Reports using Advanced Analytics

Reports using Advanced Analytics

You can create, schedule, and download reports in the SSPM UI. These reports are generated by Netskope Advance Analytics. To learn more, refer to the Netskope Advance Analytics documentation.

SSPM provides the following two dashboards in the Netskope Library: 

• SaaS Security Posture Management

• SaaS Security Posture Management – Compliance

  Follow the steps below to access the dashboards:

1. Log in to your Netskope tenant.

2. Navigate to Advance Analytics > Netskope Library. You will see the list of Netskope Library dashboards.

3. In the Dashboard Name search box, search for “Dashboard Name ~ saas” and click Enter to search. The page shows “SaaS Security Posture Management” and “SaaS Security Posture Management – Compliance” dashboards in the results. Click the name to navigate to the individual dashboards.

   

   You can mark the dashboards as favorite and also see them in the Advance Analytics > Favorite tab for easy access. To learn more, visit Advanced Analytics Favorites Folder article.

   It will take approximately 2 hours for the finding information to reflect on the SSPM dashboards in Advanced Analytics.

   SaaS Security Posture Management Dashboard

   This dashboard shows a summary of findings and configured instances. In the metrics section, account level details include:

   • Total Findings – shows the number of findings.

   • Total Failed Findings – shows the number of failed findings out of the total findings.

   • Total Passed Findings – shows the number of passed findings out of the total findings.

   • Pass Rate – shows the aggregated pass rate of a total number of findings.

   

   The table of Configured Instances by Application shows a list of app names and their instance names. The Failed Findings by App and Severity chart shows the bar graph for different apps configured in your tenant with failed critical, high, medium, and low severity. When you hover over the bars, you can see the number of that particular failed finding and app name.

   

   The Failed Findings by Severity pie chart shows the representation of total findings for the different severity levels. When you hover the pie chart, you can see the number of failed findings for the specific severity. You can also click the severity levels in the chart index to remove it from the pie chart display. 

   The Failures by Severity Breakdown table shows the per rule severity breakdown with the number of failed findings. 

   The Compliance Failure by Severity chart shows the list of compliance standards with the number of failed findings for each severity. The default display is a tabular format.

   

   The Failed Findings by Domain table provides a breakdown of count of failed findings by SaaS app across various domains supported by SSPM, including 3rd Party Apps, Application, Auditing & Logging, Authentication, Data & File Security, Device Security, Encryption, and IAM.

   The Failed Findings by MITRE ATT&CK table provides a breakdown of count of failed findings by SaaS app for various MITRE ATT&CK supported by SSPM, such as Initial Access, Privilege Escalation, Defense Evasion, Discovery, and Lateral Movement.

   

   You can see the details of all the findings in the Posture Findings table with the app name, its instance name, rule name, pass or fail status, rule severity, rule description, link to remediation steps, and resource name. Click on the remediation step hyperlink to see them in the SSPM UI.

   

   The null value symbol in the report means the data for that attribute is not available.

   SaaS Security Posture Management – Compliance Dashboard

   This dashboard shows a compliance summary of findings. You need to choose a Compliance Standard in the filters to view findings, by default, ‘AICPA-SOC-TSC-2017’ is the selected compliance standard. In the metrics section, you will see the tenant level compliance details:

   • Compliance Standard Selected – shows the name of the compliance standard selected in the filter.

   • Total Findings – shows the number of findings of the compliance standard selected in the filter.

   • Total Failed Findings – shows the number of failed findings of the compliance standard selected in the filter.

   • Total Pass Findings – shows the number of passed findings from total findings compliance standard selected in the filter.

   • Pass Rate – shows the aggregated pass rate of a total number of findings.

   

   You can see the details of all the findings in the Posture Findings table with the app name, its instance name, rule name, compliance section, compliance control, pass or fail status, rule severity, resource name, and link to remediation steps.

   

   Create an SSPM Dashboard Report

   Follow the steps to generate SSPM reports:

   1. Log in to your Netskope tenant.

   2. Navigate to Advance Analytics > Netskope Library. You will see the list of Netskope Library dashboards.

   3. In the Dashboard Name search box, search for “Dashboard Name ~ saas” and click Enter to search. The page shows “SaaS Security Posture Management” and “SaaS Security Posture Management – Compliance” dashboards in the results. Click on any of the dashboard to generate the report.

   4. Click the three dots > Download to download the reports in the following formats:

      

• CSV – select CSV and click download to generate and save the report.

• PDF – select PDF and choose the paper size, and click download to generate and save the reports.