(old 12-6-19) Cloud Services Report

The Centralized Reports > Cloud Services report gives you insight into the cloud-based applications that your organizations are using so that you can look to mitigate, restrict, or supplement their usage.

This information can be used in several ways:

Find out if there are users with a software need for which there isn't a formal tool. For instance, if your users are using an online storage system instead of the file server, this could be in order to boost their productivity rather than bypass security.
Find cloud services that are being used to bypass the traditional safeguards you have in place for data loss prevention. Knowing that it's being used can assist in better securing your work environment from the loss of personally identifiable data or confidential company information.

The Cloud Services summary includes the number of Cloud Services seen over the specified time period. This summary includes the number of new cloud services for that time period.

Cloud Services—The number of individual discrete cloud services observed being accessed by identities within your organization over the time period set in the filter.
Never Before Seen—The number of cloud services—seen over the time period set in the filter—that are new to your organization's usage.

Searching

The Cloud Services report includes an Advanced Filter, which allows you to specify the Find or Filter options from drop-down lists.

How does the Cloud Service Report work?

The Cloud Services report takes DNS information about your organization's user behavior when accessing services in the cloud and matches it to known domains for these services. Because of Umbrella's “any device, anywhere, anytime” approach, Umbrella is able to let you know about cloud services that your organizations are using even when they're not on the network. Umbrella discovers all cloud services in use, including email, file sharing, SaaS, IaaS, and PaaS services and reports on their use.

Data from an organization's Umbrella dashboard, including settings for identities, is checked and matched against the DNS traffic from your organization to specific cloud services to let you know more about how your users are using cloud services. The report includes trends for any new services being adopted, including dates when they were first used and last seen.

How are Cloud Services determined?

These days, nearly everyone uses online storage, web-based email, collaboration tools, educational sites or social media in their personal and professional lives. For this report, a 'cloud service' is any of the hundreds of SaaS, IaaS, PaaS or other "cloud" computing services available today. In fact, Umbrella itself is a cloud service and is listed as one in the report.

We've compiled a list of thousands of cloud services ranging from very small companies to software giants. If a domain that’s been visited by someone in your organization matches a domain we've identified as part of a cloud service, there’s a match for that cloud service in the report. The cloud services report provides details on which URL each cloud service consists.

Ensuring request logging is enabled

In order for the report to generate data, logging of content requests must be enabled in the organizations's policies—it's enabled by default. However, if you have disabled logging, you will need to re-enable it in order for the Cloud Services report to have data to display.

Logging is required for the requests for these cloud services because they are not security events (for example, malware), but content related DNS queries.

It’s also important that the policy with logging enabled is in the proper order for policy hierarchy so that it can collect events from all relevant identities.

If logging is currently disabled:

In the organization's Umbrella dashboard, navigate to the policy's Summary page.
Under Advanced Settings, if Log All Request is a grey shield, click Use Custom Settings to make logging editable.

Select Log All Requests.

Click Save.

List of Cloud Services

The Cloud Services report then lists all of the Cloud Services that your organizations have seen in their environments. This isn't the total list of all Cloud Services that Umbrella could list, just the ones that have been seen in the time frame specified in the report. By default, the report is sorted with the cloud service with the highest number of requests at the top, but each column is sortable, so you can pinpoint features that are of importance.

Name—The name of the cloud service itself. For more information regarding what this service is, select the service and click it.
Classification—Classifications describe what the service is typically used for. Each service has one or more classifications. For a complete list of cloud service classifications, click Filter by Classification in the lower left.
Orgs—The number of organizations using this service.
Identities—The number of identities within your organization accessing this cloud service.
Trend—The increase or decrease in the number of identities requesting this cloud service over the time period selected.
Requests—The total number of requests for this cloud service from your organization over the time period selected.
Blocked—Percentage of your requests for a service that were blocked over the time period selected.
First Seen—The date at which this service was first seen being used by identities within your organization.
Last Seen—The date that the most recent request for a service was made.

Service Detail

You can drill down into each cloud service to show a report of the use of individual services by your organizations.

Click the name of a cloud service.

Details of the cloud service are displayed.

The details for each service are:

Website—The website is for the company that provides the cloud service. In this case, the name of the cloud service and the company name are the same but that is not always the case.
Cloud Service Domains—This is the list of URLs that Umbrella has matched against to determine if the cloud service is in use. Often a cloud service will only have one cloud service domain. However, if a service has more than one, if a user visits any one of the cloud service domains listed, it's considered a match. In the example of Twitter, there's only one domain that matches this service. However, if there were more than four or five domains, clicking the (+) plus symbol will show the rest.
Classifications—The types or classifications of the service is shown. In this example, there is only one, but a cloud service can belong to multiple classifications.
Description—A brief description of the cloud service gives perspective on what this cloud service is and what potential IT services it provides for the users using the service.

Below the details for the Service, statistics specific to the total number of organizations and identities help you to get a good sense of trend over time for this service and are most helpful when comparing two time periods.

Total Orgs—The total number of organizations that have used this cloud service in the date range specified.
Total Identity Count—The total number of identities from all of the organizations that have used this cloud service in the date range specified.
Total Requests—The total number of requests to this cloud service. Requests by individual identity can be broken down within the organizations's own dashboard. Includes the percentage of these requests allowed or blocked by your organization's configurations.

Lastly, when you click the name of the organization, you are taken directly to that organization's Umbrella dashboard and into the cloud services report for their organization. Umbrella pre-filters the report for the cloud service you drilled through, so you can see the identities within each organization's environment and what they're using.

Security Summary Report < Cloud Services Report > Manage Console Settings