Advanced Analytics

The goal of this dashboard is to help you operationalize the Netskope solution. The first step is to tag your corporate-IT Managed applications and to name your instances. This dashboard will: Tell you which applications and instances have already been tagged or named. Show the top unmanaged applications in your environment and suggest these for tagging Show the application instances that appear to be corporate instances and suggest these for tagging Highlight possible gaps in your environment by showing high usage Unmanaged applications and instances Why is this important? Tagging applications and naming application instances allows you to build policies that target applications based on their managed/unmanaged and app name status. For example, you can disallow uploads to unmanged applications or block access to non corporate instances of applications like Google Drive.

I often find that knowing the host portion is much more useful than knowing the full URI of the referer, and trying to squeeze the full URI onto a widget can get cluttered real fast.    substring(substring(${app_event.referer},position(${app_event.referer},"//")+2,length(${app_event.referer})),0,position(substring(${app_event.referer},position(${app_event.referer},"//")+2,length(${app_event.referer})),"/")-1) That custom field could be simplified by referencing other custom fields containing substrings of the URI, but the version above is fully self-contained.

This dashboard gives a view into Corporate vs. Personal Application instances observed on the tenant. This information can be used to: identify unsanctioned data movement to personal instances understand how users are using personal and corporate instances understand the controls in place for instances and the effectiveness of controls to limit personal instance use (trend over time) get detailed information on specific corporate and personal instances To Use: To look at all applications and all instances, simply view the dashboard as is. To view the dashboard for a specific application, e.g. OneDrive, use the dashboard level filter above to select the application of interest and refresh the data.   Please Note: Personal instances are currently defined as all those containing “Netskope”, case insensitive. If using this dashboard on a different tenant please update the custom dimensions in the widgets below.

Knowledge is power…be it for use in parenting, cyber security or anything else. That said, knowledge is not all about getting a million data points, it’s about extracting insight out of them. Check out my Netskope blog post, in which I share some of my experiences getting actionable insights for security teams!   https://www.netskope.com/blog/data-insights-for-parenting-and-cybersecurity-teams  

I was trying to correlate and troubleshoot a sporadic issue I had noted for a very small number of our users. However, while I was able to geographicly correlate them, this is largely insignificant.  What I think would have been a more interesting piece of data to have included in the visualization is the user's presumed ISP.  Is this already being gathered via DNS when you retrieve the geolocation records, and just not available to us in DEM?  If so, can it be exposed? 

DLP incidents for Netskope Advanced Analytics are here! The documentation is live here: Advanced Analytics Incidents. The release notes are here: Advanced Analytics Incidents.   Key Features Incidents Data Collection (Explorer) DLP Incidents Status Monitoring (Netskope Library) Key Benefits Monitor Security Operations: Security incidents should be handled or mitigated in a timely manner. Advanced Analytics helps organizations see aggregated views of DLP incidents in order to get visibility into resolution. Identify process bottlenecks: With Advanced Analytics, organizations can dive into incident process workflows to identify and address bottlenecks. Identify frequent offenders: Advanced Analytics provides a summary view of DLP incidents, making it easier to spot the individuals and groups that need coaching. Communicate KPIs with upper management: CISOs need summary views to identify the problems in their security program. Submit your feedback via&nbs

This dashboard allows you to track how much traffic is being sent for remote browser isolation, the trend over time, and the details behind this traffic.

Join Elena Matchey, Head of Analytics at Netskope for a conversation on how to optimize security operations with pre-built and custom data analysis tools. Bring your questions on Advanced Analytics and get step-by-step answers from a live Netskope environment. Register Here. This session is for Netskope Advanced Analytics customers, and aimed at engineers who have hands-on experience with Netskope. We welcome interaction so that you can learn from each other and share your personal experiences. Agenda: 1.) Introductions 2.) Open Floor Q&A 3.) "Select a Use Case" 4.) Resources and where to get help

Can the data stores behind DEM be exposed to clients who have both DEM and AA?   It's quite obvious that AA is driving the data presentation of DEM, to the point that a DEM folder was appearing in the Netskope Library of AA for a while.   But (unlike other Netskope provided AA reporting) we unable to copy and tune many of those reports.  Additionally, we are not able to explore the data to find stats meaningful to us.

