netskope/casb Dashboards

Widget	Description	Type
Top Policy Hits	Displays a list of the top policy hits by user alert. Hide Query Show Query logscale `action = "useralert" \| top(policy, as=count)`	`Table`
Top Sources Triggering Alerts	Displays a chart of the top sources triggering user alerts. Hide Query Show Query logscale `action = "useralert" \| top(sourceServiceName)`	`Bar Chart`
Top 10 Applications Triggering Alerts	Displays a bar chart of the top 10 applications that have triggered alerts. Hide Query Show Query logscale `action = "useralert" \| top(requestClientApplication)`	`Bar Chart`
Users with Most Alerts	Displays a table of users with the most alerts. Hide Query Show Query logscale `action = "useralert" \| top(suser, as=count)`	`Table`
Recent Alerts	Displays a table of recent alerts and associated data (timestamp, user, hostname, src, etc.) Hide Query Show Query logscale `action = "useralert" \| table([@timestamp, suser, hostname, src, dst, policy, requestClientApplication, sourceServiceName])`	`Table`

Widget	Description	Type
Using unknown OS or Device	Displays users that are using an unknown OS or device. Hide Query Show Query logscale `os="unknown" \| groupBy(suser) \| count()`	`Gauge`
Top Application Activities	Displays a bar chart of top application activities. Hide Query Show Query logscale `top(act)`	`Bar Chart`
Browser Breakdown	Displays a pie chart of the most common browser breakdowns. Hide Query Show Query logscale `top(browser)`	`Pie Chart`
Cloud Confidence Level Breakdown	Displays a pie chart of cloud confidence levels. Hide Query Show Query logscale `top(ccl)`	`Pie Chart`
Managed Devices	Displays a pie chart of managed devices by device classification. Hide Query Show Query logscale `top(deviceClassification)`	`Pie Chart`
Activity Map	Displays a world map of activity by IP source. Hide Query Show Query logscale `worldMap(ip=src)`	`World Map`
Device Breakdown	Displays a pie chart of a device breakdown. Hide Query Show Query logscale `top(device)`	`Pie Chart`
Most Common Connections	Displays a flow chart of the top 10 most common connections. Hide Query Show Query logscale `groupBy([src, dst]) \| sort(_count, limit=10) \| sankey(source=src, target=dst)`	`Sankey`

Widget Description Type

Widget	Description	Type
Recent Detections	Displays a table of recent detections and their accompanying data. Hide Query Show Query logscale `action = "Detection" \| select([@timestamp, mwDetectionName, mwDetectionEngine, object, mwType, mwId, mwScannerResult, hostname, suser])`	`Table`
Top URL's	Displays a list of top detections by URL and limits the results to the first 10 entries. Hide Query Show Query logscale `action = "Detection" \| groupBy(url) \| sort(_count, limit=10)`	`Pie Chart`
Malware Type Timechart	Displays a timechart of detected malware by type. Hide Query Show Query logscale `action = "Detection" \| timeChart(series="mwType")`	`Time Chart`

Displays a table of recent detections and their accompanying data.

Hide Query

Show Query

logscale

action = "Detection"
| select([@timestamp, mwDetectionName, mwDetectionEngine, object, mwType, mwId, mwScannerResult, hostname, suser])

Displays a list of top detections by URL and limits the results to the first 10 entries.

Hide Query

Show Query

logscale

action = "Detection"
| groupBy(url)
| sort(_count, limit=10)

Displays a timechart of detected malware by type.

Hide Query

Show Query

logscale

action = "Detection"
| timeChart(series="mwType")