Reporting on device "Last Event: User Disabled" events

  • 25 January 2024
  • 2 replies
  • 154 views
C
Badge +5

I want to generate a weekly report using Advanced Analytics that shows a list of users and timestamps when a user disables the Netskope Client. I see we can filter this on the Security Cloud Platform > Netskope Client.> Devices page by adding a filter: "Last Event: User Disabled" so I looked for this in the Advanced Analytics Explore page but couldn't locate anything.

 

Is this currently possible with the Data Collection options we currently have? Or does a new data collection option feature need to be added for device events to accomplish this? 

 

While we have the user disable option turned off for most staff, this would be a helpful way for us to track down users who are turning the client off for various issues and are not vocal about the problems they are having. This would be super helpful on our road to complete org-wide client tamper-proofing. 

 

Thanks!

2 replies

S
Rank
Userlevel 2
Badge +12

Hi @csword The device data source for Advanced Analytics is in the latter stages of testing.  If you speak to your Customer Success Manager or Technical Account Manager, they should be able to activate it for you on your tenant.  It is a great improvement to be able to have the device data within Advanced Analytics, and a dashboard to display will be simple to build afterwards.  A device dashboard for the library has also been developed. 

qyost
Userlevel 5
Badge +16

While we have the user disable option turned off for most staff, this would be a helpful way for us to track down users who are turning the client off for various issues and are not vocal about the problems they are having. This would be super helpful on our road to complete org-wide client tamper-proofing. 

Don’t forget, while the Client Config controls can remove functionality from the GUI, many of those options still exist via the nsdiag command that is distributed with the client.   Fortunately, it looks like client disable is not though.
 

 

---Q.

Reply


Terms & ConditionsCookie settings