This dashboard gives an overview of user activities in non work-related categories (i.e. #hours spent on social apps). Use this dashboard to...    Understand trend of Users and Time spent in non-business categories:  Analyze top categories where users are spending time:  Visualize trend of business vs. non-business time spent in apps:  Filter on a particular user or set of users:    And More!  

Migrated Content

Use this dashboard to understand the allowed data movement to unmanaged applications and non-corporate instances.  Specifically, gain visibility into the following : Allowed Data Movement with DLP Violations Allowed Data Movement (with or without DLP Violations) A View into Managed and Unmanaged Applications & Instances Some example insights below.  Identify uploads to personal instances Understand activity in unmanaged applications that is allowed and has associated data movement:    Drill to see the details:       

For those of you that are leveraging Adv Analytics, what has been your real-world need for the cloud storage period for records? 7 days with a Splunk data collection looks to be feasible (if this data, indeed, feeds to Splunk). 30 days is likely where we'd want it capped but I'd like to hear from current users. 

Use this dashboard to understand traffic destined for countries of interest (based on dashboard level filter settings above). This Dashboard provides insights into:   Visuals to understand which traffic flows (events) are destined for countries of interest Originating user and application context for the generated traffic Threats (i.e. Alerts) detected , along with the types of threats, policies, and resulting actions (blocks, allows, etc.)   Recommendations:  Ensure that the Netskope client is enabled and connected to the Netskope cloud. Educate your users. Stay vigilant. Visit our resource center frequently to get updates on the evolving threat landscape, learn about the protections within Netskope products, and get additional insights to heighten your defenses. Monitor the Netskope blog for the latest research and threat information. The security of our customers is our priority, and we encourage all organizations to apply recommended protections and security upda

Advanced Analytics is a powerful data platform that will help you develop a deeper understanding of what's happening in your cloud environment. We have a number of Advanced Analytics video training resources that are available to make it easy to learn new concepts, visualize cloud activity and apply the findings to your Netskope security policies.   Each week, I'll make updates to this post when new videos are released. Keep a bookmark on this post (Options->Bookmark) to learn more about Advanced Analytics.   Video 1: Quick Tour and Creating a Report from Explore Video 2: Advanced Analytics: Overview of Popular Dashboards Video 3: CISO Dashboard Video 4: Introduction to Advanced Analytics - Part 1 Video 5: Introduction to Advanced Analytics - Part 2 Video 6: Migrating Existing Reports   Do you have requests for additional videos? Reply to this post and let me know.  

  Advanced Analytics will help you understand activities within your applications in an entirely new light. In this video @mzhang walks through the key elements for building your first dashboard.       Are there topics about Advanced Analytics that you'd like to learn more about? Leave a comment and let me know.

Hey all,So here's what the widget does:It looks to see how many users in each company division are using Cloud Storage apps.The problem is there are many Cloud Storage apps, and the list just spans across too many columns.(see the screen shot) Is it possible to (within the same widget) break up the data into different rows, or would I have to use multiple widgets?

Here is a video that discusses what dimensions and measures are, and how to use them in Advanced Analytics. This video is part of a training series that is currently in development. Please let me know what you think! 

Does Netskope have a good video, etc on the advanced analytics. We get asked from our HR dept. to pull a full report on a users internet activity. They want a nice pdf with all this type of info: user, site/app, browse time, category, action, days accessed, etc....    Thank you!

Netskope Advanced Analytics is a business intelligence and big data analytics platform providing organizations with 360° views of their cloud risk posture for apps, users, and data.