Cloud app discovery

Cloud app discovery provides insights on cloud applications, user activities, and domains through intuitive graphs and tables. You can customize reports based on gateway server, app reputation, app category, or time period. You can also change the status of the cloud app to Sanctioned, Banned, or Shadow directly from the reports. Cloud app discovery uses previously crunched data to display reports with low latency and better insights.

Group by

Select Cloud App, Actor, or Domain from the Group by drop-down on the left to view corresponding reports and graphs.

1. Cloud App

The cloud app summary shows the graph for top cloud apps by request count. The table lists the accessed cloud apps with details such as:

• Request count: Shows the number of requests raised by the cloud app.
• Reputation range: Shows the reputation score ranges of the domain that the app belongs to on a scale from zero to 100. A high reputation score denotes that the domain is relatively secure, while a low reputation denotes that the domain might be vulnerable.
• Upload size: Shows the volume of data uploaded to the cloud app.
• Download size: Shows the volume of data downloaded from the cloud app.
• Total size: Shows the total volume of uploaded and downloaded data.
• First access time: Shows the timestamp of when the app was first accessed within the selected Available Reports time filter (day, week, or all time).
• Last access time: Shows the timestamp of when the app was last accessed within the selected Available Reports time filter (day, week, or all time).

You can get deeper insights by selecting the following filters:

• Gateway Server: Choose to view reports for all or specific gateway servers.
• Available Reports: Select data from a specific date, week, or all time (up until the last crunch-run date).
• App Reputation: View data for domains in specific reputation score ranges. The app reputation score ranges from zero to100. A high reputation score indicates that the domain is relatively secure, while a low reputation score indicates that the domain is vulnerable.
• App Category: Show data for desired app categories defined as per the threat analytics database.

2. Actor

The actor summary shows the graph for top actors by download size. The table lists client devices and their internet usage with details such as:

• Request count: Shows the number of requests raised in the name of the actor.
• Upload size: Shows the volume of data uploaded by the actor.
• Download size: Shows the volume of data downloaded from cloud applications by the actor.
• Total size: Shows the total volume of uploaded and downloaded data.
• Reputation range: Shows the reputation score ranges of the domains accessed by the actor on a scale from zero to 100. A high reputation score denotes that the domain is relatively secure, while a low reputation denotes that the domain might be vulnerable.
• First access time: Shows the timestamp of when the actor first accessed the internet within the selected Available Reports time filter (day, week, or all time).
• Last access time: Shows the timestamp of when the actor last accessed the internet within the selected Available Reports time filter (day, week, or all time).

You can get deeper insights by selecting the following filters:

• Gateway Server: Choose to view reports for all or specific gateway servers.
• Available Reports: Select data from a specific date, week, or all time.
• App Reputation: View data for domains in specific reputation score ranges. The app reputation score ranges from zero to 100. A high reputation score indicates that the domain is relatively secure, while a low reputation score indicates that the domain is vulnerable.

3. Domain

The domain summary shows the graph for top domains by download size. The table report lists the domains accessed along with details such as:

• Request count: Shows the number of requests raised by the domain name.
• Upload size: Shows the volume of data uploaded by the actor for a domain.
• Download size: Shows the volume of data downloaded from a domain by the actor.
• Total size: Shows the total volume of uploaded and downloaded data.
• Reputation score: Shows the reputation score of the domains accessed by the actor. The app reputation score ranges from zero to 100. A high reputation score indicates that the domain is relatively secure, while a low reputation score indicates that the domain is vulnerable.
• App status at first access: Shows the status of an app (Sanctioned, Banned, or Shadow) when it was first accessed within the selected Available Reports time filter (day, week, or all time).
• App status at last access: Shows the status of an app (Sanctioned, Banned, or Shadow) when it was last accessed within the selected Available Reports time filter (day, week, or all time).
• Current app status: Shows the real-time status of an app (Sanctioned, Banned, or Shadow).
• First access time: Shows the timestamp of when the actor first accessed the internet within the selected Available Reports time filter (day, week, or all time).
• Last access time: Shows the timestamp of when the actor last accessed the internet within the selected Available Reports time filter (day, week, or all time).

Note: Sub-domains will inherit app status from their root domain if the app status for the root domain is preconfigured.

You can get deeper insights by selecting the following filters:

• Gateway Server: Choose to view reports for all or specific gateway servers.
• Available Reports: Choose to view data on a specific date: from the last 15 days, for a specific week, or all time.
• App status at first access: Choose to view reports for the status of an app (Sanctioned, Banned, or Shadow) when it was first accessed within the selected Available Reports time filter (day, week, or all time).
• App Reputation: View data for domains in specific reputation score ranges. The app reputation score ranges from zero to 100. A high reputation score indicates that the domain is relatively secure, while a low reputation score indicates that the domain is vulnerable.
• App Category: Show data for desired app categories defined by the threat analytics database.

You can change the app status by clicking the drop-down next to the current app status and selecting a value. You can also select multiple apps and change their app status in bulk.

Available Reports

Administrators can use the Available Reports option to filter and view data from a particular period. This data provides insights on the usage of cloud applications and helps in identifying anomalies. The various time periods users can view data for are:

• All time: Shows data from the moment the gateway server was configured until the most recent crunch time.
• Week: Shows data for a specific week. Users can choose to view data from the last week and the week before, spanning back from the most recent crunch time.
• Day: Shows data from a specific day. Users can choose to view data of any particular day within the last 15 days, spanning back from the most recent crunch time.