App Discovery Report

• Unreviewed—The app has not yet been assigned any label.

• Under Audit—The app is currently being reviewed.

• Not Approved—The app should not be approved for use in your environment.

• Approved—The app may be used in your environment.

Note

Once you relabel an Unreviewed app, you cannot change the app label back to Unreviewed. Use the Under Audit label for apps that still need review.

Note

Labels do not automatically block apps from use. You must configure a rule to block specific apps or apps with specific labels. For more information, see Control Apps.

Cisco's Cloud Security researchers categorize apps according to function, source, and other factors. The categories of most interest (and most risk) are:

• Anonymizers—Services that provide an anonymous proxy tool that attempts to make activity on the Internet untraceable. Apps in this category can introduce data exfiltration risks.

• Cloud Storage—Applications that offer massively scalable storage capacity that can be used for applications and file storage. Apps in this category can also be used for data exfiltration.

• Collaboration—Applications that may store sensitive data in unreliable services or unsecured environments.

• Games—Online and mobile games. While games are not notable for data exfiltration risks, some can be used as attractive ways to introduce malware.

• Generative AI—Applications that have the potential to generate misleading or fraudulent content and copyright or intellectual property infringements.

• Media—Applications that can contribute to productivity loss and are frequently managed as unwanted bandwidth consumers.

• P2P—Peer to Peer torrents like apps and protocols. These apps can be used for data exfiltration.

• Social Networking—Can be used to transmit sensitive data as well as contribute to productivity loss.

For a complete list of application categories, see Application Categories.

These protocols are flagged based on the protocol used by the application.

Note

Dismissing a flagged app card hides it from the overview. It does not label or block the app.

The graph shows the total number of DNS requests for apps discovered in the past 30 days. Secure Access assigns a risk score to apps based on several factors. The DNS requests made by a high-risk app can be considered more problematic than the same number of requests made by an app with a lower risk score.

1. Filter the graph by label and risk.

   
   
   

2. Select Web and review Traffic (bytes in and out) by App Risk for the last 30 days.

   
   
   

3. View All Traffic, Outbound Traffic or Inbound Traffic.

   
   
   

Click a bar on the chart to view apps in that category in the App Grid.

1. Filter by label and risk.

   
   
   

The apps at the top of the list should now represent the highest number of DNS requests made by the riskiest apps.

• Unreviewed—The app has not yet been assigned any label.

• Approved—The app may be used in your environment.

• Not Approved—The app should not be approved for use in your environment.

• Under Audit—The app is currently under review.

Note

Once you relabel an Unreviewed app, you cannot change the app label back to Unreviewed. Use the Under Audit label for apps that still need review.

Note

Labels do not automatically block apps from use. You must configure a rule to block specific apps or apps with specific labels. For more information, see Control Apps.

You can filter the apps listed by apps that are controllable and apps that have advanced app controls.

For more information on how risk is calculated, see Risk Details.

For more information on app categories, see Application Categories.

• SaaS—Software as a service

• PaaS—Platform as a service

• IaaS—Infrastructure as a service

Note

Rearrange the order of settings by dragging and dropping the column fields,

• App Type—The type of app: SaaS, PaaS or IaaS.

• Blocked DNS—The percentage of DNS requests blocked by Secure Access based on policy configurations.

• Blocked Traffic—The percentage of all traffic blocked.

• DNS Requests—The number of DNS requests for this app.

• First Detected—The date the app was first detected.

• Identities—The number of identities affected by the app. Click this number to view the app's details and the list of identities with requests for that app.

• Inbound Traffic—Bytes inbound.

• Last Detected—The date the app was last detected.

• Outbound Traffic—Bytes outbound.

• Total Traffic—The total number of bytes inbound and outbound for this app in your environment.

• Vendor—The vendor that owns the app.

• Weighted Risk—The risk the app poses to the environment.

Note

Once you relabel an Unreviewed app, you cannot change the app label back to Unreviewed. Use the Under Audit label for apps that still need review.

Note

Labels do not automatically block apps from use. You must configure a rule to block specific apps or apps with specific labels. For more information, see Control Apps.

• Risk Score—The overall score assigned to the app. This could be calculated by Umbrella or assigned by you. Hover over the Risk Score icon to display the Risk Summary for the app.

  
  
  

  The risk summary displays:

  • The Custom risk score, which appears if you have chosen to override the Weighted risk score calculated by Umbrella. To apply a Custom risk score see Change App Details.

