Create a Page Events Custom Report
A report can include a combination of custom and predefined charts, comments, and saved search results. For example, a cloud risk assessment report can include lists and charts side-by-side to help you analyze a wide range of data more easily.
To create a report:
Log in to the Netskope UI and navigate to Reports.
Click New Report. Enter a report title, and click Create Report.
Tip
Enable the Share with others checkbox if you want others to access this report.
After creating a report, click Add in the top right corner to add one of these components:
Comment: Enter a description about the report in the text field, and then choose to make it small or large.
New Chart: A series of pages guide you through the process of creating a new chart. You can add multiple charts to the report.
Predefined Chart: Choose the type of chart you want from the list, or enter text in the search field to quickly find a specific type of chart.
Saved Search: After you create a custom chart, it appears in this list for future use. Select one of these saved queries to add a chart with the noted parameters.
To create a new chart, select Add > New Chart to open the Add Chart window which guides you through the process. Each chart you create is based on the event, format, and value options you select. The key parameters for the Event Type page are:
Parameters
Description
Event Type
Choose whether you want to query an alert event, application event, or page event:
Alert: Alerts are generated when a policy, DLP, or watchlist is matched. For log discovery using PAN firewall logs, alerts show the list of apps blocked by the PAN firewall. For every event blocked by PAN we generate a corresponding alert.
Page: Page events are generated for the actual HTTP connection and contain app, appcategory, ccl, source, destination, bytes and latency details. For log discovery using PAN firewall logs, page events also show the details of all the cloud apps that are allowed in the network.
Application: Application events record more details of the user activity inside the cloud app. For log discovery using PAN firewall logs, this is identified using the URL recorded in the PAN logs.
Time
Specify the time period. Choose 30 days, 7 days, 24 hours, or a custom time period.
Query
Enter a query to execute. For example, if you want to query the users who use Box, enter
app eq Boxin the query field. When you enter words in the query field, a list of options opens and changes to help you find the specific code strings needed create a query.When finished, click Next.
Select the formats you want from the dropdown lists. The key parameters are:
Parameters
Description
Summarize By
You can summarize the data by Application, Device Classification, User, CCL, Organization Unit, and App Category, Device or CCI parameters. In the above example, you want to query all users using Dropbox, and choose Summarize by User.
Format
Reports can be in a line chart, bar chart, or table format, plus multi-axis column or stacked bar graph. Table format allows displaying up to 100 lines in the report UI.
Widget Size
Specifies the width and height for the chart.
Show Top (#)
Specifies the total number of top values to display. Choosing Table format allows displaying the top 100 values in the UI.
When finished, click Next.
The Numeric Value options vary, depending on the type of chart you are creating. For example, a table has numeric and attribute value options, as shown below, but a bar chart only has total events. When finished, click Next.
Enter a name for this widget (chart name), and click Save Chart.
After a chart is created it displays on the Reports page. Hover over the arrow for options to available based on your permissions. If you created the report, you have full access. Otherwise, you will see a subset of options.
The buttons in the top-right corner of the chart/widget allow you to edit, clone, export (to CSV), or delete the chart/widget. Cloning a report makes it easier and quicker to create new reports. Select the clone icon to open the Clone Chart window. This allows you to change only certain factors to easily create similar reports instead of creating a report from scratch.