The SaaS Application Usage PDF report is a two-part report that allows you to easily
explore SaaS application activity by risk and sanction state. A sanctioned
application is an application that you formally approve for use on your network. A
SaaS application is an application that has the characteristic SaaS=yes in the
applications details page in , all other applications are considered as non-SaaS. To indicate that
you have sanctioned a SaaS or non-SaaS application, you must tag it with the
predefined tag named Sanctioned. The firewall and Panorama consider any application
without this predefined tag as unsanctioned for use on the network.
The first part of the report presents the key findings for the SaaS
applications on your network during the reporting period with a comparison
of the sanctioned versus unsanctioned applications and lists the top
applications based on sanction state by usage, compliance, and data
transfers. To help you identify and explore the extent of high risk
application usage, the applications with risky characteristics section of
the report lists the SaaS applications with the following unfavorable
hosting characteristics: certifications achieved, past data breaches,
support for IP-based restrictions, financial viability, and terms of
service. You can also view a comparison of sanctioned versus unsanctioned
SaaS applications by total number of applications used on your network,
bandwidth consumed by these applications, the number of users using these
applications, top user groups that use the largest number of SaaS
applications, and the top user groups that transfer the largest volume of
data through sanctioned and unsanctioned SaaS applications. This first part
of the report also highlights the top SaaS application subcategories listed
in order by maximum number of applications used, the number of users, and
the amount of data (bytes) transferred in each application subcategory.
The second part of the report focuses on the detailed browsing information
for SaaS and non-SaaS applications for each application subcategory listed
in the first-part of the report. For each application in a subcategory, it
also includes information about the top users who transferred data, the top
blocked or alerted file types, and the top threats for each application. In
addition, this section of the report tallies samples for each application
that the firewall submitted for WildFire analysis, and the number of samples
determined to be benign and malicious.
Use the insights from this report to consolidate the list of business-critical and
approved SaaS applications and to enforce policies for controlling unsanctioned and
risky applications that pose unnecessary risks for malware propagation and data
leaks.
The predefined SaaS application usage report is still available as a daily
View Reports that lists the top 100 SaaS applications
(which means applications with the SaaS application characteristic, SaaS=yes)
running on your network on a given day. This report does not give visibility
into applications you have designated as sanctioned, but rather gives visibility
into all of the SaaS applications in use on your network.
Ensure that all prerequisites are met to enable this report generation on new
deployments.
- Enable logging on security policies. If you don't enable logging, the
report will be empty.
- Select .
- Select the rule.
- Select Actions.
- Enable Log at Session End
- Click OK.
- Commit.
- Plan for a 24-hour period before running the report. After logging is
enabled and traffic is flowing, allow at least 24 hours before running the
report. Traffic log summation runs on an hourly cycle.
- Set the date range to match the deployment date. The report can only show
data from the date the firewall began passing live traffic. Set the report start
date to the deployment date, not the first day of the calendar month. For
example, if you deployed a firewall on September 7, set the report start date to
that date, not September 1. Partial month coverage is expected behavior for new
deployments, and is not a data loss issue.
