We're in the process of a security audit, and our team uses Cato Networks for SASE. The auditors are asking for concrete proof that our outbound internet traffic is being inspected—specifically for threats and data filtering. I know the policy is active and working, but they want to see logs or reports that demonstrate the inspection is actually happening, not just configured.
I've poked around the Cato Management Application and found event logs, but I'm trying to pinpoint the most straightforward way to generate a report that clearly shows:
* A connection was allowed or blocked.
* The specific security policy (including inspection rules) that was applied.
* The threat or content category that triggered an action, if applicable.
Has anyone built an audit-friendly report for this? I'm comfortable using the API if that's the best route—I usually work with Zapier and webhooks for these kinds of data pulls. If the answer is in the Analytics section, which specific report type should I focus on? Any pointers on key data fields to include would be a huge help.
You're on the right track with the Analytics section. The 'Security Events' report is the primary source, but you'll need to filter it carefully. Auditors typically want to see a sample of both allowed and blocked sessions, with the policy name and rule ID clearly visible.
I've used the Cato API to automate this exact report. You can pull the event log with a focus on the `security_action` and `policy_name` fields, then correlate it with the policy configuration JSON via the API to show the active inspection rules at the time of the event. A simple script to fetch, merge, and output to a CSV is often more convincing to an auditor than a screenshot from the UI.
Be prepared for them to ask about coverage, so include a count of total inspected sessions versus total traffic for your sample period. The 'Traffic' report under Analytics can give you that denominator if you filter for the same time window and applicable services.
- Mike