--- title: "What is Application Control via API with App Activities" slug: "what-are-saas-events" tags: ["CASB", "Internet Security"] updated: 2026-11-03T14:32:24Z published: 2026-11-03T14:32:24Z canonical: "knowledge.catonetworks.com/what-are-saas-events" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt > Use this file to discover all available pages before exploring further. # What are SaaS Events? ## Overview Users depend on SaaS applications for their daily work, and many of the actions that put your data at risk happen inside those applications: a user downloads a large customer report, an administrator changes a security setting, or a new account is given administrator permissions. To detect these actions, you need visibility into the activity inside each application, not only into the traffic that reaches it. Cato collects two types of SaaS events: - **App Activities**: Cato connects directly to the API of each connected application and collects its audit logs. This provides out-of-band visibility of all activity in the application, by every user, even if the user isn't connected to the Cato Cloud or TLS Inspection is disabled. To make activity from different applications easy to compare, Cato maps each activity to an Activity Category. - **SaaS Alerts**: Cato runs detections on App Activities to identify behavior associated with techniques used in real attacks, such as account takeover, persistence, and data exfiltration. You can also bring in security alerts from other vendors with SaaS alert connectors. You can review SaaS events in these places in the CMA: - The **Activities** tab of the Cloud Apps Dashboard. For more information, see [Using the Cloud Apps Dashboard](/v1/docs/using-the-applications-dashboard) - The **SaaS Events** section of the Cloud Apps Dashboard Overview tab, including the Alerts to Review widget. For more information, see [Using the Cloud Apps Dashboard](/v1/docs/using-the-applications-dashboard) - The **Events** page A CASB license is required for SaaS Events. For more about purchasing a CASB license, please contact your Cato representative. ### Understanding Posture Drift and SaaS Alerts Posture drift and SaaS alerts are both detected in the audit logs collected by App Activities connector. They each have a distinct purpose: - **Posture Drift:** A SaaS Posture check that previously passed, but has now failed, weakening the security posture of the app’s configuration - **SaaS Alerts:** App Activities detections of suspicious post-breach activity (persistence, privilege escalation, exfiltration) ### Use cases Use cases for SaaS Events include: #### Suspicious Downloads A contractor on an unmanaged device downloads 10MB of Salesforce reports with customer personal data each week. In one day the contractor downloads 5GB of customer personal data. From reviewing the **Cloud Apps Dashboard**, the security team can identify this behavioral anomaly and analyze if it is suspicious. #### Employee Offboarding A developer that uses their own device is leaving company ABC. They have access to a SharePoint with presentations containing sensitive intellectual property. On the **Events** page, the security team can filter for the SharePoint activities taken by the developer to ensure they did not download the intellectual property before leaving the company. #### Mailbox Takeover An attacker steals an employee's Microsoft 365 session with a phishing page and signs in. To read the employee's email without being noticed, the attacker creates an inbox rule that forwards email to an external address. A SaaS alert is raised for the rule. The security team reviews the alert, finds the attacker's sign-in in App Activities, removes the rule, revokes the employee's sessions, and resets their credentials. #### Supported Applications For the applications that support App Activities, see [App Activities Connectors](https://knowledge.catonetworks.com/docs/app-activities-connectors) . For SaaS alert integrations, see [SaaS Alert Connectors](https://knowledge.catonetworks.com/docs/saas-anomalies-connectors). #### Prerequisites - To add a connector, you must have editor permission for **Integrations** (in the **Resources** section) and **App & Data API Protection** (in the **App & Data Control** section). For more information, see [Managing Admin Roles Using RBAC](/v1/docs/managing-admin-roles-using-rbac). ## Understanding Inline and API Visibility App Activities complements the inline visibility of Application Control. Inline events are available for traffic that passes through the Cato Cloud. Activity-level inline events require Application Control and TLS Inspection. App Activities covers all users of a connected application, including unmanaged users. Events from both are shown together in the Cloud Apps Dashboard and the Events page. For more information, see [What is SaaS Security?](/v1/docs/what-is-saas-security) ## Understanding Activity Categories Different SaaS applications use different terms to describe the same action. For example, accessing a report could be called Exporting, Downloading, or Fetching. This creates a challenge when trying to understand what actions users are taking. With Activity Categories, Cato maps activities in a SaaS application into a general category. This lets you track, filter, and visualize SaaS application activity, without needing to understand detailed processes in each application. Activity Categories apply to activities monitored by your Application Control policy and by App Activities connectors. They are a field in Application Security API events, and you can use them to filter activities in the Cloud Apps Dashboard. This ensures a consistent view across inline and API-based visibility. The Activity Categories are: | Activity Category | Example Actions | | --- | --- | | Admin Settings | User creation, Quarantine, Change permissions | | API and Integration Execution | Automation, scripts via API | | Communication & Collaboration | Chat, Video, Voice | | Content Operations other | Upload, Download, Move | | Delete | Deleting data | | Download | Downloading a report | | Execution | Automation, scripts | | Failed Login | Failed login | | Login other | Login, Logout | | Move | Moving the location of a report | | Search and View | View report | | Share | Sharing via link | | Upload | Uploading data |