Skip to main content
Solved

Reporting on unsanctioned app usage

  • July 14, 2023
  • 2 replies
  • 148 views

Forum|alt.badge.img+7

Hi Everyone,

Am attempting to create a report of all unsanctioned application usage where corporate email addresses have been used, is this possible with standard reporting?

Thank you

Best answer by sshiflett

@Curious

Yes this should be possible with classic reporting but Advanced Analytics would provide more insight.  You can create a widget that has a query like:

activity like Login and app-cci-app-tag eq 'Unsanctioned' and from_user like corpdomain.com

The widget can then be configured to break down by user, app, and other fields:

 


This gives you insight into the corporate username and the from user that they leveraged.  My example is sparse as my tenant just has traffic from me and my test accounts but here's a sample:

 

 






 

This topic has been closed for replies.

2 replies

Forum|alt.badge.img+16
  • Netskope Employee
  • Answer
  • July 19, 2023

@Curious

Yes this should be possible with classic reporting but Advanced Analytics would provide more insight.  You can create a widget that has a query like:

activity like Login and app-cci-app-tag eq 'Unsanctioned' and from_user like corpdomain.com

The widget can then be configured to break down by user, app, and other fields:

 


This gives you insight into the corporate username and the from user that they leveraged.  My example is sparse as my tenant just has traffic from me and my test accounts but here's a sample:

 

 






 


Forum|alt.badge.img+7
  • Author
  • Explorer III
  • July 24, 2023

Thanks @sshiflett, love your work!