Using Advanced Analytics to have visibility into bypassed traffic

Netskope Global Technical Success (GTS)

Using Advanced Analytics to have visibility into bypassed traffic

Netskope Cloud Version - 124

Objective

This article aims to explain how to leverage Advanced Analytics to build a Dashboard that provides insights of bypassed traffic.

Pre-requisite

Advanced Analytics entitlement is required

This article assumes that the administrator has a foundational understanding of Advanced Analytics

Context

Sometimes administrators need to identify which users are hitting specific steering exceptions in their Netskope environment. While steering exceptions are configured at the steering configuration level and are not user/group based, there is a need to understand which users  traffic is actually bypassing Netskope due to these exceptions. There are some caveats though since not all bypassed traffic is visible in these events, this is because some bypass decisions happen at the client level and are not recorded in the Netskope Cloud.

The exceptions typed that are not logged are:

• Private IP exceptions
• Certificate pinned applications exceptions
• Category exceptions: Netskope client checks whether the domain is in the domain category exception cache if yes, flow is bypassed else NS Client makes an HTTP request to NS Proxy to figure out whether the domain is in the category exception list. First flow is always tunneled
• IP exceptions

Procedure

1. Go to Advanced Analytics and use Page Events as the data source for creating a new Dashboard.
2. Use the following Dimensions:
   1. User
   2. Bypass reason
   3. Site
   4. URL
   5. Domain
3. Use the following filters:

4. Optionally, to filter by bypass reason do the following:

1. Edit the dashboard by clicking on the three dots to the right and select "Edit dashboard"Click on "Filters - Add Filter"
2. Search for "Bypass" and select "Bypass Reason"
3. Choose "Dropdown Menu" as the control type for the filter

Note: A pre-built dashboard with the aforementioned characteristics has been uploaded here for your convenience. It can be imported into your Netskope tenant for immediate access to the information.

Terms and Conditions

• All documented information undergoes testing and verification to ensure accuracy.
• In the future, If any such platform changes are brought to our attention, we will promptly update the documentation to reflect them.

 Notes

• This article is authored by Netskope Global Technical Success (GTS).
• For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.