The deployment-mssp Developer Hub

Welcome to the deployment-mssp developer hub. You'll find comprehensive guides and documentation to help you start working with deployment-mssp as quickly as possible, as well as support if you get stuck. Let's jump right in!

Get Started    

Change the Location of Event Data Logs

By default, a customer's instance of Umbrella saves event data logs to Cisco's California data warehouse location. You can change the location of the data warehouse from North America to Europe at any time.

Only event data is stored to the data warehouse. This is any data that might appear in an Umbrella report. Configuration data, such as audit logs and policy settings remains stored by Cisco in California regardless of a change to the data warehouse's location.

Data warehouse configuration settings are only managed through the Umbrella dashboard. The MSSP console has no data warehouse configuration settings. However, when a customer's data warehouse location changes to Europe, the MSSP console's reporting options change. Once changed, you can select that reports be generated based on either the North American or European storage region. This allows for the accommodation of an MSSP that manages customers in both regions.

Implications When You Change Data Warehouse Locations

When you change the location of the data warehouse from North America to Europe or Europe to North America, the data that the customer's Umbrella dashboard uses changes. Because Umbrella's various reports use the data saved to logs that are stored to the data warehouse, only data from the data warehouse's current location is available to Umbrella to generate reports. Existing logs do not change locations. Data stored in North America stays in North America. Data stored to Europe stays in Europe. In Umbrella, to generate reports using data from the previous data warehouse location, you must change the data warehouse location back to the previous location.

For reports generated from the MSSP console, if you change the data warehouse location for a customer, you are given options through the MSSP console's reports to generate reports either for customers using the North American located data warehouse or the European located data warehouse.

Note: Umbrella roaming client IP blocking logs are always stored in California.

Caution

Although you can change back from the European data warehouse location to the North American data warehouse location, we do not recommend this procedure. Changing back and forth between data warehouse locations results in the splitting of your Umbrella event data between locations. This splitting lessons the accuracy of your Umbrella reports. We strongly recommend that once you change the location of your data warehouse from North America to Europe that you do not change back, unless the change back is intended to be permanent.

Note: When you change the data warehouse's location in Umbrella, Umbrella's reporting functionality is temporarily suspended while the switchover to a new location occurs. For activity search data, the switchover period lasts only a few minutes; however, other reporting data may take several hours to begin appearing in reports.

Log Retention

Logs are deleted when the retention date expires:

  • 30 days for detailed data
  • Two years for summary data

Logs are not deleted when you change the data warehouse location.

Prerequisites

  • Full administrative access to the MSSP console
  • Full administrative access to the customer's Cisco Umbrella dashboard.

Change Data Warehouse Locations

  1. In the MSSP console, navigate to Customer Management​ and click View Dashboard.
  1. In Umbrella, navigate to Admin > Log Management and under Data Storage click Change Location.
  1. Select a new location and click Next.
  1. Confirm that you understand the consequences of changing the location where logs are physically stored and click Change.

The data warehouse location is changed and Umbrella now stores event data logs to this new location. Logging to the old location stops.
Note: Logs stored at the previous location are not deleted until the retention period expires—30 days for detailed data and two years for summary data.

Changing the data warehouse location from North America to Europe results in MSSP reports updating so that you can generate reports for either the North American or European regions. But not both at the same time.


Enable Logging to a Cisco-managed S3 Bucket < Change the Location of Event Data Logs > Stop Logging

Updated about a year ago

Change the Location of Event Data Logs


Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.