Available Search Terms
The Omnibar is a flexible search tool that allows you to find the information you need about your cloud services quickly. The following search terms are supported.
The left column organizes the terms into categories and the right column displays each option for the category. You can either enter the category into the Omnibar and select the search term or terms you wish to use, or type the search term directly. In cases where the same search term exists in multiple categories, you can select which term to use before initiating your filter.
|
Search Category |
Search Term |
|---|---|
|
Service Type |
|
|
|
Backup and Archiving |
|
|
Botnets and Malware |
|
|
Business Intelligence |
|
|
Cloud Infrastructure |
|
|
Cloud Storage |
|
|
Collaboration |
|
|
Content Sharing |
|
|
CRM |
|
|
Development |
|
|
e-Commerce |
|
|
Education |
|
|
ERP |
|
|
Finance |
|
|
Health Care |
|
|
HR |
|
|
IaaS Admin Console |
|
|
IaaS Services |
|
|
IT Services |
|
|
Legal |
|
|
Logistics |
|
|
Marketing |
|
|
Media |
|
|
Networking |
|
|
Procurement |
|
|
Project Management |
|
|
Security |
|
|
Service Desk and Support |
|
|
Service Proxy |
|
|
Social media |
|
|
Tracking |
|
|
Virtual Data Rooms |
|
|
Web Application API |
|
Risk Type |
|
|
|
Low Risk |
|
|
Medium Risk |
|
|
High Risk |
|
|
|
|
|
403 Denied Count |
|
|
Content Inspection |
|
|
Data Transfer |
|
|
Data Transfer Usage Behavior |
|
|
MIME Type (Application) |
|
|
MIME Type (Audio) |
|
|
MIME Type (Binary) |
|
|
MIME Type (Image) |
|
|
MIME Type (Message) |
|
|
MIME Type (Model) |
|
|
MIME Type (Multipart) |
|
|
MIME Type (Text) |
|
|
MIME Type (Video) |
|
|
Multiple IP addr Anomaly |
|
|
Multiple User Anomaly |
|
|
Periodicity Anomaly |
|
|
Repeat Offender |
|
|
Repeat Offender Combined |
|
|
Report |
|
|
Report Number of Fields |
|
|
Service Access Count |
|
|
Service Action Byte Count |
|
|
Service Action Count |
|
|
Service Category Based Data Transfer |
|
|
Unmatched Data Transfer Anomaly |
|
|
Unsupported Device |
|
User Type |
|
|
|
IP Address |
|
Device Type |
|
|
|
Desktop |
|
|
Mobile |
|
|
Application |
|
|
Unknown |
|
Permission type |
|
|
|
Allowed |
|
|
Denied |
|
Protocol type |
|
|
|
http |
|
|
https |
|
|
ftp |
|
Tag type |
|
|
|
User defined |
|
|
User defined attributes 1 thru 5 |
|
|
User defined |
|
|
|
|
|
1 |
|
|
2 |
|
|
3 |
|
|
4 |
|
|
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
Calendar Type |
|
|
|
Last 24 hours |
|
|
Last 7 days |
|
|
Last month |
|
|
Last 3 months |
|
|
Last year |
|
|
All data |
|
Upload Data |
|
|
|
Only include data transfers above : Bytes, KB, MB, GB, TB |
|
Inbound Data |
|
|
|
Only include data transfers above : Bytes, KB, MB, GB, TB |
|
Outbound Data |
|
|
|
Only include data transfers above : Bytes, KB, MB, GB, TB |
|
Total Data |
|
|
|
Only include data transfers above : Bytes, KB, MB, GB, TB |
Service Attributes
You can use Omnibar to search for services based on their Service Attributes from the Global Registry. You can either search by the service attribute name and select the attribute value or values, or search by a specific value by typing it directly into the Omnibar. In cases where the same values exist for multiple service attributes, you will be given the opportunity to select which attribute you wish to use before initiating the search.
