Review what Single Sign-on De-Idenfiation is and how impacts the information included in events; this does impact what data is generated in logs and other informational tables.
This action hides the hostname, internal IP address, and username of end users in Secure Access reports, replacing identity with a one-to-one hash.
The Security Activity report highlights security events generated by your organization's sources visiting destinations flagged—but not necessarily blocked—by Secure Access security researchers as a threat. Activities captured by this report include attempts to access sites hosting malware or phishing sites, botnet activity on infected machines on your local network, and attempts to download malicious files.