Skip to main content
  • EN

Discussions

Get answers to your questions about app usage, data movement, and user behaviors. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.

  • 70 Topics
  • 68 Replies
70 Topics
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Discussions
September 2024 Office Hours Recap

Hello Folks, Below you can find a recap of the topics discussed during the September Advanced Analytics office hours and those sent in that we were not able to cover in the session. Feel free to comment and continue the discussion, as well as attend our future sessions that can be found from the Community Events Calendar! Secure Client Enrollment (Rogue Device) DashboardBy providing visibility into users with multiple devices & device classifications, this dashboard helps you identify “rogue devices” in your environment. For more details about how to best use the dashboard, please view this video.The dashboard can be found here. Admin Disabled User DashboardBased on the Device Data, this dashboard allows you to identify “admin disabled” users who have not yet been re-enabled. Detailed instructions about how to best use the dashboard are provided.The dashboard can be found here. POP Usage DashboardBased on Application Events, this dashboard provides visibility into Netskope Host POP

190
Aaron_Zhang
Netskope Employee
16 days ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions
Advanced Analytics Training Resources

 Please follow the 3 steps below to quickly get started with Advanced Analytics: Step 1: Reference Netskope Advanced Analytics - Getting Started to get started using Advanced Analytics in 5 minutes. Step 2: Watch “Getting Started” Webinar to understand what Advanced Analytics is all about.  Step 3: Visit our Video Library for more features and advanced use cases with Advanced Analytics.Don’t forget the Netskope Community is your friend. Here you can post your questions and get answers in Discussions, view the latest dashboards in Dashboard Gallery, and register for our monthly Advanced Analytics Office Hours. --------------------------------- If you need technical support, please visit our Support Portal. You can request your end-user account on the support portal by sending email to support@netskope.com. A demo of Netskope Support Portal can be found here.  

0
Aaron_Zhang
Netskope Employee
11 months ago
S
secproceoNew Member
asked in Discussions
Netskope Client for iOS

Can the Netskope client be installed for iOS (iPad) without using Intune? I need to install it for one device. If so, are there instructions? Thanks. 

3
S
14 days ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
August 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the August office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any recommended “getting started” dashboards for new users?A: The CASB & NG-SWG Dashboards are designed to help you maximize the ROI of your Netskope CASB investment by highlighting ways to fully utilize Netskope’s features. This dashboard includes to-do lists, recommendations, and best practices, making it valuable for leadership reporting. It also helps you understand if your controls are working effectively by showing trends and showcasing the value of your team’s work.The Security Health Check (Self-Service) Dashboard offers a comprehensive self-service tool for performing health checks and identifying security concerns or gaps in your environment. It covers two main dim

0
lzhi
Netskope Employee
1 month ago
jonathanpereira-claro
jonathanpereira-claroNew Member
posted in Discussions
Order by on advanced analytics

Hi, team! I created a bunch of widgets with really useful data but I'm unable to find order by fields to avoid a bar graph with a roller-coaster look. Any help would be great!

1
Aaron_Zhang
Netskope Employee
1 month ago
D
dazmacmainNew Member III
asked in Discussions
How Can I Improve Netskope's Performance?

I have just started a new company.We have brand new Cisco Cat 9500 and 9300 MGig switches. With Netskope installed on our computer have run a speed test and getting 100Mbps connected to the Internet with Netskope enabled.  With Netskope disabled we are getting speeds of up to 700Mbps connected to the internet. Is there a reason why this is so slow, has it got to do with deep packet inspection? Can anything be done to speed this up? I am new to Netskope and our security team are in charge of this. 

3
S
2 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
July 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the July office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any AI specific reports that are new in the last 2-3 months? A: The updated AI Usage Dashboard. This dashboard displays AI usage within a customer environment and highlights any controls that are in place to manage AI traffic. A major update to this dashboard includes the Application Instance widget, which uses a Sankey chart to clearly illustrate the traffic flow of AI app usage. You can dive into the widgets for more detailed insights. Q: Where is the data source of the AI Usage Dashboard residing?A: The data for the AI Usage Dashboard is sourced from Application Events, which syncs data from Netskope Skope IT. For more information, you can refer to the Application Events Intro

0
lzhi
Netskope Employee
2 months ago
M
Netskope Employee
mgulledgeNetskope Employee
posted in Discussions
Sending Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform

OverviewThis document encompasses a step by step guide outlining how to send all your Netskope Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform. PrerequisitesNetskope API Token Azure Log Analytics Workspace Microsoft Sentinel InstanceDeployment StepsLog into your Azure portal: https://portal.azure.com/signin/index/  Select what Netskope API endpoints you want to send to Log Analytics (see screenshot below)   Next navigate in the Azure portal to the Data Collection Endpoints page and create a Data Collection Endpoint for each Netskope API endpoint you want to send to Sentinel: (make sure the DCEs are in the same region and resource group as your Log Analytics workspace)   Once completed we will need to deploy a custom template for each API endpoint so navigate to Deploy from a custom template in your Azure portal: Select Build your own template in the editor and paste the JSON files linked below: (You will need to repeat this step for each endpoint as it

1
M
Netskope Employee
2 months ago
T
TKO3SonsNew Member III
asked in Discussions
Issues with Advanced Analytics pulling 90 days

Has anyone else ran into issues with the Advanced Analytics attmpting to pull informaiton for 90 days?  I’m attempting to pull reports for the previous quarter, but i’m running into charts that appears to be missing information going back that far.   

