Not sure if anyone else has run into this issue when deploying the preview editon of the Umbrella Connector. The expected data types in the pre-built queries is Cisco_Umbrella, however the Function app created the following data types
- Cisco Umberlla_cloudfirewall_Cl
So none of out of the box queries work, and it isn't a simple action to swap in the correct data types. You need to rewrite the query with the correct fields.