What are SaaS Events?

Overview

Users depend on SaaS applications for their daily work, and many of the actions that put your data at risk happen inside those applications: a user downloads a large customer report, an administrator changes a security setting, or a new account is given administrator permissions. To detect these actions, you need visibility into the activity inside each application, not only into the traffic that reaches it.

Cato collects two types of SaaS events:

• App Activities: Cato connects directly to the API of each connected application and collects its audit logs. This provides out-of-band visibility of all activity in the application, by every user, even if the user isn't connected to the Cato Cloud or TLS Inspection is disabled. To make activity from different applications easy to compare, Cato maps each activity to an Activity Category.

• SaaS Alerts: Cato runs detections on App Activities to identify behavior associated with techniques used in real attacks, such as account takeover, persistence, and data exfiltration. You can also bring in security alerts from other vendors with SaaS alert connectors.

You can review SaaS events in these places in the CMA:

• The Activities tab of the Cloud Apps Dashboard. For more information, see Using the Cloud Apps Dashboard

• The SaaS Events section of the Cloud Apps Dashboard Overview tab, including the Alerts to Review widget.  For more information, see Using the Cloud Apps Dashboard

• The Events page

A CASB license is required for SaaS Events. For more about purchasing a CASB license, please contact your Cato representative.

Use cases

Use cases for SaaS Events include:

Suspicious Downloads

A contractor on an unmanaged device downloads 10MB of Salesforce reports with customer personal data each week. In one day the contractor downloads 5GB of customer personal data. From reviewing the Cloud Apps Dashboard, the security team can identify this behavioral anomaly and analyze if it is suspicious.

Employee Offboarding

A developer that uses their own device is leaving company ABC. They have access to a SharePoint with presentations containing sensitive intellectual property. On the Events page, the security team can filter for the SharePoint activities taken by the developer to ensure they did not download the intellectual property before leaving the company.

Mailbox Takeover

An attacker steals an employee's Microsoft 365 session with a phishing page and signs in. To read the employee's email without being noticed, the attacker creates an inbox rule that forwards email to an external address. A SaaS alert is raised for the rule. The security team reviews the alert, finds the attacker's sign-in in App Activities, removes the rule, revokes the employee's sessions, and resets their credentials.

Supported Applications

For the applications that support App Activities, see App Activities Connectors . For SaaS alert integrations, see SaaS Alert Connectors.

Prerequisites

• To add a connector, you must have editor permission for Integrations (in the Resources section) and App & Data API Protection (in the App & Data Control section). For more information, see Managing Admin Roles Using RBAC.

Understanding Inline and API Visibility

App Activities complements the inline visibility of Application Control. Inline events are available for traffic that passes through the Cato Cloud. Activity-level inline events require Application Control and TLS Inspection. App Activities covers all users of a connected application, including unmanaged users. Events from both are shown together in the Cloud Apps Dashboard and the Events page.

For more information, see What is SaaS Security?

Understanding Activity Categories

Different SaaS applications use different terms to describe the same action. For example, accessing a report could be called Exporting, Downloading, or Fetching. This creates a challenge when trying to understand what actions users are taking.

With Activity Categories, Cato maps activities in a SaaS application into a general category. This lets you track, filter, and visualize SaaS application activity, without needing to understand detailed processes in each application.

Activity Categories apply to activities monitored by your Application Control policy and by App Activities connectors. They are a field in Application Security API events, and you can use them to filter activities in the Cloud Apps Dashboard. This ensures a consistent view across inline and API-based visibility.

The Activity Categories are: