Advanced Analytics

Several of the examples in the Netskope Library with Word Clouds visualization are for Justification.  As these are largely user-generated, they tend to be nearly universally unique.  Has there been any consideration of tokenizing these into either individual words (discarding filler words) or shorter phrases?   A drill-in on these could then expose the justifications that contain the selected word/phrase.

  Hello Folks,    Below you can find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events calendar!   Q: I’m new to Advanced Analytics. How and where can I start my journey? A: Here is a link to a helpful video on how to get started quickly https://www.youtube.com/watch?v=R1X131ouyY0. We highly recommend starting with existing dashboards, either in the library or community. Tags can help you find dashboards you are interested in. You can explore any dashboards based on your needs, and customize them in your environment. You can also find tons of resources (e.g., hot topic discussion, dashboard intro, and upcoming AA events, etc.) here on the Netskope Community. Feel free to let us know if you need any help!   Q: What reports can be used to show executives a sum

TL;DR Use dashboard filters to reduce data volume being loaded all at once (i,e. Date range, Category, User Group) Dashboards will load slow if they contain a lot of widgets; for best performance, keep widget count < 15 when creating dashboards Dashboards with custom fields and advanced features such as merged results and pivot will take longer to load Large number of data attributes/columns will affect dashboard loading time   The most important element of dashboard performance is the underlying SQL query performance. Each widget on the dashboard runs a SQL query that takes time to execute on the underlying database. Below are some considerations for creating performant dashboards or widgets:   Data volume has the greatest impact on performance. The more data that is returned in a widget on the dashboard, the more memory resources will be consumed. Widgets returned with many thousands of data points will use more memory. Utilize filters to limit size of data or rows of

UEBA/UBA policies and alerts help you flag anomalous and/or suspicious user behavior in your environment. The dashboard below helps you get visibility into this behavior.    High level counts give you a sense for the number of apps, users and total alerts:    Understand top UEBA policies:  Top Users triggering UEBA:  Trend over time:      And more:   

Hi Everyone,    This dashboard is ideal for looking at a specific policy which involves allows users to Proceed and enter justifications. With this dashboard you can answer the following questions: How many users actually triggered the policy Among those who triggered the policy: How many chose to proceed ? How many stopped? What were their justifications  

In Netskope R103, the UI for Advanced Analytics has a brand new look, and we think you’ll like it. That’s because based on the feedback from our user community, we’re making it easier for you to get the information you need, in a very personalized way. In some cases, we are adding new capabilities, such as the Persona profile so that you can quickly get information relevant to your job. In other areas, we’ve added quality of life improvements which makes many Advanced Analytics capabilities easier to find and use, such as favorite dashboards and counters to identify how many times a dashboard has been run.   The most immediate change you’ll notice is that Advanced Analytics now has an Overview page. In the past, admins would go directly to an Advanced Analytics submenu item, such as Netskope Library, directly from the UI (don’t worry, this functionality is still here, if that’s what you’d like to do). What’s changed is that there is now an Overview page, which taps into what you

Hello Folks,    Below you will find a recap of questions asked at the office hours sessions last week and those sent in that we were not able to cover at the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events calendar!   Q: How can I start to edit/customize a dashboard? A: Before customizing a dashboard, please copy and save the dashboard to your personal or group folder. To do this, click on the 3-dot button and then hit “Copy.” You can then select the destination folder with the dropdown menu (personal/group). By hitting “COPY HERE,” the dashboard will be saved to your selected folder. You can then find and start to edit the dashboard.     Q: What reports can be used to show executives a summary of cloud usage, threat, and risk assessment, etc.? A: “CISO dashboard” and “Cloud Risk Assessment - QBR” dashboard are 2 good options. You may also use the “Industry Benchmarks” das

The dashboard attached had the following views that have been created or moved up from a different position in the previous dashboard. Here are the highlights of these views and their significance.    The top level numbers tell you how many open incidents there are in the environment, for a given time period. Also listed a % unassigned, and # of assignees.      Another powerful view is the incident status by policy. This view is great for tuning, for example to identify policies that have high rates of false positives:      Check out the rest of the dashboard by downloading a sample PDF export or the dashboard template , which you can upload into your own environment, both available below.   

