Skip to main content
  • EN
  • Home
  • Advanced Analytics

Advanced Analytics

Advanced Analytics helps organizations understand and manage their exposure to cloud risks by providing a 360° view of activity throughout the Netskope platform.

132 Topics
Rohit_Bhaskar
Netskope Employee
Rohit_BhaskarNetskope Employee
published in Dashboard Gallery
NSKPSA-2024-001 - DashboardDashboard

The dashboard can be used to detect and identify any rogue devices in the customer environment where NSClient is deployed. This dashboard can be used for Netskope released security advisory as NSKPSA-2024-001

7224
A
3 days ago
M
Netskope Employee
marguelloNetskope Employee
published in Dashboard Gallery
Use AA to help to find Admin Disabled Users that were not Re-Enabled

By following the instructions you can use this Dashboard to collect information you can process in a Spreadsheet type software (e.g. Excel, Google Sheets) to look for Admin Disabled users that might still be disabled. I hope you find it useful.

600
M
Netskope Employee
6 days ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
August 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the August office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any recommended “getting started” dashboards for new users?A: The CASB & NG-SWG Dashboards are designed to help you maximize the ROI of your Netskope CASB investment by highlighting ways to fully utilize Netskope’s features. This dashboard includes to-do lists, recommendations, and best practices, making it valuable for leadership reporting. It also helps you understand if your controls are working effectively by showing trends and showcasing the value of your team’s work.The Security Health Check (Self-Service) Dashboard offers a comprehensive self-service tool for performing health checks and identifying security concerns or gaps in your environment. It covers two main dim

0
lzhi
Netskope Employee
14 days ago
ematchey
Netskope Employee
ematcheyNetskope Employee
published in Dashboard Gallery
China Traffic Insights

Netskope administrators often need visibility into user-level and app-level data transfer volumes within China in order to help them track utilization.The objective of this dashboard, attached below, is to provide insights into data consumption volumes in China, assisting customers in optimizing their steering and security policies. Specifically, this report helps to identify the primary users and websites responsible for consuming the largest amount of data transferred in China within a specific time period.  

1620
ematchey
Netskope Employee
18 days ago
jonathanpereira-claro
jonathanpereira-claroNew Member
posted in Discussions
Order by on advanced analytics

Hi, team! I created a bunch of widgets with really useful data but I'm unable to find order by fields to avoid a bar graph with a roller-coaster look. Any help would be great!

1
Aaron_Zhang
Netskope Employee
21 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery
Advanced UEBA Dashboard

 Thanks @lgibson for providing this great idea! Looking for visibility into Advanced UEBA with machine learning detections that automatically learn the baselines for different users and raise alerts when there are anomalous behaviors? Our latest Advanced UEBA Dashboard is here to help!  This dashboard provides detailed visibility into the alerts generated by Advanced UEBA policies, which helps you perform user investigation & alert validation on this topic. With the dashboard, you can better understand why these alerts are being triggered and if your policies are working effectively.  By default, the dashboard starts with a summary of Advanced UEBA alerts triggered in the last 30 days, including # alerts triggered, # apps with these alerts, and # users triggering these alerts. The # UCI Threshold Alerts triggered are highlighted, which is a starting point for your user investigation.Advanced UEBA automatically computes the User Confidence Index (UCI) score for every user on the pla

1740
Aaron_Zhang
Netskope Employee
25 days ago
D
dazmacmainNew Member III
asked in Discussions
How Can I Improve Netskope's Performance?

I have just started a new company.We have brand new Cisco Cat 9500 and 9300 MGig switches. With Netskope installed on our computer have run a speed test and getting 100Mbps connected to the Internet with Netskope enabled.  With Netskope disabled we are getting speeds of up to 700Mbps connected to the internet. Is there a reason why this is so slow, has it got to do with deep packet inspection? Can anything be done to speed this up? I am new to Netskope and our security team are in charge of this. 

3
S
1 month ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
July 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the July office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any AI specific reports that are new in the last 2-3 months? A: The updated AI Usage Dashboard. This dashboard displays AI usage within a customer environment and highlights any controls that are in place to manage AI traffic. A major update to this dashboard includes the Application Instance widget, which uses a Sankey chart to clearly illustrate the traffic flow of AI app usage. You can dive into the widgets for more detailed insights. Q: Where is the data source of the AI Usage Dashboard residing?A: The data for the AI Usage Dashboard is sourced from Application Events, which syncs data from Netskope Skope IT. For more information, you can refer to the Application Events Intro

0
lzhi
Netskope Employee
1 month ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery
AI Usage with App Instances

 July 2024 Update:This dashboard is now available in Netskope Library. Based on the AI Usage Dashboard in Netskope Library, we developed this updated version with App Instance data added. With this dashboard, you can get additional visibility into the App Instances used to access AI Apps/Sites in your environment, which helps you identify if your traffic is moving within your corporate environment only, or through a public llm. The dashboard is attached below. Feel free to import and view it in your own environment. Let us know if you have any questions or feedback!

2951
W
1 month ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery
New User Behavior Analytics (UBA) Dashboard

  The latest User Behavior Analytics (UBA) Dashboard is now available in the Netskope Library. This dashboard can be used to monitor UBA alerts and refine your UBA policies.     In addition to an overview of UBA alerts, the dashboard also provides detailed visibility into each UBA alert triggered, which helps reduce investigation time for anomalous user activities in your environment.     The dashboard can be found in the Netskope Library. Feel free to copy and view it in your own environment. Let us know if you have any questions!  

1941
2
1 month ago
lzhi
Netskope Employee
lzhiNetskope Employee
published in Dashboard Gallery
Disabled Client Dashboard

Check out the Disabled Client Dashboard! We’ve created this dashboard in response to several use cases related to disabled devices in the environment. This dashboard allows you to explore the following questions:How many devices are disabled? What percentage of the devices in the environment are disabled? Why are the devices disabled? How many users are disabling their devices? Who are these users? How long have the devices been disabled?Here are the main sections of the dashboard:Number and Percentage of Currently Disabled DevicesThese widgets show the number and percentage of currently disabled devices in your environment. They also indicate how many users have disabled devices, helping you understand the current client status.Number of Users by Status Change ReasonThe “# Users by Status Change Reason” widget helps you understand the reasons behind device status changes in your environment, highlighting the reasons with the largest number of users. For example, the screenshot shows t

3460
lzhi
Netskope Employee
1 month ago
M
Netskope Employee
mgulledgeNetskope Employee
posted in Discussions
Sending Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform

OverviewThis document encompasses a step by step guide outlining how to send all your Netskope Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform. PrerequisitesNetskope API Token Azure Log Analytics Workspace Microsoft Sentinel InstanceDeployment StepsLog into your Azure portal: https://portal.azure.com/signin/index/  Select what Netskope API endpoints you want to send to Log Analytics (see screenshot below)   Next navigate in the Azure portal to the Data Collection Endpoints page and create a Data Collection Endpoint for each Netskope API endpoint you want to send to Sentinel: (make sure the DCEs are in the same region and resource group as your Log Analytics workspace)   Once completed we will need to deploy a custom template for each API endpoint so navigate to Deploy from a custom template in your Azure portal: Select Build your own template in the editor and paste the JSON files linked below: (You will need to repeat this step for each endpoint as it

1
M
Netskope Employee
1 month ago
M
Netskope Employee
mnekkarNetskope Employee
published in Dashboard Gallery
Data Flow Investigation Dashboard

This dashboard gives a view of how data is moving in your organization. It allows you to filter for a specific application, user, or activity. Using this dashboard, you can answer questions like: Who are the top users moving data and where are they moving the data to? Who is uploading or downloading data into specific applications, such as Box?  What are the activities taking place in a specific application, such as Google Drive? Where is a specific user moving data from and to?  Also, the dashboard’s Sankey Chart allows you to understand how data is flowing from the user to the action. You can see the flow from user to from user to application to instance to activity to action. The best use for this widget is to filter for a specific user to see what data they are moving and to where.The dashboard is attached below. Feel free to view it in your own environment and share any comments/feedback. Please also let us know if you want any additional fields/data to be added to the dashboard.

2210
M
Netskope Employee
2 months ago
T
TKO3SonsNew Member III
asked in Discussions
Issues with Advanced Analytics pulling 90 days

Has anyone else ran into issues with the Advanced Analytics attmpting to pull informaiton for 90 days?  I’m attempting to pull reports for the previous quarter, but i’m running into charts that appears to be missing information going back that far.   

1
2
2 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
June 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the June office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: What are the benefits of using Advanced Analytics?A: Advanced Analytics enables you to gain valuable insights and present them effectively to your leadership. It provides visibility into your environment, helping you understand how Netskope is protecting you. With Advanced Analytics, you can identify risks in your environment and learn how to address them. To get started, refer to Advanced Analytics Training Resources. Q: How to accurately report on user activities with Advanced Analytics?A: There are several ways to do this. One effective method is to utilize the Netskope Library dashboard resources. You can search “user” in the dashboard name search bar or select the “Users” tag. The User

0
lzhi
Netskope Employee
2 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery
Security Health Check (Self-Service) Dashboard

 Looking to quickly pinpoint the security concerns in your environment? Take a look into our Security Health Check (Self-Service) Dashboard!  This is a one-stop dashboard which allows you to perform self-service health checks and to locate security concerns/gaps in your environment. The dashboard is expanded from 2 dimensions: 1) How Netskope is protecting your environment; 2) What Netskope is protecting your environment from.  The dashboard covers 9 major topics, which helps you identify & investigate: NewEdge Network & Traffic SteeringPOP utilization in restricted regions Unexpected access methods Device & Client ManagementUsers disabling Netskope Client Old/unsupported Client versions being used Alerts & PoliciesAlerts, alert types, policies triggered Top users triggering alerts (and the corresponding activities) SSL/TLS InspectionLow SSL inspection rate Unexpected bypassed traffic Coaching PoliciesIncorrect/unexpected coaching policies detected Justification reasons

