Discovered app Security Breach query

[Christo De Lange]

Hi All

I am trying to understand the CAS Dashboard alerts and need a bit of guidance and understanding, please

I see an alert for "Discovered app security breach" for Premera Blue Cross.(See Fig 1 attached)

I click on the app and it shows I have 2 active users, 6 transactions. but no alerts!  (See Fig 2 and 3 attached)

The 2 "active" users it claims accessed this app are actually 2 of our IT Team browsing the relevant url related to the breached app to determine what's on the website. 

I am confused why they would be listed as active users, if we have no alerts and they don't have any apps installed related to "Premera Blue Cross". Confused.com! Any pointers would be very much appreciated   

Thanks in advance

[#2]

@Christo De Lange 

That's a built-in alert in the product when we know there is a public breach with a specific application. Since there are users in your network who've accessed this application based on your traffic logs - we're letting you know that there is breach associated with this application. 

The discovery dashboard is based on your traffic logs which we parse and create the dashboard with. Please let me know if this answers your question. 

https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery

[#3]

Hi Banu
@Banu Jafarli 

Thanks so much for your reply. Ok I understand the built-in alert for breached apps(Kudos!), I also understand traffic logs would advise that there was traffic between 2 of our computer clients and a URL associated with a breached app, however, the 2 users do not have the associated app installed or use it, they simply browsed to a website to investigate the URL.

Which then looks to me like a false alert. No breached app was actually in use. So my understanding now is the dashboard alert is based on traffic logs between two points(One being host to a breached app) rather than traffic between a specific "breached" application and our clients. Hope this makes sense?