netskope/casb Dashboards

Widget	Description	Type
Top Policy Hits	Hide Query Show Query logscale `action = "useralert" \| top(policy, as=count)`	`Table`
Top Sources Triggering Alerts	Hide Query Show Query logscale `action = "useralert" \| top(sourceServiceName)`	`Bar Chart`
Top 10 Applications Triggering Alerts	Hide Query Show Query logscale `action = "useralert" \| top(requestClientApplication)`	`Bar Chart`
Users with Most Alerts	Hide Query Show Query logscale `action = "useralert" \| top(suser, as=count)`	`Table`
Recent Alerts	Hide Query Show Query logscale `action = "useralert" \| table([@timestamp, suser, hostname, src, dst, policy, requestClientApplication, sourceServiceName])`	`Table`

Widget	Description	Type
Using unknown OS or Device	Hide Query Show Query logscale `os="unknown" \| groupBy(suser) \| count()`	`Gauge`
Top Application Activities	Hide Query Show Query logscale `top(act)`	`Bar Chart`
Browser Breakdown	Hide Query Show Query logscale `top(browser)`	`Pie Chart`
Cloud Confidence Level Breakdown	Hide Query Show Query logscale `top(ccl)`	`Pie Chart`
Managed Devices	Hide Query Show Query logscale `top(deviceClassification)`	`Pie Chart`
Activity Map	Hide Query Show Query logscale `worldMap(ip=src)`	`World Map`
Device Breakdown	Hide Query Show Query logscale `top(device)`	`Pie Chart`
Most Common Connections	Hide Query Show Query logscale `groupBy([src, dst]) \| sort(_count, limit=10) \| sankey(source=src, target=dst)`	`Sankey`

Widget Description Type

Recent Detections

Widget	Description	Type
Recent Detections	Hide Query Show Query logscale `action = "Detection" \| select([@timestamp, mwDetectionName, mwDetectionEngine, object, mwType, mwId, mwScannerResult, hostname, suser])`	`Table`
Top URL's	Hide Query Show Query logscale `action = "Detection" \| groupBy(url) \| sort(_count, limit=10)`	`Pie Chart`
Malware Type Timechart	Hide Query Show Query logscale `action = "Detection" \| timeChart(series="mwType")`	`Time Chart`

Hide Query

Show Query

logscale

action = "Detection"
| select([@timestamp, mwDetectionName, mwDetectionEngine, object, mwType, mwId, mwScannerResult, hostname, suser])

Top URL's

Hide Query

Show Query

logscale

action = "Detection"
| groupBy(url)
| sort(_count, limit=10)

Malware Type Timechart

Hide Query

Show Query

logscale

action = "Detection"
| timeChart(series="mwType")