Automated Umbrella Device Coverage Checks
Every morning, WebRun signs in to Cisco Umbrella, lists the roaming computers registered on the account, reads the last seen date on each identity, flags any device that has sent no traffic for several days, texts the on-call admin the silent list through Twilio, and books time in Google Calendar to chase them.
How do I find devices that stopped reporting to my DNS security?
WebRun signs in to Cisco Umbrella every morning, reads the last seen date on every roaming computer, and flags any identity that has sent no traffic for several days. It texts the on-call admin the silent list through Twilio and books follow-up time in Google Calendar, so coverage gaps get fixed instead of assumed.
- Devices that go silent are named within days, not at the next audit
- Every silent device shows its policy, network, and last seen date
- Follow-up time is booked the same morning the gap appears
Built for IT administrators · security teams · managed service providers · operations leads
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
login.umbrella.comin a real browser with your saved login - no setup, no API keys. -
1
Cisco Umbrella - find devices that went silent
cisco.com
WebRun opens Cisco Umbrella to find devices that went silent. - Sign in and open the list of roaming computers
- Read the last seen date on every identity
- Flag any device with no activity for more than 3 days
- Note which policy and network each silent device belongs to
Done when Every registered device has a last seen date and a silent or active flag.
-
2
Twilio - text the on-call admin
twilio.com
WebRun opens Twilio to text the on-call admin. - Text the on-call admin's own saved number with the silent device count
- Name the longest silent devices and the days since each was last seen
- Send to the admin number only, never to an employee or device owner
- Stay quiet on mornings where every device reported in
Done when The on-call admin knows today's coverage gaps.
-
3
Google Calendar - book the follow-up
calendar.google.com
WebRun opens Google Calendar to book the follow-up. - Book a short follow-up slot on the admin's own calendar
- List the silent devices, their policy, and their last seen date in the event notes
- Do not invite the device owner or any external guest
- Leave every fix to a person. WebRun never changes a policy, blocks a domain, or removes an identity
Done when There is booked time to chase every device that went quiet.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it change policies or remove a device?
No. WebRun reads last seen dates and reports them. It never edits a policy, blocks or allows a domain, deletes an identity, or deregisters a roaming client. Every change stays with your admin.
Who receives the text?
Only the on-call admin number you configure. WebRun never texts an employee, a device owner, or anyone outside your IT team, and it sends nothing on mornings when every device has reported in.
What counts as a silent device?
A registered roaming computer with no activity for more than 3 days. The report shows the exact last seen date, the policy it sits under, and the network, so you can tell a broken client from a laptop on holiday.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.