Before
Analysts manually searched usage events and application reports in separate security consoles for the same review window. They then reconciled application names, gathered user details, and compared policy or source signals before creating a shared summary.
How it works
- Define the review window and optional application filter, then collect AI usage events and application reports.
- Match applications across the sources and gather associated users and usage evidence.
- Return a standardized application view with policy signals, activity details, source health, and an overall summary.
Workflow details
- Scope the review: The flow starts from an optional application name and lookback period, defaulting to a 24-hour window when no period is supplied. It uses those inputs to focus the usage search on generative AI applications.
- Collect evidence: It gathers AI usage events from Netskope and application reporting data from Zscaler, including application names, users, actions, sanctioned state, risk information, transaction counts, and hosting details where available.
- Add user context: For the relevant applications, it retrieves application-user details and combines them with users identified in usage events, including an indication of personal usage in the Netskope evidence.
- Create a common view: Application names are standardized and matching records are combined into one entry per tool. The result includes source health, user counts and lists, policy and transaction signals, source-specific availability, and the most recent observed activity; this demonstration uses locally replayed synthetic responses.
What changed
Each run produces a common application-level view with matching users, usage and policy signals, and an explicit indication when a source is unavailable. Analysts receive the evidence in one structured result instead of performing the reconciliation and summary preparation by hand.
Work removed
Manually searching two security consoles, joining gateway reports, aligning application names, gathering user details, comparing source availability, and assembling the review summary.
Expected outcome
One automated run replaces at least three recurring reconciliation activities—collecting reports, matching applications, and gathering user context—while producing a consistent basis for application review and user follow-up.
