Explore the Dashboards

The System Status tab appears by default as the home page after first logging into the Cloud Exchange. The System Status Dashboard provides a comprehensive view of your Cloud Exchange environment with the following sections:

System Specifications

The System Specifications section displays key infrastructure details about your Cloud Exchange deployment:

• Platform Provider: Shows the virtualization platform (like VMware).

• Host OS: Displays the operating system and version (like Ubuntu 22)

• Deployment Type: Indicates whether the deployment is Standalone or part of an HA cluster.

• Flavor: Shows the deployment method (like Container or VM).

Services Status

The Services Status section shows all the services running on the system, with an appropriate Up and Down arrow based on active status. When the service is up, respective service status will have a green colored up arrow. When the service is down, respective service status will have a red colored down arrow.

System Stats

The System Stats section provides real-time performance metrics with 5-minute average line charts for:

• CPU Load: Shows CPU utilization percentage over time.

• Memory Usage: Displays both total and used memory in GB.

• Disk Usage: Shows both total and used disk space in GB.

Queues Details

The Queues Details section provides information about the RabbitMQ message queues:

• Queue Name: The name of the message queue.

• State: Current state of the queue (Running/Stopped).

• Messages: Shows message counts with three sub-columns:
  
  
  • Total: Total number of messages in the queue.
  
  
  • Ready: Number of messages ready to be delivered.
  
  
  • Pending Ack: Number of messages waiting for acknowledgment.
  
  

Click Refresh in the top right corner to get the latest system and service status updates.

Click the Log Shipper tab.

The Log Shipper Dashboard is organized into the following sections:

Summary

The Summary section provides an overview of key metrics with clickable elements that navigate to their respective detailed views.

• Total Configured Plugins: Shows the total number of configured plugins contributing ingestion of logs to CLS. 
• Total Alerts/Events/WebTX Sent to External Receiver: Based on the filter it shows the total number of logs sent.
  • All Time: Shows the total number of alerts/events/webtx sent.
  • Last 10 Minutes: Shows total number of alerts/events/webtx sent in the last 10 minutes.
  • Last 30 Minutes: Shows total number of alerts/events/webtx sent in the last 30 minutes.
  • Last 60 Minutes: Shows total number of alerts/events/webtx sent in the last 60 minutes.
• Total WebTx Sent to External Receiver: Based on the filter it shows the WebTx bytes counts sent to sent to External receiver
  • All Time: Shows total number of webtx data sent in bytes.
  • Last 10 Minutes: Shows total number of webtx bytes count sent in the last 10 minutes.
  • Last 30 Minutes: Shows total number of webtx bytes count sent in the last 30 minutes.
  • Last 60 Minutes: Shows total number of webtx bytes count sent in the last 60 minutes.

Plugin Status

The Plugin Status section displays a table with information about all configured plugins:

• Name: The name of the configuration. 
• Plugin: The Name of plugin/product. 
• Status: Current status of the plugin (Enabled or Disabled).

Alert/Event/WebTx Sent

This section provides a configurable bar chart visualization of data transmission metrics with the following filter options:

• Destination Type: Toggle between External Receiver and Storage Buckets. 
• Type: Select the type of data (Alerts, Events, Logs, WebTx). 
• Destination: Select specific plugin destinations. 
• Sub Types: Multi-select filter for data subtypes. 
• Time Range: Filter by time period (All Time, Last 10 Minutes, Last 30 Minutes, Last 60 Minutes, or Custom)

The chart displays color-coded bars representing different data categories:

• Sent (data successfully transmitted). 
• Pulled & Filtered (data processed but filtered). 
• Mismatch (data that didn’t match expected format)

Click the Ticket Orchestrator tab to view overall user activity and ticket management information.

The Ticket Orchestrator Dashboard is organized into the following sections:

Summary

The Summary section provides an overview of key metrics with clickable elements that navigate to their respective detailed views:

• Total Configured Plugins: Shows the total number of configured plugins for ticket orchestration.
• Total Alerts Stored: Displays the total number of alerts stored in the system.
• Total Events Stored: Shows the total number of events stored in the system.
• Total Tickets Created: Shows the total number of tickets created across all connected ticketing systems.
• Total Duplicate Tickets: Shows the number of duplicate tickets that have been automatically identified.

Plugin Status

The Plugin Status section displays a table with information about all configured ticketing plugins:

• Name: The name of the configuration. 
• Plugin: The name of plugin/product.
• Status: Current status of the plugin (Enabled or Disabled).