    Note

    If you apply a Custom risk score to an App, it will be noted in the Apps Grid display as shown below:

    
    
    

  • The Weighted risk score calculated by Umbrella based on Business risk, Usage risk, Vendor compliance, and Community risk (if available).

  • The Community risk score, which appears if one or more other users have assigned a Custom risk score to the app. Umbrella calculates the Community risk score as a median of the Custom risk scores assigned to the app by all users.

• A label describing the review status of the app for your installation: Unreviewed, Approved, Not Approved, or Under Audit. To change the label assigned to the app, see Change App Details.

  Note

  App labels are primarily used for tracking and filtering, to help you keep track of the app review process within your organization. They do not of themselves control access to an app. However, if you establish an app risk profile that uses Label Status as a criteria, and that profile is used in an internet access rule, that rule may cause an application to be blocked or allowed based on the value of its app label.

• A link to control the app. The link text may appear as Control this app, Edit app controls, or Block this app.

  • Control this app—Available only when Block or Allow have not been configured for this app. If the app setting is configured but has not yet been applied to a policy, a red tooltip appears.

  • Edit app controls—Available only when the app has previously configured application settings and you can enable advanced activities for the application.

  • Block This App—Appears when a block has not been configured for this app, or a red tooltip icon will appear if the app setting is configured but has not yet been applied to a policy.

    For more details, see Control Apps.

• App URL—The URL of the app.

• Category—The category the app falls under. For more information, see Application Categories.

• Identities—The number of sources that accessed the app.

• Vendor—The owner of the app.

• Traffic—The number of bytes of total traffic and bytes blocked.

• DNS Requests—The total number of DNS requests and the percentage of requests blocked by Secure Access.

• First Detected—The date the app was first detected.

• Last detected—The date the app was last detected.

The Risk Details tab displays the app's risk score and how it was calculated, including Business Risk, Usage Risk, and Vendor Compliance.

The Identities tab lists your organization's sources that have made DNS requests and traffic for this app.

Click the Download CSV icon to download this information as a CSV file.

The Attributes tab lists the various attributes associated with this app.

Attributes are divided into categories. Click a category name to view the attributes associated with it. (Not all applications will show all attribute categories.)

For each displayed attribute, Secure Access shows whether the attribute applies to the application and the dates when the attribute information was collected and updated. Use the attributes to evaluate the risk that the application will expose your environment to data breaches, identity theft, financial fraud, and other cyber threats.

The attribute categories are:

• Compliance attributes — Indicate whether the application complies with the requirements of a number of certifications such as GDPR, HIPAA, and FEDRAMP.

• Vulnerabilities attributes — Indicate whether the application is vulnerable to exploits that attackers could use to compromise the security of the affected systems, steal sensitive data, or cause other types of damage.

• Access control attributes — Indicate the methods the application supports to manage and restrict access based on a user's identity, role, and authorization level.

• Data security attributes — Indicate the practices and technologies the application uses to protect data from unauthorized access, use, disclosure, modification, or destruction.

• Auditability attributes — Indicate the abilities the application provides for an administrator to review the activity and transactions of a system, to ensure that it is operating in a compliant and secure manner.

• Email authenticity attributes — Indicate what methods the app provides to verify that email is actually from the sender that it claims to be from, and that the message has not been tampered with or altered in any way during transit.

1. To change the risk score for an app from the Apps Grid, hover over the risk score for an app to view its Risk Summary.

   
   
   

2. To change the risk score for an app from its Details page, click the name of the app on the Apps Grid, then from the Details page hover over the risk score to view the Risk Summary.

   
   
   

• Very High

• High

• Medium

• Low

• Very Low

1. To change the label for an app from the Apps Grid, hover over its label to view the label menu.

   
   
   

2. To change the label for an app from its Details page, click the name of the app on the Apps Grid, then on the Details page hover over the label to view the Label menu.

   
   
   

• Approved—The app may be used in your environment.

• Not Approved—The app should not be approved for use in your environment.

• Under Audit—The app is currently under review.

• Block This App—Appears when a block has not been configured for this app, or a red tooltip icon will appear if the app setting is configured but has not yet been applied to a policy.

• Control This App—Appears when Block or Allow have not been configured for this app, or a red tooltip icon will appear if the app setting is configured but has not yet been applied to a policy.

• Edit App Controls—Appears when the app has already had settings configured but can be edited.

The application can only be added to application lists currently active in a policy.

The application can only be added to application lists that are currently active in a policy.

Details include the total and blocked traffic in bytes.