ^[A-Fa-f0-9]{40,}$ ]]; then
        errors+=("APIFingerprint format appears invalid")
    fi
    
    if [[ ${#errors[@]} -gt 0 ]]; then
        echo "Umbrella configuration validation failed:"
        printf '  - %s\n' "${errors[@]}"
        return 1
    fi
    
    return 0
}

# Generate enterprise Umbrella configuration
generate_umbrella_config() {
    local user_profile="${1:-standard}"
    local custom_settings="${2:-}"
    local admin_user=$(whoami)
    
    log_security_event "CONFIG_GENERATION" "profile=$user_profile" "INFO"
    
    echo "=== Generating Cisco Umbrella Configuration ==="
    echo "User Profile: $user_profile"
    echo "Deployment Mode: $DEPLOYMENT_MODE"
    echo "Administrator: $admin_user"
    echo ""
    
    # Validate configuration before generation
    if ! validate_umbrella_config; then
        log_operation "ERROR" "Configuration validation failed"
        return 1
    fi
    
    # Backup existing configuration
    if [[ -f "$UMBRELLA_CONFIG" ]]; then
        local backup_file="$BACKUP_DIR/OrgInfo_$(date +%Y%m%d_%H%M%S).plist"
        cp "$UMBRELLA_CONFIG" "$backup_file"
        log_operation "INFO" "Existing configuration backed up to: $backup_file"
    fi
    
    # Apply profile-specific security settings
    case "$user_profile" in
        "executive")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="WARN"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="false"
            ;;
        "standard")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="INFO"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            ;;
        "guest")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="WARN"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["SafeSearch"]="true"
            ;;
        "developer")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="DEBUG"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="true"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="false"
            ;;
        "kiosk")
            UMBRELLA_CONFIG_PARAMS["LogLevel"]="ERROR"
            UMBRELLA_CONFIG_PARAMS["InstallMenubar"]="false"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["EnforceSecureDNS"]="true"
            ;;
    esac
    
    # Generate the configuration file
    cat > "$UMBRELLA_CONFIG" << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Core Cisco Umbrella API Configuration -->
    <key>APIFingerprint</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIFingerprint]}</string>
    <key>APIOrganizationID</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIOrganizationID]}</string>
    <key>APIUserID</key>
    <string>${UMBRELLA_CONFIG_PARAMS[APIUserID]}</string>
    
    <!-- Enterprise UI Configuration -->
    <key>InstallMenubar</key>
    <${UMBRELLA_CONFIG_PARAMS[InstallMenubar]}/>
    <key>ShowNotifications</key>
    <true/>
    <key>AutoStart</key>
    <true/>
    
    <!-- Logging and Monitoring -->
    <key>EnableLogging</key>
    <${UMBRELLA_CONFIG_PARAMS[EnableLogging]}/>
    <key>LogLevel</key>
    <string>${UMBRELLA_CONFIG_PARAMS[LogLevel]}</string>
    <key>LogRotationDays</key>
    <integer>30</integer>
    
    <!-- Network Configuration -->
    <key>UpdateInterval</key>
    <integer>${UMBRELLA_CONFIG_PARAMS[UpdateInterval]}</integer>
    <key>BackupDNS</key>
    <string>${UMBRELLA_CONFIG_PARAMS[BackupDNS]}</string>
    <key>EnforceSecureDNS</key>
    <${UMBRELLA_CONFIG_PARAMS[EnforceSecureDNS]}/>
    
    <!-- Security Policies -->
    <key>BlockMalware</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockMalware]}/>
    <key>BlockPhishing</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockPhishing]}/>
    <key>BlockAdware</key>
    <${UMBRELLA_CONFIG_PARAMS[BlockAdware]}/>
    
    <!-- Content Filtering -->
    <key>ContentFiltering</key>
    <${UMBRELLA_CONFIG_PARAMS[ContentFiltering]}/>
    <key>SafeSearch</key>
    <${UMBRELLA_CONFIG_PARAMS[SafeSearch]}/>
    <key>YouTubeFiltering</key>
    <string>${UMBRELLA_CONFIG_PARAMS[YouTubeFiltering]}</string>
    