Ticket Status Overview

This section shows a bar chart visualization of ticket metrics with the following filter options:

• Type: Select the type of data (Alerts, Events).
• Destination: Select specific plugin destinations (like Jira).
• Sub Types: Multi-select filter for alert/event subtypes (e.g., anomaly, c2, Compromised, Content, CRE).
• Time Range: Filter by time period (All Time or custom ranges)

The chart displays the count of tickets based on the selected filters.

Recent Alerts Panel: Lists the 10 most recent alerts reported by the Netskope tenant and other sources, with their IDs, names, types (such as DLP or c2), and associated application categories.

Recent Events Panel: Lists the 10 most recent events with event IDs, types (like incident), and associated users.

Recently Created Tickets Panel: Lists the 10 most recent tickets with the ITSM ticket ID, associated alert/event IDs, alert names, current status, and external links to view tickets in their respective ticketing systems. Only alerts that match a ticket flow will create a ticket.

Overall Status of Tickets Created Panel: Shows a pie chart with the distribution of tickets by status categories, giving a quick visual overview of the current ticket status breakdown.

Threat Exchange is a rules-based engine for collecting and sharing indicators related to file hashes of malicious software (malware), file hashes of files used in Netskope DLP policy for absolute matching, or URLs used by plugged in systems for policy enforcement of restricted or allowed access.

Click the Threat Exchange tab to view the dashboard.

The Threat Exchange Dashboard is organized into the following sections:

Summary

The Summary section provides an overview of key metrics with clickable elements:

• Total Configured Plugins: Shows the total number of configured plugins contributing data to Threat Exchange.
• Total Active IoCs: Shows the number of total active (not disabled) indicators in the Threat Exchange database.
• IoCs Reported In Last 7 Days: Shows the number of active indicators delivered to Threat Exchange in the previous seven days.

Note

Although an indicator could have been recently obtained by Threat Exchange, no event will contribute to the count if the metadata timestamp delivered with the IoC entry is from a period earlier than seven days.

Plugin Status

The Plugin Status section shows a table of all configured threat intelligence plugins with their configuration names, names, and current status (Enabled or Disabled).

IoCs Overview

This section shows stacked bar charts of Indicators of Compromise (IoCs) by IoC type. Use the tabs on the left of the section to switch between the following views:

• Pulled IoCs: IoCs pulled by your source plugins.
• Shared IoCs: IoCs that a Threat Indicators business rule shares with a destination.
• CRE Entity IoCs: IoCs built from Risk Exchange records by a business rule that targets a Risk Exchange entity.
• Unified Mapping IoCs: IoCs shared by the business rules of a unified mapping.

On every tab, the IoC Type filter selects which IoC types the chart shows. All types are selected by default: URL, MD5, SHA256, IPv4, IPv6, IPv4 CIDR, IPv6 CIDR, Hostname, Domain, and FQDN. Click a bar to open the Threat IoCs page with the matching filters applied.

Pulled IoCs Tab

This tab shows the IoCs pulled by each source plugin, with a different color for each plugin source. IoCs built from Risk Exchange records or unified mappings are not included here. You can filter the chart by:

• Plugin Source Configuration: Show the IoCs of one source configuration, or select All to combine every source. By default, All is selected.
• Retraction: Select Including Retracted (All IoCs), Only Retracted, or Excluding Retracted.

Shared IoCs Tab

This tab shows how many IoCs a business rule has shared with a destination. Only business rules that target the Threat Indicators entity are listed. You can filter the chart by:

• Business Rule: The business rule to report on.
• Plugin Source Configuration: The source configuration that the business rule shares IoCs from.
• Plugin Destination Configuration: The destination that the business rule shares IoCs with.

For each IoC type, the chart shows three bars: Filtered is the number of IoCs that match the business rule, Shared is the number shared with the destination, and Mismatch is the number that match the business rule but are not shared with the destination.

CRE Entity IoCs Tab

This tab shows the share status of IoCs that Threat Exchange builds from Risk Exchange records. Only business rules that target a Risk Exchange entity are listed. You can filter the chart by:

• Business Rule: The business rule that builds the IoCs. The first business rule is selected by default.
• Plugin Destination Configuration: The destination that the business rule shares IoCs with. Select a destination to show the chart.

Each bar is split by share status: Shared, In Progress, and Failed. If no business rule targets a Risk Exchange entity, the tab shows No business rules target a CRE entity yet.

Unified Mapping IoCs Tab

This tab shows the share status of IoCs that unified mapping business rules share with Threat Exchange destinations. A unified mapping is listed as soon as one of its business rules has a destination configured, even before the first IoC is shared. You can filter the chart by:

• Unified Mapping: The unified mapping to report on. The first unified mapping is selected by default.
• Plugin Destination Configuration: The destinations that the business rules of this unified mapping share IoCs with. Select a destination to show the chart.

Each bar is split by share status: Shared, In Progress, and Failed. If no unified mapping business rule shares IoCs, the tab shows No unified mapping business rule shares to Threat Exchange yet.

Top 10 Active IoCs by External Hits

This section displays a table showing the top 10 indicators that all plugins have matched against, sorted by the number of external hits. The table includes:

• Value: The actual IoC value.
• Type: The type of IoC (md5, sha256, url, etc.).
• Hits: The number of times this IoC has been seen by non-Netskope connectors.

Top 10 Active IoCs by Reputation

This section shows a table of the top 10 active indicators sorted by reputation score. The table includes:

• Value: The actual IoC value.
• Type: The type of IoC (md5, sha256, domain, etc.).
• Reputation: The reputation score assigned to the IoC.

Note

If the Indicators are getting migrated, you will see this message in UI, Migration procedure is currently under progress, there won’t be any functionality issues as a result. This message will be removed from the UI after the migration of indicators is completed.

Click the Risk Exchange tab to view overall user activity.

The Risk Exchange Dashboard contains the following information:

Summary

The Summary section provides an overview of key metrics:

• Total Record Sources: How many vendor plugins have been configured and connected.
• Total Records Fetched: For each entity (Entity Name), shows how many records have been fetched for each table.
• Total Actions Performed: The total number of actions performed on hosts, applications and users.

Plugin Status

The Plugin Status section shows a table of all configured risk exchange plugins with their names, types, and current status.

• Name: The name of the configuration.
• Plugin: The Name of plugin/platform.
• Status: Current status of the plugin (Enabled or Disabled).

CRE Analytics Overview

The CRE Analytics Overview section provides detailed visualizations of pulled records and action logs through two interactive tabs.

Pulled Records Tab

This tab displays a bar chart showing the number of records pulled for each entity with the following features:

Filters:

• Entity: Multi-select filter to view records for specific entities. All entities are selected by default.
• Time Range: Filter by time period (All Time, Last 10 Minutes, Last 30 Minutes, Last 60 Minutes, or Custom Range)
• Custom Range: When “Custom Range” is selected, specify exact start and end dates with time.

Chart Details:

• Each bar represents an entity, and the height of the bar indicates the total number of records pulled for that entity.
• Click on any bar to navigate to the Records page with the selected entity and time range filters applied.
• Data labels show the exact record count above each bar.

Action Logs Tab

This tab displays a stacked bar chart showing action counts broken down by status with the following features:

Filters:

• Business Rule: Select a specific business rule to filter action records. The list includes Risk Exchange business rule or a Unified mapping business rule that have Risk Exchange actions configured.
• Destination Plugin: Select a destination plugin to filter actions.
• Actions: Multi-select filter to view specific action types. All actions are selected by default.
• Time Range: Filter by time period (All Time, Last 10 Minutes, Last 30 Minutes, Last 60 Minutes, or Custom Range)
• Custom Range: When “Custom Range” is selected, specify exact start and end dates with time.

Chart Details:

• Each bar represents an action name, with bars stacked by status with color coding:
  • Green: Success
  • Red: Failed
  • Orange: Pending Approval
  • Blue: Scheduled
  • Purple: Declined
• Click on any bar segment to navigate to the Action Logs page with the selected filters applied.
• Total count is displayed above each bar.
• Legend allows toggling visibility of specific status categories.

Click the Exact Data Match tab to view overall user activity.

The Exact Data Match dashboard contains the following information.

Summary

The Summary section provides an overview of key metrics:

• Total Configured Plugins: How many vendor plugins have been configured.
• Total EDM Hash Sources: Total Number of sources for EDM hashes.
• Total EDM Hashes Shared: The total number of EDM hashes shared.
• Total EDM Hashes Received: Total number of EDM hashes received.