Service Categories
DLP Incidents
The following Omnibar facets are used exclusively in on the DLP Incidents page.
| Search Term | Description | Available Options |
|---|---|---|
| File Name | The name of the file matching the DLP policy rule. You can use this Omnibar facet to locate policy violations centering on a specific file. | All detected files can be used in this search filter. |
| File Size |
The detected file size of the file matching the DLP policy rule. You can use this Omnibar facet to filter results around the size of the file. Transfers of unusually large files may indicate potential data exfiltration events. Excessive transfers of unusually small files may indicate attempts to test security measures in preparation of a data theft incident. |
Filter on file size based on KB, MB or GB. The filter can compare files against the user-entered value based on the following criteria:
|
| File Type | The format of the file matching the DLP policy rule. You can use this Omnibar facet to filter results around a specific file format in order to better tune policies that control which formats can be shared. For example, if you have a policy that only allows PDFs to be shared, you could use the File Type filter to confirm that .DOC or .XLS files are triggering policy violations. |
One or more formats can be selected from any of the Skyhigh CASB CASB supported formats. |
| Incident ID | This Omnibar facet is reserved for internal functionality. | N/A |
| Match Count | The number of policy rule matches were found in the document that triggered the policy violation. You can use this Omnibar facet to filter results to investigate files that violate a policy in many places (as those indicate the highest risk violations) or to review files that have a small number of matches as those may indicate false positives or accidental violations. | Enter any integer to filter to the number of policy matches. |
| Policy | The name of the violated policy. You can use this Omnibar facet to review all policy violations from a specific policy. | Select from any of your existing DLP policies. |
| Remediator |
The remediator is the CASB user who has been assigned to investigate the policy violation. You can use this Omnibar facet to view the workflow of your remediators. |
Select from any CASB user with the Policy Manager role to view any policy violations where that user is assigned as a remediator. |
| Response |
The response action taken as a result of the policy violation. You can use this Omnibar facet to review policy responses and see how many policy violations are responded to in a certain way. |
Select from Skyhigh CASB's DLP response actions. |
| Scan Name | The name of the On-Demand Scan that detected the policy violation. You can use this Omnibar facet to review your On-Demand Scans; if an On-Demand Scan consistently runs without triggering any policy violations it may not be configured correctly. Conversely, if an On-Demand Scan produces excessive false positives you may need to adjust the scan criteria. | Select from your active On-Demand Scans. |
| Severity | The recorded severity level of the policy violation. Severity level is defined by the user during DLP policy creation. You can use this Omnibar facet to manage your remediation workflow; filtering based on severity level allows your remediators to focus on the highest priority violations first. |
|
| Sharing | If the content is included in a shared folder or external link within the CSP. Some companies view policy violations for files shared outside of the company more harshly than files that remain internal. You can use this Omnibar facet to provide better insight on how your users are interacting with the cloud and better determine the significance of the policy violation. |
|
| Status | The current state of the policy violation. Status is set by the user in the policy violation platform. You can use this Omnibar facet to manage your remediation workflow; remediators can filter to only New policies to tackle the incoming violations or filter out any violations that have been marked as False Positive. |
|
| User | The user who triggered the policy violation. You can use this Omnibar facet to investigate specific users. If a single user is generating excessive policy violations, they may need to be investigated. | Select between all users who have triggered a DLP policy violation. |
Threat Protection & Activity Monitoring
The following Omnibar facets can be used on either the Threat Protection or Activity Monitoring pages.
| Search Term | Description | Available Options |
|---|---|---|
| Threat Protection | ||
| Service Name |
The CSP where the anomaly occurred. You can use this Omnibar facet to learn more about the activities occurring in a specific service in order to better design DLP policies for this service. |
Only the currently selected service can be used in this facet. However, Skyhigh CASB for O365 customers can use this facet to separate SharePoint, AzureAD or OneDrive results. |
| Severity | The severity of the anomaly, as determined by how much the anomaly exceeds its threshold. You can use this Omnibar facet to manage your investigation workflow; filtering based on severity level allows your investigators to focus on the highest priority anomalies or threats first. |
|
| Threat Category | The organizational categories used to sort detected threats. You can use this Omnibar facet to investigate all threats that are sorted into one of the three categories. Filtering by category can help with threat resolution; if you deal with one category at a time the list may be easier to manage. | |
| Threat ID | The unique identification number of the threat. | |
| Threat Type | The type of threat depends on the threat category. | |
| Threat Status | The status of the threat. |
|
| User Name | The name of the user who triggered the threat. Knowing which user is connected to the anomaly will assist your investigation in order to find out the circumstances of the anomalous behavior directly. | |
| Activity Monitoring | ||
| Action Name | The name of the detected activity. You can use this Omnibar facet to filter on specific activities that you wish to investigate. You may need to learn more about how many users are engaging in a specific activity or investigate threats that are calculated based on your selected activity. | Select one or more available activities. |
