Advanced Analytics

  Hello Folks,    Below you can find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar!   Q: How do I leverage Advanced Analytics for threat hunting activities?  A: Check out some blogs recently posted by Netskope’s internal security team including:  The Threat Hunting Process Threat Hunting: Suspected Shell Traffic in Advanced Analytics Investigating .zip and .mov top-level domains   Q: I’m new to Advanced Analytics. How and where can I start my journey? A: Netskope Advanced Analytics - Getting Started will help you get started in about 5 minutes. For a more indepth getting started guide, check out our recent webinar Getting Started with Advanced Analytics.   Q: How can I leverage Advanced Analytics to properly measure policy e

Web shells are commonly used by threat actors as part of the command and control phase of a cyberattack. These shells can be custom code and used by common C2 frameworks such as Cobalt Strike or be generated as a default payload in exploitation frameworks such as Metasploit. With this comes a challenge to security professionals on how to detect, mitigate, and hunt these shells that may be generated by an adversary during an attack. Netskope’s Advanced Analytics can be used in combination with Netskopes Cloud Firewall to create a dashboard that provides insight into where potential shell traffic is occurring within an organization's environment.    Uploaded with this community post is a Netskope Advance Analytics Dashboard that provides broad insight into where these potential shells may be occurring within an organization's environment.    The first Widget in the dashboard is the Ping dashboard. This shows ping traffic within the organization's environment. Dependin

  As an essential feature of Advanced Analytics, adding "links" to a dashboard helps users precisely locate particular content. Simply by clicking the keyword with a URL attached, users will be directed to the webpage linked.   A link can be added in several ways. The easiest way is typing the syntax "[Keyword](URL)." By doing so, the webpage will be opened in the current window when users clicking the keyword.    However, this method does not work properly sometimes, and may give you the error message shown below.   To avoid the error, the best way is having the URL linked and opened to a new tab, not in the current window. The syntax template in this case is "<a href="URL" target="_blank">Keyword</a>."    By doing so, the webpage linked will then be opened in a new tab when users clicking the keyword.   A sample dashboard is also attached below. Feel free to let us know if you have any questions on this topic. Happy to help

  Hello Folks,    Below you can find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar!   Q: I’m new to Advanced Analytics. How and where can I start my journey? A: Netskope Advanced Analytics - Getting Started will help you get started quickly. More details can be found from our YouTube Channel. We highly recommend starting with existing dashboards, either in the library or community. Tags can help you find dashboards you are interested in. You can explore any dashboards based on your needs, and customize them in your environment. You can also find tons of resources (e.g., hot topic discussion, dashboard intro, and upcoming AA events, etc.) here on the Netskope Community. On July 13th, 2023, we will be hosting a “Getting started with Advanced Analytics”

Hello Everyone!   I'm passionate about ensuring our customers see value from the data and analytics provided by Netskope Advanced Analytics. Please take this survey and share how this tool has helped identify gaps and improved your environment!   We use a platform called UserEvidence to collect this feedback. In return for your insights we will send you a $25 digital gift card or charity contribution for your time. This is completely optional, but something we like to include to say thank you.    Surveys submitted prior to July 1st, will be eligible for this incentive. 

In some organizations it is important to understand what new applications users are using in the environment. New applications can pose certain risks (e.g. new apps used for PDF conversion or translation could inadvertently cause data loss), and they may also introduce redundancy and inefficiency (e.g. if someone starts using a new collaboration app, but the organization already has a company sanction app that is being paid for).  The dashboard attached helps organization identify new apps and ones no longer in use.  It consists of 2 view, one for new applications in the last 30 days:  and one for application not used in the last 30 days:  Important Notes: Advanced Analytics has a 5000 row limit. In organizations with more than 5000 applications, results will be unreliable. The general recommendation would be not to use this dashboard. If you have a high need for this information and have over 5k apps, please reach out to us for an alternate solution.  For this dashboard, to give relia

Provide analytics on logs/data gathered via Discovery. Including a view of Shadow IT and application Risk. While it can be used with Inline NS products it was inspired by clients that just leverage Discovery & Risk Insights.

