Understanding FILES and TOP FILE TYPES in SaaS report

This article describes how the columns FILES and TOP FILE TYPES are generated inside the SaaS report. If you would like more information on creating this report, please visit the "Generate the SaaS Risk Assessment Report" part of the Aperture's Admin guide here: https://docs.paloaltonetworks.com/prisma/prisma-saas/prisma-saas-admin/generate-reports-on-prisma-saas/generate-the-saas-risk-assessment-report

The columns FILES and TOP FILE TYPES are populated inside the SaaS report.

• FILES is populated from the Data filtering logs, which contain the logs for file blocking profile.
• TOP FILE TYPES is populated from the WildFire Submission logs.

In the above example, inside the Top File Sharing Applications in Detail, under the TOP FILE TYPES section, only 5 files are shown for application FTP.

There can be cases where the FILES column shows a significant number of files but TOP FILE TYPE does not show any entry. This is because there are no logs for that application in the WildFire Submission log.

This is expected behavior and working as per design.

The below snapshot shows an exmaple where we have 5 files for application "google-cloud-storage-base" in the FILES column but TOP FILE TYPES shows zero. This is because no files for application "google-cloud-storage-base" are in the WildFire Submission log.