• Home
  • Advanced Analytics

Advanced Analytics

Advanced Analytics helps organizations understand and manage their exposure to cloud risks by providing a 360° view of activity throughout the Netskope platform.

123 Topics

M
Netskope Employee
mnekkarNetskope Employee
published in Dashboard Gallery

Data Flow Investigation Dashboard

This dashboard gives a view of how data is moving in your organization. It allows you to filter for a specific application, user, or activity. Using this dashboard, you can answer questions like: Who are the top users moving data and where are they moving the data to? Who is uploading or downloading data into specific applications, such as Box?  What are the activities taking place in a specific application, such as Google Drive? Where is a specific user moving data from and to?  Also, the dashboard’s Sankey Chart allows you to understand how data is flowing from the user to the action. You can see the flow from user to from user to application to instance to activity to action. The best use for this widget is to filter for a specific user to see what data they are moving and to where.The dashboard is attached below. Feel free to view it in your own environment and share any comments/feedback. Please also let us know if you want any additional fields/data to be added to the dashboard.

1210
M
Netskope Employee
14 days ago
T
TKO3SonsNew Member III
asked in Discussions

Issues with Advanced Analytics pulling 90 days

Has anyone else ran into issues with the Advanced Analytics attmpting to pull informaiton for 90 days?  I’m attempting to pull reports for the previous quarter, but i’m running into charts that appears to be missing information going back that far.   

1
2
16 days ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions

June 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the June office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: What are the benefits of using Advanced Analytics?A: Advanced Analytics enables you to gain valuable insights and present them effectively to your leadership. It provides visibility into your environment, helping you understand how Netskope is protecting you. With Advanced Analytics, you can identify risks in your environment and learn how to address them. To get started, refer to Advanced Analytics Training Resources. Q: How to accurately report on user activities with Advanced Analytics?A: There are several ways to do this. One effective method is to utilize the Netskope Library dashboard resources. You can search “user” in the dashboard name search bar or select the “Users” tag. The User

0
lzhi
Netskope Employee
25 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Security Health Check (Self-Service) Dashboard

 Looking to quickly pinpoint the security concerns in your environment? Take a look into our Security Health Check (Self-Service) Dashboard!  This is a one-stop dashboard which allows you to perform self-service health checks and to locate security concerns/gaps in your environment. The dashboard is expanded from 2 dimensions: 1) How Netskope is protecting your environment; 2) What Netskope is protecting your environment from.  The dashboard covers 9 major topics, which helps you identify & investigate: NewEdge Network & Traffic SteeringPOP utilization in restricted regions Unexpected access methods Device & Client ManagementUsers disabling Netskope Client Old/unsupported Client versions being used Alerts & PoliciesAlerts, alert types, policies triggered Top users triggering alerts (and the corresponding activities) SSL/TLS InspectionLow SSL inspection rate Unexpected bypassed traffic Coaching PoliciesIncorrect/unexpected coaching policies detected Justification reasons

3270
Aaron_Zhang
Netskope Employee
28 days ago
M
munster
asked in Discussions

Issue Password for Single User to Uninstall Agent

HiWe have users in “All Users” group in Client Configuration.  They are password protect from client installation.However, I have to issue the password to 1 user to uninstall password which means all other users can also uninstalled with this password.  Is there anyway just generate 1 time password for that user to uninstall without having to share the actual “password ptotect client uninstallation”? thx

1
ejang
Netskope Employee
29 days ago
W
wilsonExplorer III
asked in Discussions

Page events source CIDR Field question: Multiple CIDR

Within AA page events, is there a way to have multiple CIDR?  I heard that commons work, I heard that you can add the field multiple times, but neither seems to work for me.  Screenshot attached.

2
Aaron_Zhang
Netskope Employee
1 month ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Identify Office Locations by Source IP Addresses

  This dashboard helps you understand if individuals in your organization are working at the assigned office locations by converting Source IP Addresses to Office Locations.    Let's take a look at a sample use case. When doing budget planning for next year, Netskope wants to understand how many of their employees are working at the office on a weekly basis. Source IP is a good starting point, but Netskope is looking for a better view into the exact "office name" for each IP. This dashboard can help!   In the edit mode of the first widget "User Source Locations," we can find the custom dimension "Office Location" by expanding the "Custom Fields" section on the left hand side.   This custom dimension converts Source IP to the corresponding Office Location. By clicking "Edit," we will then be able to further customize it based on our needs.    Here, we have Source IP = 104.x.xx.xxx with the corresponding Office Location = STL Office. In this case, if

2832
W
1 month ago
ematchey
Netskope Employee
ematcheyNetskope Employee
published in Dashboard Gallery

Updated NG-SWG Health Check Dashboard

 An updated version of the NG-SWG Health Check dashboard is now available! The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the NG-SWG product. Below you will find a breakdown of some of the views in this dashboard.  The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.    Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.   Please Note: Customization is required for the “% of Users Protected”. Use the f

7152
ematchey
Netskope Employee
1 month ago
C
cjcarewNew Member
asked in Discussions

V2 API Pagination

Hi Folks,Apologies if this is a simpleton question, however it’s doing my head in. I have the api working and am able to use the dataexport endpoint to extract malware alerts. My issue is that I only receive one record in the response and I know there is 115 in the time period of the search. The record I receive is the very first in the results. I can confirm that by checking in the console.My (hopefully simple) question is what is the format of the api query to iterate through the results so that the full list can be retrieved? I’ve tried ?operation=next&index=(the index name supplied in the first query). However that returns an empty response.I’d appreciate any guidance.Regards,Campbell

0
C
1 month ago
C
cswordNew Member III
asked in Discussions

Exporting platform audit log data with AA

I’m curious if Netskope platform audit log data can be exported using Advanced Analytics or put on the road map? It would be helpful to generate reports for events such as Create/Delete Admins, tunnel modifications, and other events.  This arose from a recent PCI audit (looking forward into PCI 4.) where logs related to VPN access must be reviewed (and eventually ingested into SIEM or similar platform to search for anomalies) and immediately searchable up to 90 days and stored for 1 year.  Thanks!

1
mjrgg
Netskope Employee
1 month ago
B
BLAY5050New Member
asked in Discussions

Explicit Proxy Root Certificate

Does anyone know where the Netskope root certificate needs to go in Windows to use the explicit proxy? I assume it needs to go in the certificate store but is there a location? Thanks. 

3
W
1 month ago
W
wilsonExplorer III
asked in Discussions

Advanced Analytics and categories

In Advanced Analytics Application Events, it is possible to list out the primary category and the “other category” of sites”.However, page events does not have the “other category field” Questions: Is there any plan to bring these to into parity? Is there any other way to get the primary/secondary categories as it relates to a page events, or do I have to wait until Tenant version 116  new feature API and do a conversion manually?

0
W
1 month ago
lzhi
Netskope Employee
lzhiNetskope Employee
published in Discussions

May 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the May office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: I’d like to learn more about AI usage.A: The AI Usage Dashboard can help. This dashboard shows the AI usage in your environment and helps you to see what, if any, controls are in place to control AI traffic. You can use the Application filter at the top of the dashboard to dive into a specific application. The AI Usage with App Instances dashboard would also help. This dashboard provides additional visibility into the App Instances used to access AI Apps/Sites in the environment, which helps identify if the Corporate Instances are used for AI Usage. Q: Is there info from Advanced Analytics that I can extract from SkopeIT events and web transaction logs?A: Yes. Most of the data from Skope IT

460
lzhi
Netskope Employee
1 month ago
aramachandran
Netskope Employee
aramachandranNetskope Employee
published in Dashboard Gallery

Users located in Risky Countries

Despite the chagrin of employees, Return to office (RTO) is the rage these days. Employees are expected to work from their designated locations, and not expected to work from a beach in the Bahamas (say), when they had promised the employer that they would be working from the corporate office located in Miami.  Why is this important? - Potential violation of contractual agreements, tax purposes, and of course - security and handling of sensitive information. Now how do you determine if a user is not flouting company rules and working from unapproved locations ? Netskope can help you here, by alerting you on the source location of end-users via UEBA policies and visualizing them using an Advanced Analytics Dashboard(NAA).   We have pre-populated standard UEBA policies that can generate alerts when users work from ‘risky countries’ - (you can append the default list in the policy and add to it countries you do not want people to work from)Visualizing the alerts generated is simple using

1560
aramachandran
Netskope Employee
2 months ago
E
elawaetzExplorer III
asked in Discussions

Cloud Exchange Logshipper Syslog integration with Darktrace?

Has anyone had any luck with Syslog integration from Cloud Exchange into Darktrace?Darktrace describes the expected format like this:Darktrace expects the Netskope Web Gateway data to include the string "darktrace_netskope" followed by a JSON formatted representation of the Netskope logging. The order of fields within the JSON is not important. For example: darktrace_netskope {"src_time": "Fri Jan 1 00:10:00 2021","userkey": "user.name@company.com","dst_region": "Region","category": "Business","src_longitude": 52.2,"transaction_id": 0,"ur_normalized": "user.name@company.com","src_latitude": 0.12,"dst_longitude": 52.2,"domain": "www.example.org","dst_zipcode": "555555","access_method": "Client","src_timezone": "Global/UTC","ccl": "unknown","bypass_reason": "SSL policy matched","user_generated": "yes","dst_country": "ZZ","srcip": "198.51.100.1","site": "example","traffic_type": "Web","src_region": "Region","user": "user.name@example.org","appcategory": "Business","page_id": 0,"insertion_

10
Gary-Jenkins
Netskope Employee
2 months ago
D
dazmacmainNew Member III
asked in Discussions

How Can I Improve Netskope's Performance?

I have just started a new company.We have brand new Cisco Cat 9500 and 9300 MGig switches. With Netskope installed on our computer have run a speed test and getting 100Mbps connected to the Internet with Netskope enabled.  With Netskope disabled we are getting speeds of up to 700Mbps connected to the internet. Is there a reason why this is so slow, has it got to do with deep packet inspection? Can anything be done to speed this up? I am new to Netskope and our security team are in charge of this. 

2
N
2 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions

April 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the April office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Can I get visibility into geolocation data in Advanced Analytics?A: Absolutely. We have 3 main use cases on geolocation data:PoP Usage Dashboard: This dashboard provides insights into Netskope Host Points of Presence (PoPs) detected in your environment, along with users connected. It helps you identify un-allowed PoP usage.  # Consecutive Days Outside a Specific Region Dashboard: This dashboard returns the number of consecutive days a user's source country is outside a designated region. Use this dashboard to monitor and manage sensitive data movement outside the user’s assigned region. Office Locations Dashboard: Use this dashboard to gain insights into whether individuals within your org

0
lzhi
Netskope Employee
2 months ago
M
matheusfNew Member III
asked in Discussions

Filtering and Counting Files by Extension in Netskope

Hi everyone,I'm looking for a way to create a filter in Netskope that focuses only on the file extension, disregarding the full file name.Objective:My goal is to analyze the volume of files with specific extensions that are being used in our environment. For example, I have a list of extensions like .csv, .xls, and .jpg, and I want to understand how many files of each type are being accessed.Challenge:In Advanced Analytics, I can only see the complete object name. I'd like to know if it's possible to create a custom field that captures only the file extensions. This would allow me to count and visualize the volume of each file type in a dashboard or report.Example:An ideal report would display the volume of files per extension over a specific period. For instance, in the last 7 days, there were 50 .pdf files uploaded, 20 .xls files, and 2 .jpg files.I hope I have explained my need clearly. Any help or suggestions would be greatly appreciated!

2
M
3 months ago
bob
Netskope Employee
bobNetskope Employee
published in Dashboard Gallery

Employee Flight Risk Dashboard

Here is an Advanced Analytics dashboard that predicts when employees are planning to leave the company. Multiple signals are used to make the prediction including:- Visits to career sites- Visits to competitor job sites- Uploads of resume data to webmail- Suspicious data movement from corporate to unsanctioned apps- Bulk downloads of data to corporate appsTo fill in this dashboard the following config will need to be in place:1. Policy to alert when visiting (all activities) with destination ‘Job Search/Career’ category2. Policy to alert when visiting (all activities) with destination a custom web category that includes competitor job sites3. DLP policy to alert when resume data is uploaded to webmail category (use ML classifier for resume)4. UEBA policy and config for suspicious data movement (need to identify corporate apps)5. UEBA policy to detect bulk downloads of dataThanks to @Aaron_Zhang for helping to build out the dashboard components.  

5724
sfaeder
3 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Device Client Overview Dashboard

Netskope Advanced Analytics makes device data collection available for analysis through the latest Device Client Overview Client Dashboard. The dashboard helps you better understand and manage the deployment of Netskope Client in your environment. Some of the key metrics captured by this dashboard include:Getting an aggregated view of the number of corporate-managed devices that have installed the Netskope Client, and insights into the status of devices with the Client enabled, disabled, or uninstalled Understanding the trends of Client version updates over time and determining how many devices are on unsupported, supported or golden release versions Identifying devices disconnected for a long period of time Investigating and troubleshooting users’ Client activities by leveraging historical data Use this dashboard to enhance your device security posture, generate comprehensive risk insights, perform compliance assessments based on your corporate policies, and implement greater control

12224
B
3 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

Swap data using table calculations

Recently, one of our customers who is leveraging risk insights for log ingestion ran into a problem. For certain dates of the month (April 14 & 15), the ingestion swapped "Bytes Uploaded" and "Bytes Downloaded." How can they leverage Advanced Analytics to swap the data back so that their monthly reporting would be accurate? Here is one solution with Table Calculations.  The first step is to create a Custom Dimension with command: concat(${page_event.event_timestamp_date},"")  This converts the format of all “Event Dates” from “Timestamp” to “String,” which helps avoid potential errors in our Table Calculations. We name the dimension Event Date - String and then save it. The second step is to create Table Calculations which swap the data for particular dates (April 14 & 15 in this case). Let’s start with the Table Calculation swapping “Bytes Uploaded” to “Bytes Downloaded.” We create a Table Calculation with command: if(  ${event_date_string}="2024-04-14"  OR  ${event_date_strin

0
Aaron_Zhang
Netskope Employee
3 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions

March 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the March office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: How to better analyze and manage GPT traffic using Advanced Analytics?A: We recommend starting with the AI Usage Dashboard in Netskope Library, which helps you understand how AI apps & sites (e.g. ChatGPT) are being used in your organization. You can also find an updated version of the AI Usage Dashboard in Netskope Community. This version provides additional visibility into App Instances, which helps you identify if your Corporate Instances are exposed with AI usage. Q: How can we combine reports to see data being uploaded to risky applications and to understand their CCL?A: The Application Risk Management Dashboard is a great starting point for this use case. The dashboard helps you

0
Aaron_Zhang
Netskope Employee
3 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Application Risk Management

This dashboard aims to surface the application risk in your environment. Use the dashboard to better understand:What applications are being used in your environment Are any of them unmanaged, untagged, or risky Is there any sensitive or risky data movement through these applicationsLet’s take a look in our demo environment. The dashboard starts with a summary of applications being used. Here we can see 295 applications are detected, and 275 of them are unmanaged. Out of these applications, we can get visibility into how many of them are rated as “excellent,” “high,” “medium,” “low,” and “poor” in terms of risk (Cloud Confidence Level). This will help us decide how many “risky” and “less risky” applications are being used in our environment. In the meantime, we can also see how much data is moving to these “risky” and “less risky” applications. The dashboard then provides detailed information about risky applications and traffic detected, which allows us to perform deep investigations o

2820
Aaron_Zhang
Netskope Employee
3 months ago
ematchey
Netskope Employee
ematcheyNetskope Employee
posted in Dashboard Gallery

NG-SWG Operationalization Dashboard

The purpose of this dashboard is to help you maximize the ROI of your Netskope investment by highlighting ways to ensure you are using Netskope to it's full potential. The specific focus of this dashboard is operationalization of the NG-SWG product. Below you will find a breakdown of some of the views in this dashboard.    The first set of widgets focus on the NewEdge network and the POPs in use by your organization. These views help you determine if you need to optimize your POP selection settings.        Next you can see the number of users protected and steering methods used. Are the total users protected close to 100% of your organization size? Do you see the expected # of users protected? Are the access methods listed the expected ones? If not, these are red flags and we encourage to check the recommendations to resolve your issue.    After making sure the users are adequately covered, it is important to ensure that traffic is being inspec

2
ematchey
Netskope Employee
4 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Dashboard Gallery

Updated Application Category Dashboard

This dashboard provides detailed visibility into the application categories detected in your environment, including:Top used applications, both managed and unmanaged, in each category Risky applications, traffic, & data movement in each category Application instance tags Policies & alerts triggered by applications in each categoryUse this dashboard to:Better understand top used applications in each category to reduce app redundancy Identify the usage of unmanaged & risky applications in each category Monitor sensitive & risky traffic/data movement in each category The dashboard is attached below. Feel free to download and view it in your own environment. Let us know if you have any questions!

2450
Aaron_Zhang
Netskope Employee
4 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings