Looking for advice on how to accomplish the following:Identify all SaaS Apps that our users are logging into, and identify the user groups (departments, OUs, etc.) that are logging in for each SaaS App Key information that we are looking for on the App is the following: App Name URL URL Category CCI Available - Is the application in CCI? Here is what I tried that was inefficient, lack of quality data, etc.:I tried querying web_tx for URI containing /Login/ I then queried App Names against CCI via API Lastly, I manually looked up Apps in CCI to try and find users with traffic associated to the app (the issue here is that a browse to the site would show up and not indicative of a user login)Any advice and/or direction would be appreciated. (Was not sure the appropriate category to put this question into - thus chose Additional Discussions)

Answer

User Login Reporting

Forum|Forum|8 months ago
April 2, 2025
1 reply
100 views

b-rad
New Member

Looking for advice on how to accomplish the following:

Identify all SaaS Apps that our users are logging into, and identify the user groups (departments, OUs, etc.) that are logging in for each SaaS App
Key information that we are looking for on the App is the following:
- App Name
- URL
- URL Category
- CCI Available - Is the application in CCI?

Here is what I tried that was inefficient, lack of quality data, etc.:

I tried querying web_tx for URI containing /Login/
I then queried App Names against CCI via API
Lastly, I manually looked up Apps in CCI to try and find users with traffic associated to the app (the issue here is that a browse to the site would show up and not indicative of a user login)

Any advice and/or direction would be appreciated.

(Was not sure the appropriate category to put this question into - thus chose Additional Discussions)

Best answer by sshiflett

@b-rad,

If you have Advanced Analytics this can be queried in multiple ways. You can start with Application Events to see logins that Netskope was explicitly able to identify the Login Activity:

You can alternatively (or use them together) filter URLs that contain the word “Login” using TransactioN Events.

You can add additional fields as needed for OU, group, etc.

This topic has been closed for replies.

S

+16

sshiflett
Netskope Employee
Answer
Forum|Forum|8 months ago
April 10, 2025

@b-rad,

If you have Advanced Analytics this can be queried in multiple ways. You can start with Application Events to see logins that Netskope was explicitly able to identify the Login Activity: