Cisco Umbrella after 12 months - honest review from a 400-user org

We rolled out Cisco Umbrella about a year ago for our ~400 users. I was tasked with helping monitor the reporting side. Overall, it's been solid for blocking threats at the DNS layer, but I have some mixed feelings.

The good: It's very "set and forget" for basic security. We saw a big drop in malware incidents. The bad: The reporting feels clunky to me. I'm used to Python/pandas for analysis, but pulling custom reports for management was harder than expected. The ROI dashboard is useful, though.

For those with larger deployments, how do you handle custom reporting? Do you export and use your own tools? Also, any surprises after the first year we should watch for?