The goal of this dashboard is to help you operationalize the Netskope solution. The first step is to tag your corporate-IT Managed applications and to name your instances. This dashboard will: Tell you which applications and instances have already been tagged or named. Show the top unmanaged applications in your environment and suggest these for tagging Show the application instances that appear to be corporate instances and suggest these for tagging Highlight possible gaps in your environment by showing high usage Unmanaged applications and instances Why is this important? Tagging applications and naming application instances allows you to build policies that target applications based on their managed/unmanaged and app name status. For example, you can disallow uploads to unmanged applications or block access to non corporate instances of applications like Google Drive.

I often find that knowing the host portion is much more useful than knowing the full URI of the referer, and trying to squeeze the full URI onto a widget can get cluttered real fast.    substring(substring(${app_event.referer},position(${app_event.referer},"//")+2,length(${app_event.referer})),0,position(substring(${app_event.referer},position(${app_event.referer},"//")+2,length(${app_event.referer})),"/")-1) That custom field could be simplified by referencing other custom fields containing substrings of the URI, but the version above is fully self-contained.

This dashboard gives a view into Corporate vs. Personal Application instances observed on the tenant. This information can be used to: identify unsanctioned data movement to personal instances understand how users are using personal and corporate instances understand the controls in place for instances and the effectiveness of controls to limit personal instance use (trend over time) get detailed information on specific corporate and personal instances To Use: To look at all applications and all instances, simply view the dashboard as is. To view the dashboard for a specific application, e.g. OneDrive, use the dashboard level filter above to select the application of interest and refresh the data.   Please Note: Personal instances are currently defined as all those containing “Netskope”, case insensitive. If using this dashboard on a different tenant please update the custom dimensions in the widgets below.

Knowledge is power…be it for use in parenting, cyber security or anything else. That said, knowledge is not all about getting a million data points, it’s about extracting insight out of them. Check out my Netskope blog post, in which I share some of my experiences getting actionable insights for security teams!   https://www.netskope.com/blog/data-insights-for-parenting-and-cybersecurity-teams  

I was trying to correlate and troubleshoot a sporadic issue I had noted for a very small number of our users. However, while I was able to geographicly correlate them, this is largely insignificant.  What I think would have been a more interesting piece of data to have included in the visualization is the user's presumed ISP.  Is this already being gathered via DNS when you retrieve the geolocation records, and just not available to us in DEM?  If so, can it be exposed? 

DLP incidents for Netskope Advanced Analytics are here! The documentation is live here: Advanced Analytics Incidents. The release notes are here: Advanced Analytics Incidents.   Key Features Incidents Data Collection (Explorer) DLP Incidents Status Monitoring (Netskope Library) Key Benefits Monitor Security Operations: Security incidents should be handled or mitigated in a timely manner. Advanced Analytics helps organizations see aggregated views of DLP incidents in order to get visibility into resolution. Identify process bottlenecks: With Advanced Analytics, organizations can dive into incident process workflows to identify and address bottlenecks. Identify frequent offenders: Advanced Analytics provides a summary view of DLP incidents, making it easier to spot the individuals and groups that need coaching. Communicate KPIs with upper management: CISOs need summary views to identify the problems in their security program. Submit your feedback via&nbs

This dashboard allows you to track how much traffic is being sent for remote browser isolation, the trend over time, and the details behind this traffic.

Join Elena Matchey, Head of Analytics at Netskope for a conversation on how to optimize security operations with pre-built and custom data analysis tools. Bring your questions on Advanced Analytics and get step-by-step answers from a live Netskope environment. Register Here. This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences. Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

Can the data stores behind DEM be exposed to clients who have both DEM and AA?   It's quite obvious that AA is driving the data presentation of DEM, to the point that a DEM folder was appearing in the Netskope Library of AA for a while.   But (unlike other Netskope provided AA reporting) we unable to copy and tune many of those reports.  Additionally, we are not able to explore the data to find stats meaningful to us.

This dashboard gives an overview of user activities in non work-related categories (i.e. #hours spent on social apps). Use this dashboard to...    Understand trend of Users and Time spent in non-business categories:  Analyze top categories where users are spending time:  Visualize trend of business vs. non-business time spent in apps:  Filter on a particular user or set of users:    And More!  

Use this dashboard to understand the allowed data movement to unmanaged applications and non-corporate instances.  Specifically, gain visibility into the following : Allowed Data Movement with DLP Violations Allowed Data Movement (with or without DLP Violations) A View into Managed and Unmanaged Applications & Instances Some example insights below.  Identify uploads to personal instances Understand activity in unmanaged applications that is allowed and has associated data movement:    Drill to see the details: