Block AI Tools with Cisco Umbrella
DNS Filtering

#!/usr/bin/env python3
"""Create and populate a Cisco Umbrella destination list with AI tool domains."""

import requests
import json

# Umbrella Management API credentials
UMBRELLA_API_KEY    = "your-management-api-key"
UMBRELLA_API_SECRET = "your-management-api-secret"
ORG_ID              = "your-org-id"

# AI Tools Blocklist API credentials
BLOCKLIST_API_KEY = "your-blocklist-api-key"
BLOCKLIST_FEED    = "https://api.aitoolsblocklist.com/v1/feed/domains?format=plain"

BASE_URL = f"https://api.umbrella.com/v1/organizations/{ORG_ID}"

def get_auth_token():
    """Obtain OAuth2 token from Umbrella API."""
    resp = requests.post(
        "https://api.umbrella.com/auth/v2/token",
        auth=(UMBRELLA_API_KEY, UMBRELLA_API_SECRET),
        data={"grant_type": "client_credentials"},
        timeout=10
    )
    resp.raise_for_status()
    return resp.json()["access_token"]

def fetch_ai_domains():
    """Download the latest AI tool domains from the blocklist feed."""
    resp = requests.get(
        BLOCKLIST_FEED,
        headers={"Authorization": f"Bearer {BLOCKLIST_API_KEY}"},
        timeout=30
    )
    resp.raise_for_status()
    domains = [line.strip() for line in resp.text.splitlines() if line.strip()]
    return domains

def create_destination_list(token, name):
    """Create a new block-type destination list in Umbrella."""
    resp = requests.post(
        f"{BASE_URL}/destinationlists",
        headers={
            "Authorization": f"Bearer {token}",
            "Content-Type": "application/json"
        },
        json={
            "name": name,
            "access": "block",
            "isGlobal": False
        },
        timeout=10
    )
    resp.raise_for_status()
    list_id = resp.json()["id"]
    print(f"Created destination list: {name} (ID: {list_id})")
    return list_id

def add_domains_to_list(token, list_id, domains, batch_size=500):
    """Add domains in batches to avoid API payload limits."""
    for i in range(0, len(domains), batch_size):
        batch = domains[i:i + batch_size]
        payload = [{"destination": d} for d in batch]
        resp = requests.post(
            f"{BASE_URL}/destinationlists/{list_id}/destinations",
            headers={
                "Authorization": f"Bearer {token}",
                "Content-Type": "application/json"
            },
            json=payload,
            timeout=30
        )
        resp.raise_for_status()
        print(f"  Added batch {i // batch_size + 1}: {len(batch)} domains")

# Main workflow
token   = get_auth_token()
domains = fetch_ai_domains()
print(f"Fetched {len(domains)} AI tool domains from blocklist feed")

list_id = create_destination_list(token, "AI Tools Blocklist")
add_domains_to_list(token, list_id, domains)
print(f"Done. {len(domains)} domains loaded into destination list {list_id}")

# Download category-specific domain lists for granular Umbrella policies

# High-risk: text generation and chatbots
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.aitoolsblocklist.com/v1/feed/domains?format=plain&categories=text-language" \
  -o /tmp/ai-text-language.txt

# High-risk: code assistants and development tools
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.aitoolsblocklist.com/v1/feed/domains?format=plain&categories=code-development" \
  -o /tmp/ai-code-dev.txt

# Medium-risk: image and visual generation
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.aitoolsblocklist.com/v1/feed/domains?format=plain&categories=image-visual" \
  -o /tmp/ai-image-visual.txt

# Lower-risk: productivity and collaboration
curl -s -H "Authorization: Bearer $API_KEY" \
  "https://api.aitoolsblocklist.com/v1/feed/domains?format=plain&categories=productivity-collaboration" \
  -o /tmp/ai-productivity.txt

echo "Category lists downloaded:"
wc -l /tmp/ai-text-language.txt /tmp/ai-code-dev.txt \
      /tmp/ai-image-visual.txt /tmp/ai-productivity.txt

#!/usr/bin/env python3
"""Pull AI tool block events from Umbrella Reporting API for SIEM integration."""

import requests
import json
from datetime import datetime, timedelta

UMBRELLA_KEY    = "your-reporting-api-key"
UMBRELLA_SECRET = "your-reporting-api-secret"
ORG_ID          = "your-org-id"

REPORT_URL = f"https://reports.api.umbrella.com/v2/organizations/{ORG_ID}/activity"

def get_token():
    resp = requests.post(
        "https://api.umbrella.com/auth/v2/token",
        auth=(UMBRELLA_KEY, UMBRELLA_SECRET),
        data={"grant_type": "client_credentials"},
        timeout=10
    )
    resp.raise_for_status()
    return resp.json()["access_token"]

def get_ai_block_events(token, hours=24):
    """Fetch blocked DNS events for AI tool domains."""
    now   = datetime.utcnow()
    start = now - timedelta(hours=hours)

    params = {
        "from":     start.strftime("%Y-%m-%dT%H:%M:%S.000Z"),
        "to":       now.strftime("%Y-%m-%dT%H:%M:%S.000Z"),
        "verdict":  "blocked",
        "limit":    500
    }

    resp = requests.get(
        REPORT_URL,
        headers={"Authorization": f"Bearer {token}"},
        params=params,
        timeout=30
    )
    resp.raise_for_status()
    return resp.json().get("data", [])

token  = get_token()
events = get_ai_block_events(token)

print(f"AI tool block events (last 24h): {len(events)}")
for event in events[:20]:
    print(json.dumps({
        "timestamp":   event.get("datetime"),
        "domain":      event.get("domain"),
        "identity":    event.get("identity"),
        "action":      event.get("verdict"),
        "policy":      event.get("policyIdentity"),
        "source_ip":   event.get("externalIp")
    }, indent=2))