1
2
3 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
June 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the June office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: What are the benefits of using Advanced Analytics?A: Advanced Analytics enables you to gain valuable insights and present them effectively to your leadership. It provides visibility into your environment, helping you understand how Netskope is protecting you. With Advanced Analytics, you can identify risks in your environment and learn how to address them. To get started, refer to Advanced Analytics Training Resources. Q: How to accurately report on user activities with Advanced Analytics?A: There are several ways to do this. One effective method is to utilize the Netskope Library dashboard resources. You can search “user” in the dashboard name search bar or select the “Users” tag. The User

0
lzhi
Netskope Employee
3 months ago
M
munster
asked in Discussions
Issue Password for Single User to Uninstall Agent

HiWe have users in “All Users” group in Client Configuration.  They are password protect from client installation.However, I have to issue the password to 1 user to uninstall password which means all other users can also uninstalled with this password.  Is there anyway just generate 1 time password for that user to uninstall without having to share the actual “password ptotect client uninstallation”? thx

1
ejang
Netskope Employee
3 months ago
W
wilsonExplorer III
asked in Discussions
Page events source CIDR Field question: Multiple CIDR

Within AA page events, is there a way to have multiple CIDR?  I heard that commons work, I heard that you can add the field multiple times, but neither seems to work for me.  Screenshot attached.

2
Aaron_Zhang
Netskope Employee
3 months ago
C
cjcarewNew Member
asked in Discussions
V2 API Pagination

Hi Folks,Apologies if this is a simpleton question, however it’s doing my head in. I have the api working and am able to use the dataexport endpoint to extract malware alerts. My issue is that I only receive one record in the response and I know there is 115 in the time period of the search. The record I receive is the very first in the results. I can confirm that by checking in the console.My (hopefully simple) question is what is the format of the api query to iterate through the results so that the full list can be retrieved? I’ve tried ?operation=next&index=(the index name supplied in the first query). However that returns an empty response.I’d appreciate any guidance.Regards,Campbell

0
C
4 months ago
C
cswordNew Member III
asked in Discussions
Exporting platform audit log data with AA

I’m curious if Netskope platform audit log data can be exported using Advanced Analytics or put on the road map? It would be helpful to generate reports for events such as Create/Delete Admins, tunnel modifications, and other events.  This arose from a recent PCI audit (looking forward into PCI 4.) where logs related to VPN access must be reviewed (and eventually ingested into SIEM or similar platform to search for anomalies) and immediately searchable up to 90 days and stored for 1 year.  Thanks!

1
Mario Garcia
Netskope Employee
4 months ago
B
BLAY5050New Member
asked in Discussions
Explicit Proxy Root Certificate

Does anyone know where the Netskope root certificate needs to go in Windows to use the explicit proxy? I assume it needs to go in the certificate store but is there a location? Thanks. 

3
W
4 months ago
W
wilsonExplorer III
asked in Discussions
Advanced Analytics and categories

In Advanced Analytics Application Events, it is possible to list out the primary category and the “other category” of sites”.However, page events does not have the “other category field” Questions: Is there any plan to bring these to into parity? Is there any other way to get the primary/secondary categories as it relates to a page events, or do I have to wait until Tenant version 116  new feature API and do a conversion manually?

0
W
4 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
published in Discussions
May 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the May office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: I’d like to learn more about AI usage.A: The AI Usage Dashboard can help. This dashboard shows the AI usage in your environment and helps you to see what, if any, controls are in place to control AI traffic. You can use the Application filter at the top of the dashboard to dive into a specific application. The AI Usage with App Instances dashboard would also help. This dashboard provides additional visibility into the App Instances used to access AI Apps/Sites in the environment, which helps identify if the Corporate Instances are used for AI Usage. Q: Is there info from Advanced Analytics that I can extract from SkopeIT events and web transaction logs?A: Yes. Most of the data from Skope IT

630
lzhi
Netskope Employee
4 months ago
E
elawaetzExplorer III
asked in Discussions
Cloud Exchange Logshipper Syslog integration with Darktrace?

