CloudSOC CASB Gateway

Hi,

I am very new to CASB and is trying to figure things out. I have a very basic question and please bare with me.

I am interested to export the filtered activities from O365 securlet. I was able to obtain the csv report but I noticed that when I try to open the .csv file in excel, the last column under Other header, it has a bunch of text with all the information contain in a single column. For example, Sub_Feature, domain, doc_class,filename,file size,training profiles, uba detection,risks,expressions etc are all in 1 column. How can I seperate those into seperate columns so that it is easier to view the results?

Thanks

--Kim

Hi Kim!

Currently it's a challenging function. What is happening that not all rows have the same number of items. Items in a column are currently separated based on "space".

There is an enhancement ticket open. Thank you for reporting/confirming.

Meanwhile, you'll need to perform a little Google-fu on the Excel side.

Oh, that's not too good. Reporting function will be key for analysis.

I hope this enchancement comes quick as the dashboard does not provide enough flexibility to perform further analysis and the only way is the export the report.

Yeah did some googling and trying to replace the character, but it's no help. The csv has comma as separator for the first few columns but when it is the last column, the separator is inconsistent, it has the weird u'' separator and = sign separator. I think it can be easily be fixed if the separator is consistent. Just have all the columns exportable and if there are no datas in some columns just leave it blank.

Please feedback to the development team.

Done and done! I have added to the Assembla ticket.

Thank you so much!

I don't know your specific use case or specific reporting you are wanting to do, but you might have better luck setting up a custom dashboard and using the Schedule Report functionality than exporting filtered results to CSV. The tech note "Customizing CloudSOC Dashboards" can walk you through how to set up custom widgets with the information you are looking for and how to configure report schedules. You can access this tech note from your tenant, as described in this article: https://support.symantec.com/us/en/article.tech253002.html