The Cisco Umbrella Popularity List CDF ingests a configurable subset of highly queried domains from the Cisco Umbrella global network into ThreatQ as whitelisted FQDN indicators. These indicators help prevent commonly used domains from being identified as malicious by later intelligence imports, blocklists, or detection workflows.

The Cisco Umbrella Popularity List ranks the one million domains most frequently queried across the Cisco Umbrella global network. The ranking reflects DNS activity and includes root domains and subdomains, rather than relying only on web-browser traffic.

The integration provides the following feed:

• Cisco Umbrella Popularity List - ingests up to the first 10,000 entries from the current or a historical Cisco Umbrella Popularity List snapshot.

The integration ingests indicator and indicator attribute objects into the ThreatQ platform.