RiskVision cloud app reports

Using Reports | TRITON RiskVision | 02-Jun-2016

Use the Reporting > Cloud Apps tab to see a summary of high-risk cloud app use in your network. Each chart on the page can be toggled between pie chart and bar chart format.

These charts show data that is initially aggregated from the database 30 seconds after the Data Server service starts. The aggregation then is updated every 6 hours.

The Top High Risk Cloud Apps chart shows the high risk cloud-based applications most accessed in your network.

Details about why each of the cloud apps in the chart is considered high risk can be found in the Transaction Viewer on the Incidents page. To find information about a specific cloud app:

Navigate to the Incidents page.

Change the table View to Cloud App.

Enter the name of the cloud app you want to research in the Filter field.

Make sure View Details is ON, then select a record in the table.

Select the Cloud App tab of the Details pane.

The Cloud App tab provides information about the app and its provider, as well as details about the risk factors used to determine that the app is high risk.

The Top Users of High Risk Cloud Apps chart shows the users who have most frequently accessed high risk cloud apps.

If user name information is not available, the source IP address of the machine used to access the cloud apps is shown instead.

Use the Transaction Viewer on the Incidents page to find out if there is activity consistent with malicious or suspicious software, or with data loss or data theft, also associated with the users of high risk cloud apps.

For more information about the cloud apps or users shown in the charts, generate a presentation report that includes either or both of the Cloud App reports on the Executive Reports tab. See Generating RiskVision presentation reports.

For more tips on researching cloud app-related incidents, see Using RiskVision to Investigate Cloud App Use.