• Home
  • Advanced Analytics

Advanced Analytics

Advanced Analytics helps organizations understand and manage their exposure to cloud risks by providing a 360° view of activity throughout the Netskope platform.

107 Topics

M
matheusfNew Member III
asked in Discussions

Filtering and Counting Files by Extension in Netskope

Hi everyone,I'm looking for a way to create a filter in Netskope that focuses only on the file extension, disregarding the full file name.Objective:My goal is to analyze the volume of files with specific extensions that are being used in our environment. For example, I have a list of extensions like .csv, .xls, and .jpg, and I want to understand how many files of each type are being accessed.Challenge:In Advanced Analytics, I can only see the complete object name. I'd like to know if it's possible to create a custom field that captures only the file extensions. This would allow me to count and visualize the volume of each file type in a dashboard or report.Example:An ideal report would display the volume of files per extension over a specific period. For instance, in the last 7 days, there were 50 .pdf files uploaded, 20 .xls files, and 2 .jpg files.I hope I have explained my need clearly. Any help or suggestions would be greatly appreciated!

2
M
4 days ago
bob
Netskope Employee
bobNetskope Employee
published in Dashboard Gallery

Employee Flight Risk Dashboard

Here is an Advanced Analytics dashboard that predicts when employees are planning to leave the company. Multiple signals are used to make the prediction including:- Visits to career sites- Visits to competitor job sites- Uploads of resume data to webmail- Suspicious data movement from corporate to unsanctioned apps- Bulk downloads of data to corporate appsTo fill in this dashboard the following config will need to be in place:1. Policy to alert when visiting (all activities) with destination ‘Job Search/Career’ category2. Policy to alert when visiting (all activities) with destination a custom web category that includes competitor job sites3. DLP policy to alert when resume data is uploaded to webmail category (use ML classifier for resume)4. UEBA policy and config for suspicious data movement (need to identify corporate apps)5. UEBA policy to detect bulk downloads of dataThanks to @Aaron_Zhang for helping to build out the dashboard components.  

3204
sfaeder
7 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Device Client Overview Dashboard

Netskope Advanced Analytics makes device data collection available for analysis through the latest Device Client Overview Client Dashboard. The dashboard helps you better understand and manage the deployment of Netskope Client in your environment. Some of the key metrics captured by this dashboard include:Getting an aggregated view of the number of corporate-managed devices that have installed the Netskope Client, and insights into the status of devices with the Client enabled, disabled, or uninstalled Understanding the trends of Client version updates over time and determining how many devices are on unsupported, supported or golden release versions Identifying devices disconnected for a long period of time Investigating and troubleshooting users’ Client activities by leveraging historical data Use this dashboard to enhance your device security posture, generate comprehensive risk insights, perform compliance assessments based on your corporate policies, and implement greater control

8154
B
8 days ago
E
elawaetzExplorer III
asked in Discussions

Cloud Exchange Logshipper Syslog integration with Darktrace?

Has anyone had any luck with Syslog integration from Cloud Exchange into Darktrace?Darktrace describes the expected format like this:Darktrace expects the Netskope Web Gateway data to include the string "darktrace_netskope" followed by a JSON formatted representation of the Netskope logging. The order of fields within the JSON is not important. For example: darktrace_netskope {"src_time": "Fri Jan 1 00:10:00 2021","userkey": "user.name@company.com","dst_region": "Region","category": "Business","src_longitude": 52.2,"transaction_id": 0,"ur_normalized": "user.name@company.com","src_latitude": 0.12,"dst_longitude": 52.2,"domain": "www.example.org","dst_zipcode": "555555","access_method": "Client","src_timezone": "Global/UTC","ccl": "unknown","bypass_reason": "SSL policy matched","user_generated": "yes","dst_country": "ZZ","srcip": "198.51.100.1","site": "example","traffic_type": "Web","src_region": "Region","user": "user.name@example.org","appcategory": "Business","page_id": 0,"insertion_

4
E
9 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

Swap data using table calculations

Recently, one of our customers who is leveraging risk insights for log ingestion ran into a problem. For certain dates of the month (April 14 & 15), the ingestion swapped "Bytes Uploaded" and "Bytes Downloaded." How can they leverage Advanced Analytics to swap the data back so that their monthly reporting would be accurate? Here is one solution with Table Calculations.  The first step is to create a Custom Dimension with command: concat(${page_event.event_timestamp_date},"")  This converts the format of all “Event Dates” from “Timestamp” to “String,” which helps avoid potential errors in our Table Calculations. We name the dimension Event Date - String and then save it. The second step is to create Table Calculations which swap the data for particular dates (April 14 & 15 in this case). Let’s start with the Table Calculation swapping “Bytes Uploaded” to “Bytes Downloaded.” We create a Table Calculation with command: if(  ${event_date_string}="2024-04-14"  OR  ${event_date_strin

