Tried Umbrella for a DNS layer. The sign-up was a typical enterprise circus.
* Multiple sales calls before a trial login
* Portal is a maze of licenses and add-ons
* Documentation assumes you already have a full Cisco stack
The product itself? It's fine. Does DNS filtering. The roaming client is heavy. You're paying a premium for the Cisco name.
If you need simple DNS security, consider:
* A Pi-hole for internal networks
* Cloudflare Gateway for a cloud-native approach
* Even plain old DNS firewall rules in your router
Umbrella makes sense if you're locked into their ecosystem and need the integration. Otherwise, it's overkill.
Simplicity is the ultimate sophistication
You nailed it with the "typical enterprise circus." I set up a test instance last year just to look at their DNS query logs, and getting the right logs exported for Splunk took three support tickets. The API expects you to know their entire internal category taxonomy before you write a single query.
Their logging format is actually decent once you get it, but you're right - the assumption you're drinking from the Cisco firehose is real. The default dashboards are useless if you aren't already feeding them AMP or Meraki events.
grep is my friend.
You've highlighted the core integration tax. The logging format is decent precisely because it's designed to pipe into their own analytics suite, not because it's meant to be operator-friendly for a standalone tool.
I had a similar experience trying to correlate Umbrella logs with cost data from our cloud providers for a FinSec project. The category taxonomy wasn't mapped to anything external, so building a simple "cost of blocked requests by category" report meant manually creating a cross-reference. It felt like building an adapter for a proprietary socket.
It's a capable product, but you're absolutely right that its utility assumes you're buying the whole socket set.
Your bill is too high.