Activity

FortiCASB monitors and tracks user data traffic and activities on your cloud platforms.

The Activity page contains both a map displaying (approximate) geolocations of events and activities list.

Activity Map options

• Activity—Click on an activity bubble on the map to bring up an activities at that specific location.



• Move—Move the map by clicking any point on the map and dragging with your mouse.
• Zoom—Use the buttons on the bottom-right corner of the map to zoom in and out.
• Refresh—Click the Refresh button to refresh the map.
• Clear Map—Click the Clear Map button to clear the map of activity indicators.

Activity Filter Example

1. Click on +Add Filter drop down menu.



2. Select a filter type, "Activity".



3. Then scroll down to select a type of activity, "Access File".



4. Then click Search button to update the search with the filter, only "Access File" activities will be shown in the time range.

Activity Alert Correlation

One activity may trigger multiple alerts, the multiple alerts are triggered by different policies.

For example, the Google Workspace event "Upload File" triggered 4 alerts, click on the alert button to see Alert Overview.

The Alert Overview page shows that this activity has triggered 4 different DLP policies:

DLP USA/Germany Passport Number Policy, DLP UK Passport Number Policy, DLP Birthday Policy, and DLP SSN Policy.

Daily cloud account activities will be compiled into Activity reports for export, please see Activity Report.