6610
Aaron_Zhang
Netskope Employee
2 months ago
M
munster
asked in Discussions
Issue Password for Single User to Uninstall Agent

HiWe have users in “All Users” group in Client Configuration.  They are password protect from client installation.However, I have to issue the password to 1 user to uninstall password which means all other users can also uninstalled with this password.  Is there anyway just generate 1 time password for that user to uninstall without having to share the actual “password ptotect client uninstallation”? thx

1
ejang
Netskope Employee
2 months ago
W
wilsonExplorer III
asked in Discussions
Page events source CIDR Field question: Multiple CIDR

Within AA page events, is there a way to have multiple CIDR?  I heard that commons work, I heard that you can add the field multiple times, but neither seems to work for me.  Screenshot attached.

2
Aaron_Zhang
Netskope Employee
2 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery
Identify Office Locations by Source IP Addresses

  This dashboard helps you understand if individuals in your organization are working at the assigned office locations by converting Source IP Addresses to Office Locations.    Let's take a look at a sample use case. When doing budget planning for next year, Netskope wants to understand how many of their employees are working at the office on a weekly basis. Source IP is a good starting point, but Netskope is looking for a better view into the exact "office name" for each IP. This dashboard can help!   In the edit mode of the first widget "User Source Locations," we can find the custom dimension "Office Location" by expanding the "Custom Fields" section on the left hand side.   This custom dimension converts Source IP to the corresponding Office Location. By clicking "Edit," we will then be able to further customize it based on our needs.    Here, we have Source IP = 104.x.xx.xxx with the corresponding Office Location = STL Office. In this case, if

3702
W
2 months ago
ematchey
Netskope Employee
ematcheyNetskope Employee
published in Dashboard Gallery
Updated NG-SWG Health Check Dashboard

 An updated version of the NG-SWG Health Check dashboard is now available! The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the NG-SWG product. Below you will find a breakdown of some of the views in this dashboard.  The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.    Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.   Please Note: Customization is required for the “% of Users Protected”. Use the f

9362
ematchey
Netskope Employee
3 months ago
C
cjcarewNew Member
asked in Discussions
V2 API Pagination

Hi Folks,Apologies if this is a simpleton question, however it’s doing my head in. I have the api working and am able to use the dataexport endpoint to extract malware alerts. My issue is that I only receive one record in the response and I know there is 115 in the time period of the search. The record I receive is the very first in the results. I can confirm that by checking in the console.My (hopefully simple) question is what is the format of the api query to iterate through the results so that the full list can be retrieved? I’ve tried ?operation=next&index=(the index name supplied in the first query). However that returns an empty response.I’d appreciate any guidance.Regards,Campbell

0
C
3 months ago
C
cswordNew Member III
asked in Discussions
Exporting platform audit log data with AA

I’m curious if Netskope platform audit log data can be exported using Advanced Analytics or put on the road map? It would be helpful to generate reports for events such as Create/Delete Admins, tunnel modifications, and other events.  This arose from a recent PCI audit (looking forward into PCI 4.) where logs related to VPN access must be reviewed (and eventually ingested into SIEM or similar platform to search for anomalies) and immediately searchable up to 90 days and stored for 1 year.  Thanks!

1
mjrgg
Netskope Employee
3 months ago
B
BLAY5050New Member
asked in Discussions
Explicit Proxy Root Certificate

Does anyone know where the Netskope root certificate needs to go in Windows to use the explicit proxy? I assume it needs to go in the certificate store but is there a location? Thanks. 

3
W
3 months ago
W
wilsonExplorer III
asked in Discussions
Advanced Analytics and categories

In Advanced Analytics Application Events, it is possible to list out the primary category and the “other category” of sites”.However, page events does not have the “other category field” Questions: Is there any plan to bring these to into parity? Is there any other way to get the primary/secondary categories as it relates to a page events, or do I have to wait until Tenant version 116  new feature API and do a conversion manually?

0
W
3 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
published in Discussions
May 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the May office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: I’d like to learn more about AI usage.A: The AI Usage Dashboard can help. This dashboard shows the AI usage in your environment and helps you to see what, if any, controls are in place to control AI traffic. You can use the Application filter at the top of the dashboard to dive into a specific application. The AI Usage with App Instances dashboard would also help. This dashboard provides additional visibility into the App Instances used to access AI Apps/Sites in the environment, which helps identify if the Corporate Instances are used for AI Usage. Q: Is there info from Advanced Analytics that I can extract from SkopeIT events and web transaction logs?A: Yes. Most of the data from Skope IT

630
lzhi
Netskope Employee
3 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings