Overview
Netskope One DSPM’s Activity Logs is a recorded history of all important user and system activities, including record changes (creation, edits, and deletion) and actions initiated. Platform users can review, filter, and export this history for use in their security & compliance-related duties.
Accessing Activity Logs
Platform users with the necessary permission can access Activity Logs via the following steps:
- Log into the Netskope One DSPM platform.
- Navigate to Administration > Activity Logs.
- The Activity Logs screen is displayed.
The Activity Logs screen is divided into three tabs, each recording different types of information. See below for details on using each specific tab.
User Activity Tab
The User Activity tab is a record of user-initiated actions & record changes. Examples of user activity include:
- Creation, updates, and deletion of all records
- User activities, such as Data Store discovery, etc.
When you visit the tab, a table is displayed with the following information:
| Column Name | Details |
|---|---|
| Date/Time (UTC) | Timestamp representing when the activity occurred |
| Type | Nature of the activity. Possible values include: Create, Read, Update, Delete |
| Username | Netskope Administrator name who performed the activity Note: For legacy Dasera customers, this field may also contain the Platform User Name as well.” |
| Resource | Area of the platform where the activity occurred. Possible values (and the areas they cover) include: – Administration – Authentication – Alert – Classification – Data Store – Data Tag – Licensing – Platform Settings – Policy – Task – User Identity |
| Description | Details of the activity. Hover over truncated values to view the entire content. When available, this will include a unique identifier for named records such as Classification Field, Policy Name, etc |
| Actions | Click the View icon to display the activity record in a dedicated modal to assist with readability and printing. |
Netskope One DSPM offers the following methods for narrowing the on-screen display of records:
- Enter a text string that matches against any field.
- Click on the Filter dropdown to filter by one-or-more values of specific fields.
If you wish to review the displayed records offline, click the CSV Export icon to generate a comma-separated values (CSV) file, which you can then research within separate tools such as Microsoft Excel and Google Sheets.
System Activity Tab
The System Activity tab is a record of platform-initiated actions. Examples of system activity include:
- Discovery of new assets, such as Infrastructure Accounts, Data Stores, etc.
- Scan failures
When you visit the tab, a table is displayed with the following information:
| Column Name | Details |
|---|---|
| Date/Time (UTC) | Timestamp representing when the activity occurred |
| Type | Nature of the activity. Possible values include: Error, Fatal, Info, Warning, Scan |
| Notification | Details of the activity. Hover over truncated values to view the entire content. |
| Actions | Bold rows represent unread system activity records. For unread records, click the Notification Read icon to acknowledge the record. The icon will be replaced by a Notification Unread icon; click this to reverse any acknowledgement. |
Netskope One DSPM offers the following methods for narrowing the on-screen display of records:
- Enter a text string that matches against any field.
- Click on the Filter dropdown to filter by one-or-more values of specific fields.
If you wish to review the displayed records offline, click the CSV Export icon to generate a comma-separated values (CSV) file, which you can then analyze using tools such as Microsoft Excel and Google Sheets.
Scan Activity Tab
The Scan Activity tab is a record of all scheduled and manual data store scan activity. Examples of scan activity include:
- Completed scans
- Aborted scans
- Failed scan
When you visit the tab, a table is displayed with the following information:
| Column Name | Details |
|---|---|
| Date/Time (UTC) | Timestamp representing when the activity occurred. |
| Type | Scheduled: resulting from a scan frequency Manual: user-initiated scan. |
| Data Store | Name of the affected data store. Hyperlink to the overview in Data Store Inventory. |
| Sidecar Pool Name | Sidecar pool associated with the data store. Hyperlink to the Sidecar Administration screen. Blank if none. |
| Sidecar Name | Sidecar that scanned this data store. Blank if none. |
| Description | Details of the scan. Hover over truncated values to view the entire content. |
| Scan Result | Fail, Complete, or Aborted. |
Netskope One DSPM offers the following methods for narrowing the on-screen display of records:
- Enter a text string that matches against any field
- Click on the Filter dropdown to filter by one-or-more values of specific fields.
If you wish to review the displayed records offline, click the CSV Export icon to generate a comma-separated values (CSV) file, which you can then research within separate tools such as Microsoft Excel and Google Sheets.