I've put together a quick map visualization, but I am not able to manipulate it in the manner I'd like to. The editing options have a lot of control over how the points at the end of the line display, but I'm not really interested in the ends.   Instead, I'd like to change how the lines are displayed.  Am I overlooking something, or should I open an Enhancement Request to expose formatting controls for the lines themselves?Specifically, I would like to color the line one end based on a string value associated with one of the points.

Several of the examples in the Netskope Library with Word Clouds visualization are for Justification.  As these are largely user-generated, they tend to be nearly universally unique.  Has there been any consideration of tokenizing these into either individual words (discarding filler words) or shorter phrases?   A drill-in on these could then expose the justifications that contain the selected word/phrase.

  Hello Folks,    Below you can find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events calendar!   Q: I’m new to Advanced Analytics. How and where can I start my journey? A: Here is a link to a helpful video on how to get started quickly https://www.youtube.com/watch?v=R1X131ouyY0. We highly recommend starting with existing dashboards, either in the library or community. Tags can help you find dashboards you are interested in. You can explore any dashboards based on your needs, and customize them in your environment. You can also find tons of resources (e.g., hot topic discussion, dashboard intro, and upcoming AA events, etc.) here on the Netskope Community. Feel free to let us know if you need any help!   Q: What reports can be used to show executives a sum

TL;DR Use dashboard filters to reduce data volume being loaded all at once (i,e. Date range, Category, User Group) Dashboards will load slow if they contain a lot of widgets; for best performance, keep widget count < 15 when creating dashboards Dashboards with custom fields and advanced features such as merged results and pivot will take longer to load Large number of data attributes/columns will affect dashboard loading time   The most important element of dashboard performance is the underlying SQL query performance. Each widget on the dashboard runs a SQL query that takes time to execute on the underlying database. Below are some considerations for creating performant dashboards or widgets:   Data volume has the greatest impact on performance. The more data that is returned in a widget on the dashboard, the more memory resources will be consumed. Widgets returned with many thousands of data points will use more memory. Utilize filters to limit size of data or rows of

UEBA/UBA policies and alerts help you flag anomalous and/or suspicious user behavior in your environment. The dashboard below helps you get visibility into this behavior.    High level counts give you a sense for the number of apps, users and total alerts:    Understand top UEBA policies:  Top Users triggering UEBA:  Trend over time:      And more:   

Hi Everyone,    This dashboard is ideal for looking at a specific policy which involves allows users to Proceed and enter justifications. With this dashboard you can answer the following questions: How many users actually triggered the policy Among those who triggered the policy: How many chose to proceed ? How many stopped? What were their justifications  

In Netskope R103, the UI for Advanced Analytics has a brand new look, and we think you’ll like it. That’s because based on the feedback from our user community, we’re making it easier for you to get the information you need, in a very personalized way. In some cases, we are adding new capabilities, such as the Persona profile so that you can quickly get information relevant to your job. In other areas, we’ve added quality of life improvements which makes many Advanced Analytics capabilities easier to find and use, such as favorite dashboards and counters to identify how many times a dashboard has been run.   The most immediate change you’ll notice is that Advanced Analytics now has an Overview page. In the past, admins would go directly to an Advanced Analytics submenu item, such as Netskope Library, directly from the UI (don’t worry, this functionality is still here, if that’s what you’d like to do). What’s changed is that there is now an Overview page, which taps into what you

Hello Folks,    Below you will find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events calendar!   Q: How can I start to edit/customize a dashboard? A: Before customizing a dashboard, please copy and save the dashboard to your personal or group folder. To do this, click on the 3-dot button and then hit “Copy.” You can then select the destination folder with the dropdown menu (personal/group). By hitting “COPY HERE,” the dashboard will be saved to your selected folder. You can then find and start to edit the dashboard.     Q: What reports can be used to show executives a summary of cloud usage, threat, and risk assessment, etc.? A: “CISO dashboard” and “Cloud Risk Assessment - QBR” dashboard are 2 good options. You may also use the “Industry Benchmarks” das

The dashboard attached had the following views that have been created or moved up from a different position in the previous dashboard. Here are the highlights of these views and their significance.    The top level numbers tell you how many open incidents there are in the environment, for a given time period. Also listed a % unassigned, and # of assignees.      Another powerful view is the incident status by policy. This view is great for tuning, for example to identify policies that have high rates of false positives:      Check out the rest of the dashboard by downloading a sample PDF export or the dashboard template , which you can upload into your own environment, both available below.