Cisco Umbrella Investigate provides access to certain Cisco Threat Content about malicious domains, IPs, networks, and file hashes. Using a diverse dataset of billions of daily DNS requests and live views of the connections between different networks on the Internet, Cisco Umbrella Investigate applies statistical models and human intelligence to identify attackers’ infrastructures. Cisco Umbrella Investigate data can be accessed via a web-based console or an API. Cisco Umbrella includes various license options including Roaming, Branch, Professional, Insights, Platform and Investigate and WLAN.
The Insights package offers everything from Professional, plus Active Directory integration, user-based policies, the ability to retain logs forever, and more reporting options.