| Anomaly Category |
The organizational categories used to sort detected anomalies. You can use this Omnibar facet to investigate all anomalies that are sorted into one of the three categories. Filtering by category can help with anomaly resolution; if you deal with one category at a time the list may be more easy to manage. |
|
| Anomaly Duration | The length of time that the anomaly took place. You can use this Omnibar facet to filter your anomaly list based on the longest-running anomalies. Anomalies that have been measured over longer timelines are more likely to indicate valid threats. |
|
| Anomaly Name |
The name of the specific anomaly. You can use this Omnibar facet to filter on a particular anomaly in order to investigate security events; if you have an account breach you can check into any unusual file transfers that occurred during the breach. |
Only anomalies that have been detected for the active CSP will be available for selection. At this time, users can only filter results by name for Superhuman, Brute Force Login, and Large Report Download anomalies. If you wish to filter based on anomalies in the Data Anomalies category, you should use the Anomaly Category filter instead. |
| Anomaly Threshold | This Omnibar facet is reserved for internal functionality. | N/A |
| Category | The category of the detected activity. You can use this Omnibar facet to filter on specific activity types. Filtering by category can help with activity monitoring; if you deal with one category at a time the list may be more easy to manage. |
<This appears to be the same list as activity name. What's the difference?> Valli- e.g download category refers to several download activity names like - Download File, DOwnload Folder, so here you are searching at a category level . |
| Client Browser | The web browser used to create the activity or anomaly. You can use this Omnibar facet to gain additional insight into how your users are interacting with your cloud services and learn about potential anomaly patterns that may influence your device management rules. For example, if the majority of your access anomalies are occurring through an insecure browser, you may wish to block users from connecting to the cloud service using that browser. | Select one or more detected browsers. |
| Client OS | The computer operating system used to create the activity or anomaly. You can use this Omnibar facet to gain additional insight into how your users are interacting with your cloud services and learn about potential anomaly patterns that may influence your device management rules. For example, if the majority of your access anomalies are occurring through an insecure OS, you may wish to block users from connecting to the cloud service using that OS. | Select one or more detected operating systems. |
| Collaboration Group | The domain of the user's email address. For example, if you detect activity from users with email address ending in samplecompany.com, competetorcompany.com and freeemail.com, there will be three detected collaboration groups. You can use this Omnibar facet on the Collaboration View to filter collaborations to specific domains. | Select one or more of the detected collaboration groups for the CSP. |
| Country | The country where the activity or anomaly occurred. You can use this Omnibar facet to understand anomaly and threat patterns occurring in different countries. If excessive anomalies occur in a specific country you can adjust your access and DLP policies surrounding access in that country. | Select one or more detected countries. <Is there an abbreviation to country list I can use?> |
| Device | The device used to trigger the activity or anomaly. You can use this Omnibar facet to gain additional insight into how your users are interacting with your cloud services and learn about potential anomaly patterns that may influence your device management rules. For example, if the majority of your access anomalies are occurring through an insecure device, you may wish to block users from connecting to the cloud service using that device. |
Select one or more of the detected devices. |
| Logical Operators | Use these operators to create compound Omnibar searches. You can use this Omnibar facet link multiple facets together in a single search string. For example, you can search for all anomalies in the Data Anomalies group made to Box from China. |
|
| Notes | This Omnibar facet is reserved for future functionality. | N/A |
| Profile | The profile of the user who triggered the activity or anomaly. Profile information is provided through your Salesforce or Active Directory integration. You can use this Omnibar facet to discover more about the activities of specific types of users. For example, if you've established the profile of "Sales Team" you can filter your results based on that profile. |
Select one or more detected profiles. |
| Role | The role of the user who triggered the activity or anomaly. Role information is provided through your Salesforce or Active Directory integration. You can use this Omnibar facet to discover more about the activities of specific types of users. For example, if you've established the role of "Accounting" you can filter your results based on that role. |
Select one or more detected role. |
| Service Name |
The CSP where the activity or anomaly occurred. You can use this Omnibar facet to learn more about the activities occurring in a specific service in order to better design DLP policies for this service. |
Only the currently selected service can be used in this facet. However, Skyhigh CASB for O365 customers can use this facet to separate SharePoint, AzureAD or OneDrive results. |
| Severity | The severity of the anomaly, as determined by how much the anomaly exceeds its threshold. You can use this Omnibar facet to manage your investigation workflow; filtering based on severity level allows your investigators to focus on the highest priority anomalies or threats first. |
|
| Status |
This Omnibar facet is reserved for internal functionality. |
N/A |