0
Aaron_Zhang
Netskope Employee
10 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

March 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the March office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: How to better analyze and manage GPT traffic using Advanced Analytics?A: We recommend starting with the AI Usage Dashboard in Netskope Library, which helps you understand how AI apps & sites (e.g. ChatGPT) are being used in your organization. You can also find an updated version of the AI Usage Dashboard in Netskope Community. This version provides additional visibility into App Instances, which helps you identify if your Corporate Instances are exposed with AI usage. Q: How can we combine reports to see data being uploaded to risky applications and to understand their CCL?A: The Application Risk Management Dashboard is a great starting point for this use case. The dashboard helps you

0
Aaron_Zhang
Netskope Employee
24 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Application Risk Management

This dashboard aims to surface the application risk in your environment. Use the dashboard to better understand:What applications are being used in your environment Are any of them unmanaged, untagged, or risky Is there any sensitive or risky data movement through these applicationsLet’s take a look in our demo environment. The dashboard starts with a summary of applications being used. Here we can see 295 applications are detected, and 275 of them are unmanaged. Out of these applications, we can get visibility into how many of them are rated as “excellent,” “high,” “medium,” “low,” and “poor” in terms of risk (Cloud Confidence Level). This will help us decide how many “risky” and “less risky” applications are being used in our environment. In the meantime, we can also see how much data is moving to these “risky” and “less risky” applications. The dashboard then provides detailed information about risky applications and traffic detected, which allows us to perform deep investigations o

1220
Aaron_Zhang
Netskope Employee
29 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Identify Office Locations by Source IP Addresses

  This dashboard helps you understand if individuals in your organization are working at the assigned office locations by converting Source IP Addresses to Office Locations.    Let's take a look at a sample use case. When doing budget planning for next year, Netskope wants to understand how many of their employees are working at the office on a weekly basis. Source IP is a good starting point, but Netskope is looking for a better view into the exact "office name" for each IP. This dashboard can help!   In the edit mode of the first widget "User Source Locations," we can find the custom dimension "Office Location" by expanding the "Custom Fields" section on the left hand side.   This custom dimension converts Source IP to the corresponding Office Location. By clicking "Edit," we will then be able to further customize it based on our needs.    Here, we have Source IP = 104.x.xx.xxx with the corresponding Office Location = STL Office. In this case, if

1491
T
1 month ago
ematchey
Netskope Employee
ematcheyNetskope Employee
posted in Dashboard Gallery

NG-SWG Operationalization Dashboard

The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the NG-SWG product. Below you will find a breakdown of some of the views in this dashboard.    The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.        Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.    After making sure the users are adequately covered, it is important to ensure that traffic is being inspec

2
ematchey
Netskope Employee
1 month ago
ematchey
Netskope Employee
ematcheyNetskope Employee
published in Dashboard Gallery

Updated NG-SWG Health Check Dashboard

 An updated version of the NG-SWG Health Check dashboard is now available! The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the NG-SWG product. Below you will find a breakdown of some of the views in this dashboard.  The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.    Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.   Please Note: Customization is required for the “% of Users Protected”. Use the f

2680
ematchey
Netskope Employee
1 month ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Updated Application Category Dashboard

This dashboard provides detailed visibility into the application categories detected in your environment, including:Top used applications, both managed and unmanaged, in each category Risky applications, traffic, & data movement in each category Application instance tags Policies & alerts triggered by applications in each categoryUse this dashboard to:Better understand top used applications in each category to reduce app redundancy Identify the usage of unmanaged & risky applications in each category Monitor sensitive & risky traffic/data movement in each category The dashboard is attached below. Feel free to download and view it in your own environment. Let us know if you have any questions!