    <!-- Enterprise Metadata -->
    <key>OrganizationName</key>
    <string>$ORGANIZATION_NAME</string>
    <key>DeploymentMode</key>
    <string>$DEPLOYMENT_MODE</string>
    <key>ConfigurationVersion</key>
    <string>$(date +%Y%m%d%H%M%S)</string>
    <key>DeployedBy</key>
    <string>$admin_user</string>
    <key>DeploymentDate</key>
    <string>$(date)</string>
    <key>UserProfile</key>
    <string>$user_profile</string>
</dict>
</plist>
EOF
    
    # Set secure permissions
    chmod 644 "$UMBRELLA_CONFIG"
    chown root:wheel "$UMBRELLA_CONFIG"
    
    # Validate generated configuration
    if plutil -lint "$UMBRELLA_CONFIG" &>/dev/null; then
        echo "✅ Configuration generated successfully"
        log_operation "INFO" "Umbrella configuration generated for profile: $user_profile"
        log_security_event "CONFIG_DEPLOYED" "profile=$user_profile,file=$UMBRELLA_CONFIG" "INFO"
        return 0
    else
        echo "❌ Configuration validation failed"
        log_operation "ERROR" "Generated configuration file is invalid"
        return 1
    fi
}

# Install Cisco Umbrella certificates
install_umbrella_certificates() {
    local cert_source="${1:-auto}"
    local admin_user=$(whoami)
    
    log_security_event "CERT_INSTALLATION" "source=$cert_source" "INFO"
    
    echo "=== Installing Cisco Umbrella Certificates ==="
    echo "Certificate Source: $cert_source"
    echo "Administrator: $admin_user"
    echo ""
    
    local cert_files=()
    
    case "$cert_source" in
        "auto")
            # Download certificates from Cisco (requires authentication)
            echo "Downloading latest Cisco Umbrella root certificates..."
            
            # Note: In production, these would be downloaded from Cisco portal
            # For this example, we'll check for pre-downloaded certificates
            if [[ -f "$CERTS_DIR/cisco_umbrella_root.pem" ]]; then
                cert_files+=("$CERTS_DIR/cisco_umbrella_root.pem")
            else
                echo "⚠️  Certificate files not found in $CERTS_DIR"
                echo "Please download certificates from Cisco Umbrella portal:"
                echo "Deployments > Configuration > Root Certificate"
                return 1
            fi
            ;;
        "local")
            # Use locally provided certificates
            cert_files=($(find "$CERTS_DIR" -name "*.pem" -o -name "*.crt" -o -name "*.cer"))
            ;;
        *)
            # Specific certificate file
            if [[ -f "$cert_source" ]]; then
                cert_files=("$cert_source")
            else
                echo "Certificate file not found: $cert_source"
                return 1
            fi
            ;;
    esac
    
    if [[ ${#cert_files[@]} -eq 0 ]]; then
        echo "No certificate files found"
        return 1
    fi
    
    # Install certificates
    local installed_count=0
    for cert_file in "${cert_files[@]}"; do
        echo "Installing certificate: $(basename "$cert_file")"
        
        # Verify certificate before installation
        if openssl x509 -in "$cert_file" -text -noout &>/dev/null; then
            # Install to system keychain
            if security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$cert_file"; then
                echo "✅ Certificate installed successfully"
                installed_count=$((installed_count + 1))
                log_operation "INFO" "Certificate installed: $(basename "$cert_file")"
            else
                echo "❌ Failed to install certificate: $(basename "$cert_file")"
                log_operation "ERROR" "Certificate installation failed: $(basename "$cert_file")"
            fi
        else
            echo "❌ Invalid certificate format: $(basename "$cert_file")"
            log_operation "ERROR" "Invalid certificate format: $(basename "$cert_file")"
        fi
    done
    
    echo ""
    echo "Certificate installation completed: $installed_count/${#cert_files[@]} successful"
    
    if [[ $installed_count -gt 0 ]]; then
        log_security_event "CERTS_INSTALLED" "count=$installed_count" "INFO"
        return 0
    else
        log_security_event "CERT_INSTALL_FAILED" "all_failed=true" "ERROR"
        return 1
    fi
}

# Monitor Cisco Umbrella service health
monitor_umbrella_health() {
    local check_type="${1:-basic}"
    local admin_user=$(whoami)
    
    echo "=== Cisco Umbrella Health Monitoring ==="
    echo "Check Type: $check_type"
    echo "Monitor: $admin_user"
    echo ""
    
    local health_status="HEALTHY"
    local issues=()
    
