User Profile
Caroline_Lee
Joined 6 years ago
User Widgets
Recent Discussions
Re: Snapshot report from 2 gb Cisco ASA Firewall logs only showing 8 Apps?
Lassekatten Hi Lars, since you've checked the log format, size and time period there's no reason I can think of as to why you're only seeing 8 apps. I'd recommend opening a support ticket for this issue.1.2KViews0likes0CommentsRe: Snapshot report from 2 gb Cisco ASA Firewall logs only showing 8 Apps?
Lassekatten Hi, there is a size limit for each log upload (1GB), that could be the reason. Also, do the logs contain any entries outside of the 90 day period? Link to snapshot doc: https://docs.microsoft.com/en-us/cloud-app-security/create-snapshot-cloud-discovery-reports1.2KViews0likes2CommentsRe: Created Policy - What is the difference: Alerts vs Activity?
SergioT1228 Great question! The activity log will be a view of all the activities performed in your connected applications. This could range from a log on, file download, task creation, etc where as an alert will notify you of a potential threat in your cloud environment. The reason why you may be seeing more failed log ons in activity log vs. in the alert panel is because sometimes failed logins can be normal behavior (i.e. user forgetting their password). This could also depend on how you've scoped your policy i.e. alert on 10 repeated failed log-ons in a 5 min time interval would only result in 1 alert but 10 entries in activity log. There is also specific anomaly detection policy based off of User Entity Behavior Analytics (UEBA), where MCAS studies the behavior of the user for 7 days and establishes a baseline for each user and will alert on any unusual behavior. Investigating multiple failed logon attempts: https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts#multiple-failed-login-attempts Activities in MCAS: https://docs.microsoft.com/en-us/cloud-app-security/activity-filters Does that answer your question?1.3KViews1like0CommentsRe: Log collector error from columbus
mlmcadams Hi! Could you try these two options & see if they work for you? The error code 301 at the end references permanent URL redirection, meaning current links or records using the URL that the response is received for should be updated. Check log collector version make sure it TLS 1.2+, you can check by running the following command prompt: docker exec -it <LogCollectorName> ls -l /etc/adallom/components/columbus/columbus.jar1.6KViews0likes0Comments