1500
Aaron_Zhang
Netskope Employee
1 month ago
ematchey
Netskope Employee
ematcheyNetskope Employee
published in Dashboard Gallery

Updated CASB Health Check Dashboard Operation

An updated version of the CASB Health Check dashboard is now available!The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the CASB product. Below you will find a breakdown of some of the views in this dashboard.  The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.    Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.Please Note: Customization is required for the “% of Users Protected”. Use the following

3570
ematchey
Netskope Employee
1 month ago
ematchey
Netskope Employee
ematcheyNetskope Employee
posted in Dashboard Gallery

Cloud Firewall Dashboard

This dashboard can be used to have an overview of Cloud Firewall in terms of users, traffic, policies, top allowed protocols, top blocked protocols, top users and source IP for allowed and blocked traffic, top blocked DNS domains, top users with blocked DNS domains, top DNS allowed domains, etc.   Please note, this post was created quickly and will be updated in the coming days & weeks. 

2
Aaron_Zhang
Netskope Employee
2 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

February Office Hours Recap

 Hello Folks,  Below you can find a recap of questions asked at the February office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: We noticed that the community page looks different now. What happened?A: We recently launched a new version of Netskope Community, and that is why you may have observed many changes in our community page. The URL remains the same, so you can still visit our community through https://community.netskope.com/. Advanced Analytics section is still located in the new community landing page, where you can access all the features like dashboard gallery, discussion board, and training resources.  We are still updating the new community page, so you may see additional changes in the upcoming weeks or months. In the meantime, please feel free to share any feedback and let us know if you have any

0
Aaron_Zhang
Netskope Employee
2 months ago
E
Netskope Employee
eoakesonNetskope Employee
published in Dashboard Gallery

Cloud Firewall Dashboard - Updated

This is an update to the already improved Cloud Firewall Dashboard that was uploaded last year. I've made a few tweaks to improve the filtering for more efficient usage. This improves upon the Cloud Firewall Discovery dashboard in the Netskope Library by now having users, traffic, policies, top allowed protocols, top blocked protocols, top users and source IP for allowed and blocked traffic, top blocked DNS domains, top users with blocked DNS domains, top DNS allowed domains, etc. You can now filter all of the data or different widgets independently depending on your needs:More visibility into DNS specific activities, especially if you're using Cloud Firewall's DNS Security:Give it a try!  

2124
qyost
2 months ago
C
cswordNew Member III
posted in Discussions

Reporting on device "Last Event: User Disabled" events

I want to generate a weekly report using Advanced Analytics that shows a list of users and timestamps when a user disables the Netskope Client. I see we can filter this on the Security Cloud Platform > Netskope Client.> Devices page by adding a filter: "Last Event: User Disabled" so I looked for this in the Advanced Analytics Explore page but couldn't locate anything. Is this currently possible with the Data Collection options we currently have? Or does a new data collection option feature need to be added for device events to accomplish this?  While we have the user disable option turned off for most staff, this would be a helpful way for us to track down users who are turning the client off for various issues and are not vocal about the problems they are having. This would be super helpful on our road to complete org-wide client tamper-proofing.  Thanks!

2
qyost
2 months ago
P
Netskope Partner
Paradox07Netskope Partner
asked in Discussions

I am facing issues while provisioning user groups to netskope console from OneLogin

Hi Everyone,While provisioning users from OneLogin to netskope console, I am facing issues when I try to fetch groups. I have successfully provisioned users by following the given document: https://docs.netskope.com/en/netskope-help/integrations-439794/provisioning-and-authentication/user-and-user-group-provisioning-with-onelogin But when it comes to provision groups I am unable to find a way to achieve the same.If there are any ways or documentation kindly let me know.

1
S
Netskope Employee
2 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

January 2024 Office Hours Recap

Hello Folks,    Below you can find a recap of questions asked at the January office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar!   Q: I’d like to know which recommended training we should take in a structured manner to get started with Advanced Analytics. A: We highly recommend starting with the NAA Training Resources post in our community. The post points you to a list of resources which can help you quickly get started with Advanced Analytics. If you are looking for some recommended dashboards to start with, the NAA Top Dashboards post will be a good choice.   Q: I want to make sure we are using Netskope products effectively. Can I leverage Advanced Analytics on this? A: Yes. The CASB & NG-SWG Operationalization Dashboard are two good starting points. With focus on CASB & NG-SWG, these

0
Aaron_Zhang
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Discussions

Office Hours: Advanced Analytics

Join Aaron Zhang, Analytics Specialist at Netskope for a conversation on how to get actionable insights with data and analytics about your environment, security posture and risk exposure. Bring your questions on Advanced Analytics and get step-by-step answers using a live Netskope environment.   This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences.   Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

0
kvarshney
Netskope Employee
3 months ago

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
Show all badges
Terms & ConditionsCookie settings