    # Check if configuration file exists and is valid
    if [[ ! -f "$UMBRELLA_CONFIG" ]]; then
        health_status="CRITICAL"
        issues+=("Configuration file missing")
    elif ! plutil -lint "$UMBRELLA_CONFIG" &>/dev/null; then
        health_status="CRITICAL"
        issues+=("Configuration file corrupted")
    fi
    
    # Check if Umbrella process is running
    if ! pgrep -f "Umbrella" &>/dev/null; then
        health_status="WARNING"
        issues+=("Umbrella client not running")
    fi
    
    # Check DNS resolution through Umbrella
    echo "Testing DNS resolution through Cisco Umbrella..."
    local test_domains=("cisco.com" "umbrella.com" "google.com")
    local dns_failures=0
    
    for domain in "${test_domains[@]}"; do
        if timeout "$HEALTH_CHECK_TIMEOUT" nslookup "$domain" &>/dev/null; then
            echo "✅ DNS resolution successful: $domain"
        else
            echo "❌ DNS resolution failed: $domain"
            dns_failures=$((dns_failures + 1))
        fi
    done
    
    if [[ $dns_failures -gt 0 ]]; then
        health_status="WARNING"
        issues+=("DNS resolution issues ($dns_failures failed)")
    fi
    
    # Check certificate validity
    echo ""
    echo "Checking Cisco Umbrella certificates..."
    local expired_certs=0
    
    # Get Umbrella-related certificates from system keychain
    local umbrella_certs=$(security find-certificate -a -c "Cisco" /Library/Keychains/System.keychain 2>/dev/null | grep "alis" | wc -l)
    
    if [[ $umbrella_certs -eq 0 ]]; then
        health_status="WARNING"
        issues+=("No Cisco certificates found")
    else
        echo "✅ Found $umbrella_certs Cisco certificates"
    fi
    
    # Advanced checks
    if [[ "$check_type" == "comprehensive" ]]; then
        echo ""
        echo "Running comprehensive health checks..."
        
        # Check log file for errors
        if [[ -f "/Library/Logs/OpenDNSRoamingClient.log" ]]; then
            local recent_errors=$(tail -100 "/Library/Logs/OpenDNSRoamingClient.log" 2>/dev/null | grep -i "error" | wc -l)
            if [[ $recent_errors -gt 5 ]]; then
                health_status="WARNING"
                issues+=("High error count in logs ($recent_errors)")
            fi
        fi
        
        # Check network connectivity to Umbrella servers
        local umbrella_servers=("208.67.222.222" "208.67.220.220")
        for server in "${umbrella_servers[@]}"; do
            if timeout 5 ping -c 1 "$server" &>/dev/null; then
                echo "✅ Connectivity to Umbrella server: $server"
            else
                echo "❌ Cannot reach Umbrella server: $server"
                health_status="WARNING"
                issues+=("Connectivity issues to $server")
            fi
        done
    fi
    
    # Generate health report
    echo ""
    echo "=== Health Status Report ==="
    echo "Overall Status: $health_status"
    echo "Timestamp: $(date)"
    
    if [[ ${#issues[@]} -gt 0 ]]; then
        echo "Issues Found:"
        printf '  - %s\n' "${issues[@]}"
    else
        echo "✅ All systems operational"
    fi
    
    # Log health status
    log_operation "INFO" "Health check completed: $health_status (${#issues[@]} issues)"
    log_security_event "HEALTH_CHECK" "status=$health_status,issues=${#issues[@]}" "INFO"
    
    # Return appropriate exit code
    case "$health_status" in
        "HEALTHY") return 0 ;;
        "WARNING") return 1 ;;
        "CRITICAL") return 2 ;;
        *) return 3 ;;
    esac
}

# Generate Umbrella deployment report
generate_umbrella_report() {
    local report_type="${1:-summary}"
    local admin_user=$(whoami)
    local report_file="/var/reports/umbrella_report_$(date +%Y%m%d_%H%M%S).txt"
    
    mkdir -p "$(dirname "$report_file")"
    
    log_security_event "REPORT_GENERATION" "type=$report_type" "INFO"
    
    {
        echo "Roundfleet Cisco Umbrella Deployment Report"
        echo "========================================="
        echo "Report Type: $report_type"
        echo "Generated: $(date)"
        echo "Generated By: $admin_user"
        echo "Hostname: $(hostname)"
        echo ""
        
        case "$report_type" in
            "summary")
                echo "== Deployment Summary =="
                echo "Organization: $ORGANIZATION_NAME"
                echo "Deployment Mode: $DEPLOYMENT_MODE"
                echo "Configuration File: $UMBRELLA_CONFIG"
                
                if [[ -f "$UMBRELLA_CONFIG" ]]; then
                    echo "Configuration Status: Deployed"
                    local config_date=$(stat -f %Sm "$UMBRELLA_CONFIG")
                    echo "Last Modified: $config_date"
                else
                    echo "Configuration Status: Not Deployed"
                fi
                
                # Client status
                if pgrep -f "Umbrella" &>/dev/null; then
                    echo "Client Status: Running"
                else
                    echo "Client Status: Not Running"
                fi
                ;;
            "security")
                echo "== Security Assessment =="
                echo "Security Features Enabled:"
                
                if [[ -f "$UMBRELLA_CONFIG" ]]; then
                    local malware_blocking=$(plutil -extract BlockMalware xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    local phishing_blocking=$(plutil -extract BlockPhishing xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    local content_filtering=$(plutil -extract ContentFiltering xml1 -o - "$UMBRELLA_CONFIG" 2>/dev/null | grep -o "<true/>" && echo "Enabled" || echo "Disabled")
                    
                    echo "  Malware Blocking: $malware_blocking"
                    echo "  Phishing Blocking: $phishing_blocking"
                    echo "  Content Filtering: $content_filtering"
                else
                    echo "  Configuration not available for analysis"
                fi
                
                # Certificate status
                local cisco_certs=$(security find-certificate -a -c "Cisco" /Library/Keychains/System.keychain 2>/dev/null | grep "alis" | wc -l)
                echo "  Cisco Certificates Installed: $cisco_certs"
                ;;
            "audit")
                echo "== Audit Information =="
                if [[ -f "$AUDIT_LOG" ]]; then
                    echo "Recent security events (last 10):"
                    tail -10 "$AUDIT_LOG"
                else
                    echo "No audit log available"
                fi
                ;;
        esac
        
        echo ""
        echo "== Configuration Details =="
        if [[ -f "$UMBRELLA_CONFIG" ]]; then
            echo "Configuration file contents:"
            cat "$UMBRELLA_CONFIG"
        else
            echo "No configuration file found"
        fi
        
    } > "$report_file"
    
    echo "Umbrella deployment report generated: $report_file"
    log_operation "INFO" "Umbrella report generated: $report_file"
}

# Set organization-specific parameters
set_organization_params() {
    local api_fingerprint="$1"
    local api_org_id="$2"
    local api_user_id="$3"
    
    if [[ -z "$api_fingerprint" || -z "$api_org_id" || -z "$api_user_id" ]]; then
        echo "Usage: set_organization_params <api_fingerprint> <api_org_id> <api_user_id>"
        echo ""
        echo "These parameters can be obtained from:"
        echo "Cisco Umbrella Portal > Deployments > Core Identities > Roaming Computers"
        return 1
    fi
    
    UMBRELLA_CONFIG_PARAMS["APIFingerprint"]="$api_fingerprint"
    UMBRELLA_CONFIG_PARAMS["APIOrganizationID"]="$api_org_id"
    UMBRELLA_CONFIG_PARAMS["APIUserID"]="$api_user_id"
    
    echo "Organization parameters updated successfully"
    log_security_event "ORG_PARAMS_SET" "org_id=$api_org_id" "INFO"
}

# Main Cisco Umbrella management function
main() {
    local action="${1:-help}"
    
    case "$action" in
        "configure")
            local user_profile="${2:-standard}"
            local custom_settings="$3"
            
            generate_umbrella_config "$user_profile" "$custom_settings"
            ;;
        "install-certs")
            local cert_source="${2:-auto}"
            
            install_umbrella_certificates "$cert_source"
            ;;
        "health")
            local check_type="${2:-basic}"
            
            monitor_umbrella_health "$check_type"
            ;;
        "report")
            local report_type="${2:-summary}"
            
            generate_umbrella_report "$report_type"
            ;;
        "set-params")
            local api_fingerprint="$2"
            local api_org_id="$3"
            local api_user_id="$4"
            
            set_organization_params "$api_fingerprint" "$api_org_id" "$api_user_id"
            ;;
        "deploy")
            local user_profile="${2:-standard}"
            
            echo "=== Full Cisco Umbrella Deployment ==="
            echo "Starting comprehensive deployment..."
            echo ""
            
            # Step 1: Generate configuration
            if generate_umbrella_config "$user_profile"; then
                echo "✅ Configuration deployment successful"
            else
                echo "❌ Configuration deployment failed"
                exit 1
            fi
            
            echo ""
            
            # Step 2: Install certificates
            if install_umbrella_certificates "auto"; then
                echo "✅ Certificate installation successful"
            else
                echo "⚠️  Certificate installation had issues"
            fi
            
            echo ""
            
            # Step 3: Health check
            echo "Running post-deployment health check..."
            monitor_umbrella_health "basic"
            
            echo ""
            echo "🎉 Cisco Umbrella deployment completed!"
            echo "Next steps:"
            echo "1. Install Cisco Umbrella PKG file via JAMF or manual installation"
            echo "2. Verify client is running and connected"
            echo "3. Test DNS filtering and security features"
            ;;
        "help"|*)
            echo "$SCRIPT_NAME v$VERSION"
            echo "Enterprise Cisco Umbrella Roaming Client Management"
            echo ""
            echo "Usage: $0 <action> [options]"
            echo ""
            echo "Actions:"
            echo "  configure [profile]                         - Generate Umbrella configuration"
            echo "  install-certs [source]                      - Install Cisco certificates"
            echo "  health [type]                               - Monitor Umbrella health"
            echo "  report [type]                               - Generate deployment reports"
            echo "  set-params <fingerprint> <org_id> <user_id> - Set organization parameters"
            echo "  deploy [profile]                            - Full deployment workflow"
            echo "  help                                        - Show this help message"
            echo ""
            echo "User Profiles:"
            echo "  executive   - High security, minimal blocking"
            echo "  standard    - Balanced security and usability (default)"
            echo "  guest       - Basic security, extensive blocking"
            echo "  developer   - Medium security, minimal blocking"
            echo "  kiosk       - Maximum security, extensive blocking"
            echo ""
            echo "Certificate Sources:"
            echo "  auto        - Download from Cisco (default)"
            echo "  local       - Use certificates in $CERTS_DIR"
            echo "  <file>      - Specific certificate file"
            echo ""
            echo "Health Check Types:"
            echo "  basic       - Basic connectivity and configuration checks"
            echo "  comprehensive - Extended monitoring and diagnostics"
            echo ""
            echo "Report Types:"
            echo "  summary     - Deployment overview (default)"
            echo "  security    - Security configuration analysis"
            echo "  audit       - Audit trail and events"
            echo ""
            echo "Features:"
            echo "  • Automated Cisco Umbrella client deployment"
            echo "  • Profile-based security configuration"
            echo "  • Enterprise certificate management"
            echo "  • Real-time health monitoring and diagnostics"
            echo "  • Comprehensive audit logging and compliance"
            echo "  • Integration with Roundfleet security infrastructure"
            echo "  • Advanced threat protection and DNS filtering"
            ;;
    esac
}

# Execute main function with all arguments
main "$@"

Quick Reference Commands

Initial Setup

# Set organization parameters (obtained from Cisco dashboard)
./umbrella_manager.sh set-params "your_api_fingerprint" "your_org_id" "your_user_id"

# Deploy with standard profile
./umbrella_manager.sh deploy standard

# Deploy with executive profile
./umbrella_manager.sh deploy executive

Configuration Management

# Generate configuration for different user profiles
./umbrella_manager.sh configure standard
./umbrella_manager.sh configure executive
./umbrella_manager.sh configure guest
./umbrella_manager.sh configure developer
./umbrella_manager.sh configure kiosk

Certificate Management

# Install certificates automatically
./umbrella_manager.sh install-certs auto

# Install from local directory
./umbrella_manager.sh install-certs local

# Install specific certificate file
./umbrella_manager.sh install-certs /path/to/cisco_cert.pem

Health Monitoring

# Basic health check
./umbrella_manager.sh health

# Comprehensive health check
./umbrella_manager.sh health comprehensive

Reporting Operations

# Generate summary report
./umbrella_manager.sh report

# Generate security assessment
./umbrella_manager.sh report security

# Generate audit report
./umbrella_manager.sh report audit

Integration Examples

JAMF Pro Integration

#!/bin/bash

# JAMF Pro script for Cisco Umbrella deployment
# Parameters: $4 = user_profile, $5 = api_fingerprint, $6 = api_org_id, $7 = api_user_id

USER_PROFILE="$4"
API_FINGERPRINT="$5"
API_ORG_ID="$6"
API_USER_ID="$7"

# Download Umbrella manager if not present
if [[ ! -f "/usr/local/bin/roundfleet_umbrella_manager.sh" ]]; then
    curl -o "/usr/local/bin/roundfleet_umbrella_manager.sh" \
         "https://scripts.roundfleet.com/umbrella_manager.sh"
    chmod +x "/usr/local/bin/roundfleet_umbrella_manager.sh"
fi

# Set organization parameters
/usr/local/bin/roundfleet_umbrella_manager.sh set-params \
    "$API_FINGERPRINT" "$API_ORG_ID" "$API_USER_ID"

# Deploy Umbrella configuration
/usr/local/bin/roundfleet_umbrella_manager.sh deploy "$USER_PROFILE"

# Report status back to JAMF
if [[ $? -eq 0 ]]; then
    echo "Cisco Umbrella deployed successfully"
    exit 0
else
    echo "Cisco Umbrella deployment failed"
    exit 1
fi

Security Monitoring Integration

#!/bin/bash

# Continuous monitoring script for Cisco Umbrella
monitor_umbrella_continuous() {
    local monitoring_interval=300  # 5 minutes
    local alert_threshold=3
    local consecutive_failures=0
    
    while true; do
        # Run health check
        if /usr/local/bin/roundfleet_umbrella_manager.sh health basic &>/dev/null; then
            consecutive_failures=0
            echo "$(date): Umbrella health check passed"
        else
            consecutive_failures=$((consecutive_failures + 1))
            echo "$(date): Umbrella health check failed ($consecutive_failures)"
            
            # Alert after consecutive failures
            if [[ $consecutive_failures -ge $alert_threshold ]]; then
                send_security_alert "Cisco Umbrella service degraded" "CRITICAL"
                consecutive_failures=0
            fi
        fi
        
        sleep "$monitoring_interval"
    done
}

Advanced Security Features

Threat Intelligence Integration

# Enhanced security monitoring with threat intelligence
enhanced_threat_monitoring() {
    local threat_feeds=("malware" "phishing" "botnet" "ransomware")
    
    echo "=== Advanced Threat Monitoring ==="
    
    for feed in "${threat_feeds[@]}"; do
        local blocked_count=$(grep -c "$feed" /Library/Logs/OpenDNSRoamingClient.log 2>/dev/null || echo 0)
        echo "$feed threats blocked: $blocked_count"
        
        if [[ $blocked_count -gt 100 ]]; then
            log_security_event "HIGH_THREAT_ACTIVITY" "feed=$feed,count=$blocked_count" "WARNING"
        fi
    done
}

Policy Automation

# Automated policy updates based on security events
automated_policy_updates() {
    local threat_level="$1"
    
    case "$threat_level" in
        "high")
            # Enable maximum security
            UMBRELLA_CONFIG_PARAMS["BlockAdware"]="true"
            UMBRELLA_CONFIG_PARAMS["ContentFiltering"]="true"
            UMBRELLA_CONFIG_PARAMS["SafeSearch"]="true"
            generate_umbrella_config "kiosk"
            ;;
        "medium")
            # Standard security
            generate_umbrella_config "standard"
            ;;
        "low")
            # Reduced security for business needs
            generate_umbrella_config "executive"
            ;;
    esac
    
    # Restart Umbrella client to apply changes
    sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist 2>/dev/null
    sudo launchctl load /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist 2>/dev/null
}

Best Practices

1. Secure API credentials and use environment variables for sensitive data
2. Implement profile-based configurations for different user types
3. Enable comprehensive logging for security monitoring and compliance
4. Automate certificate management and renewal processes
5. Monitor service health continuously with alerting
6. Integrate with SIEM systems for centralized security monitoring
7. Regular policy updates based on threat intelligence
8. Test DNS filtering and security features after deployment

This enterprise Cisco Umbrella management system provides comprehensive security DNS protection with automated deployment, monitoring capabilities, and enterprise-grade controls for effective Roundfleet security management.