Plugin Status

The Plugin Status section shows a table of all configured EDM plugins with their names, types, and current status.

• Name: The name of the configuration.
• Plugin: The Name of plugin/platform.
• Status: Current status of the plugin (Enabled or Disabled).

Recent Plugin Updates

The Recent Plugin Updates section shows a table of all recent updated plugins with plugin name.

• Plugin: The Name of the plugin.
• Last Updated By: Displays the user who last updated the plugin.
• Last Updated At: Displays the time when the plugin was last updated.

Hashes Upload Distribution by Netskope CE/Tenant

The Hashes Upload Distribution by Netskope CE/Tenant shows the pie chart for hashes upload distribution by Netskope CE/Tenant.

Manual CSV Hashing and Upload Status

The Manual CSV Hashing and Upload Status shows the file name, target and upload status.

• Name: Name of the CSV hashing file.
• Target: Specifies the target plugin with which the user shared the file.
• Status: Status shows whether upload is Completed or Failed.

Hashes Shared to Another Netskope CE/Tenant

The Hashes Shared to Another Netskope CE/Tenant shows a table of all the hashes shared to another Netskope CE.

• File Name: Hashing File Name.
• Configuration Name: Configuration Name with which the hashes shared.
• Last Shared At: Indicates the time when the hashes were shared.

Hashes Received from Another Netskope CE

The Hashes Received from Another Netskope CE shows a table for the hashes received from another Netskope CE.

• File Name: The name of the file hashing file.
• Configuration Name: Configuration Name from which hashes received.
• Last Received At: Indicated the time when the hashes were received.

Click the Custom File Classification tab to view overall user activity.

The Custom File Classification dashboard contains the following information.

Summary

The Summary section provides an overview of key metrics:

• Total Configured Plugins: How many vendor plugins have been configured.
• Total CFC Image Sources: Total Configured Image Sources.
• Total CFC images Shared: The total number of images shared.
• Total Classifiers Trained: Total number of classifier trained.

Plugin Status

The Plugin Status section shows a table of all configured CFC plugins with their names, types, and current status.

• Name: The name of the configuration.
• Plugin: The Name of plugin/platform.
• Status: Current status of the plugin (Enabled or Disabled).

Recent Plugin Updates

The Recent Plugin Updates section shows a table of all recent updated plugins with plugin name.

• Plugin: The Name of the plugin.
• Last Updated By: Displays the user who last updated the plugin.
• Last Updated At: Displays the time when the plugin was last updated.

Manual Images Hashing and Sharing Status

The Manual Images Hashing and Sharing Status section shows a table of all the manual images hashing with their sharing status.

• Name: Name of the user who shared the file.
• Target :Specifies the target plugin with which the user shared the file.
• Status : Status shows whether sharing Completed or Failed.

Destination Configuration Distribution by Sharing Configurations

The Destination Configuration Distribution by Sharing Configurations shows the pie chart for destination configurations.

Shared Images Distribution by Destination Configuration

The Shared Images Distribution by Destination Configuration shows the number of images used to train any classifier and can select the plugin from the dropdown.

Cloud Exchange records the tokens, duration, and outcome of every AI request. Users with AI Copilot read permission can navigate to Home page and select AI Analytics tab to see recorded activity.

Usage is attributed to one of three features throughout the dashboard:

• Configuration Copilot: The copilot chat which helps with configuration along with guided steps and page understanding.
• Posture Assessment: Uused for single-log and multi-log analysis.
• CRE Automapper: Helps with configuration of pull mappings of plugin fields.

Summary

The Summary section provides an at-a-glance view of AI activity for the selected time range. Hover over the information icon beside a value for its definition.

• Active Users: The number of distinct users who used an AI feature in this range. Use it to see how widely the AI features have been adopted, and whether usage is spread across your admins or concentrated in one or two.
• Round Trips: The total number of AI round trips, counting one per invocation. Each chat turn, single-log analysis, and posture assessment is one request and response to the model. This is the closest thing to a request count, and it is the figure to compare against your provider’s own rate limits.
• Total Tokens: Input and output tokens combined. Tokens are what providers bill on, so this is the raw consumption figure behind everything else on the dashboard.
• Est. Spend: An estimate of what that consumption cost.

Time Range

The Time Range filter applies to all charts and sections of AI Analytics. Use time range filters to get results for desired timeline.

Usage Over Time

An area chart of daily activity, with one series per AI feature. Use the selector above the chart to plot Tokens, Round Trips, or Cost (USD). This is the trend view, and shows the change in consumption of features. A rising Cost line is a warning that your provider bill is trending up. Each feature’s area reflects its own value rather than being stacked, so features can be compared directly.

Token Flow

A Sankey diagram that traces tokens through three stages: the feature that requested them, the model that served them, and the split between input and output token consumed.

Read it to understand where your consumption originates and where the cost lands. The diagram also makes it obvious when a feature is being served by a more expensive model than you expected.

Token Spend

A sunburst chart with three rings. The inner ring is the feature, the middle ring is the user, and the outer ring is the model. Click a segment to zoom into it, and click the centre to zoom back out.

Where the Sankey shows how tokens move across features and models, the sunburst helps to narrow it down per user. It shows the features used by a user and the models used for those features.

Model Mix & Est. Spend

A donut chart of the share of tokens served by each model, with the estimated total spend called out in the centre. Hover over a slice to see that model’s estimated cost.

Use it to confirm which models your deployment is actually using and what each one is costing. Because models differ significantly in price, a small slice by token count can still be a large share of the spend. This is the panel to check after changing the Model in your LLM Provider configuration, to confirm the change took effect and to compare the cost of the two periods.

Reliability & Latency

The Reliability & Latency section reports on the health of AI requests, and has three parts:

• A donut of successful against failed round trips. A healthy deployment is almost entirely green; a visible error share means requests are being rejected or are timing out.
• Top errors: the most frequent error types and their counts. This is where a wrong API key, a rate limit, or a provider outage shows up as a pattern rather than as a one-off toast message a user reported.
• A bar chart of average round-trip time per feature, in milliseconds. Posture Assessment is expected to be slower than a copilot turn because it reads and reasons over many logs; a copilot turn that is unusually slow points at provider latency or an overly broad request.

If the error share is significant, go to Settings > Logging and filter on the AI-COPILOT prefix to see what the failed requests reported.

Token Usage by Feature

A stacked bar chart of Input Tokens and Output Tokens per feature, with a selector for narrowing it to the features you want to compare.

This is the totals view behind the Usage Over Time trend, and the panel to use when you want a single number per feature for the period. The input-to-output split matters for cost: a feature that reads a lot of context but answers briefly, such as Posture Assessment, sits mostly in the input band, while a feature that produces long answers weights towards the more expensive output band.

Token Usage by User (Top 100)

A stacked bar chart of input and output tokens for each user, limited to the 100 highest consumers. Selectors above the chart let you narrow it to specific users, specific features, or both.

Use it for attribution: to see which accounts are driving consumption, to check a suspected spike against the user who caused it, or to confirm that usage is spread as you expect after rolling the AI features out to a wider group.

• If available disk space will reach below 35% then it will show following warning message in the UI. “You’re running out of disk space on your host. The available disk space is {available_space}%. The new data pull from Netskope will be paused soon. Please free up your disk space or provide additional disk space to resume the pulling. Refer to the Netskope Cloud Exchange sizing recommendations..”
  
• If available disk space will reach below 20% then the UI will display red banner warning with following message: “You’re running out of disk space on your host. The available disk space ({available_space}%) is critically low. The new data pull from Netskope has been paused. You will have to free up the disk space or provision additional disk space to make the available disk space more than 35% of the total disk space to resume the pulling. Refer to the Netskope Cloud Exchange sizing recommendations.”
  
• If the V2 API token has expired for the Netskope tenant, a red banner will appear with the following message: “The Netskope tenant API token has expired for Alliances Netskope. generate the new token or re-issue the token and update the tenant configuration to resume communication between Netskope Tenant and Cloud Exchange.”
  
• If the V2 API token is revoked or deleted from the Netskope platform, or if the token does not have all the necessary privileges, the following error message will be displayed: “Netskope API token of <TENANT_NAME> has been revoked, deleted or has insufficient privileges to continue pulling alerts and events from Netskope. Please check the required privileges and ensure that your API token has the necessary permissions to access the required resources.”
  
• When Cloud Exchange is unable to establish a connection with Netskope Analytics (https://reporting.netskope.tech), a yellow warning banner message will appear on the Cloud Exchange Settings Page with following message: “Unable to establish a connection with https://reporting.netskope.tech. Verify the network connectivity, proxy settings or firewall configurations to address the connectivity issues for enhanced product deployment and administration experience.”