Has anyone had any luck with Syslog integration from Cloud Exchange into Darktrace?Darktrace describes the expected format like this:Darktrace expects the Netskope Web Gateway data to include the string "darktrace_netskope" followed by a JSON formatted representation of the Netskope logging. The order of fields within the JSON is not important. For example: darktrace_netskope {"src_time": "Fri Jan 1 00:10:00 2021","userkey": "user.name@company.com","dst_region": "Region","category": "Business","src_longitude": 52.2,"transaction_id": 0,"ur_normalized": "user.name@company.com","src_latitude": 0.12,"dst_longitude": 52.2,"domain": "www.example.org","dst_zipcode": "555555","access_method": "Client","src_timezone": "Global/UTC","ccl": "unknown","bypass_reason": "SSL policy matched","user_generated": "yes","dst_country": "ZZ","srcip": "198.51.100.1","site": "example","traffic_type": "Web","src_region": "Region","user": "user.name@example.org","appcategory": "Business","page_id": 0,"insertion_

10
Gary-Jenkins
Netskope Employee
4 months ago
lzhi
Netskope Employee
lzhiNetskope Employee
posted in Discussions
April 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the April office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Can I get visibility into geolocation data in Advanced Analytics?A: Absolutely. We have 3 main use cases on geolocation data:PoP Usage Dashboard: This dashboard provides insights into Netskope Host Points of Presence (PoPs) detected in your environment, along with users connected. It helps you identify un-allowed PoP usage.  # Consecutive Days Outside a Specific Region Dashboard: This dashboard returns the number of consecutive days a user's source country is outside a designated region. Use this dashboard to monitor and manage sensitive data movement outside the user’s assigned region. Office Locations Dashboard: Use this dashboard to gain insights into whether individuals within your org

0
lzhi
Netskope Employee
5 months ago
M
matheusfNew Member III
asked in Discussions
Filtering and Counting Files by Extension in Netskope

Hi everyone,I'm looking for a way to create a filter in Netskope that focuses only on the file extension, disregarding the full file name.Objective:My goal is to analyze the volume of files with specific extensions that are being used in our environment. For example, I have a list of extensions like .csv, .xls, and .jpg, and I want to understand how many files of each type are being accessed.Challenge:In Advanced Analytics, I can only see the complete object name. I'd like to know if it's possible to create a custom field that captures only the file extensions. This would allow me to count and visualize the volume of each file type in a dashboard or report.Example:An ideal report would display the volume of files per extension over a specific period. For instance, in the last 7 days, there were 50 .pdf files uploaded, 20 .xls files, and 2 .jpg files.I hope I have explained my need clearly. Any help or suggestions would be greatly appreciated!

2
M
5 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions
Swap data using table calculations

Recently, one of our customers who is leveraging risk insights for log ingestion ran into a problem. For certain dates of the month (April 14 & 15), the ingestion swapped "Bytes Uploaded" and "Bytes Downloaded." How can they leverage Advanced Analytics to swap the data back so that their monthly reporting would be accurate? Here is one solution with Table Calculations.  The first step is to create a Custom Dimension with command: concat(${page_event.event_timestamp_date},"")  This converts the format of all “Event Dates” from “Timestamp” to “String,” which helps avoid potential errors in our Table Calculations. We name the dimension Event Date - String and then save it. The second step is to create Table Calculations which swap the data for particular dates (April 14 & 15 in this case). Let’s start with the Table Calculation swapping “Bytes Uploaded” to “Bytes Downloaded.” We create a Table Calculation with command: if(  ${event_date_string}="2024-04-14"  OR  ${event_date_strin

0
Aaron_Zhang
Netskope Employee
5 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions
March 2024 Office Hours Recap

Hello Folks,  Below you can find a recap of questions asked at the March office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: How to better analyze and manage GPT traffic using Advanced Analytics?A: We recommend starting with the AI Usage Dashboard in Netskope Library, which helps you understand how AI apps & sites (e.g. ChatGPT) are being used in your organization. You can also find an updated version of the AI Usage Dashboard in Netskope Community. This version provides additional visibility into App Instances, which helps you identify if your Corporate Instances are exposed with AI usage. Q: How can we combine reports to see data being uploaded to risky applications and to understand their CCL?A: The Application Risk Management Dashboard is a great starting point for this use case. The dashboard helps you

0
Aaron_Zhang
Netskope Employee
6 months ago
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
posted in Discussions
February Office Hours Recap

 Hello Folks,  Below you can find a recap of questions asked at the February office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: We noticed that the community page looks different now. What happened?A: We recently launched a new version of Netskope Community, and that is why you may have observed many changes in our community page. The URL remains the same, so you can still visit our community through https://community.netskope.com/. Advanced Analytics section is still located in the new community landing page, where you can access all the features like dashboard gallery, discussion board, and training resources.  We are still updating the new community page, so you may see additional changes in the upcoming weeks or months. In the meantime, please feel free to share any feedback and let us know if you have any

0
Aaron_Zhang
Netskope Employee
7 months ago
C
cswordNew Member III
posted in Discussions
Reporting on device "Last Event: User Disabled" events

I want to generate a weekly report using Advanced Analytics that shows a list of users and timestamps when a user disables the Netskope Client. I see we can filter this on the Security Cloud Platform > Netskope Client.> Devices page by adding a filter: "Last Event: User Disabled" so I looked for this in the Advanced Analytics Explore page but couldn't locate anything. Is this currently possible with the Data Collection options we currently have? Or does a new data collection option feature need to be added for device events to accomplish this?  While we have the user disable option turned off for most staff, this would be a helpful way for us to track down users who are turning the client off for various issues and are not vocal about the problems they are having. This would be super helpful on our road to complete org-wide client tamper-proofing.  Thanks!

2
qyost
7 months ago