I saw a mention in a webinar that Cato's audit logs can help track unsanctioned cloud app usage. I'm new to SASE and was curious how this works in practice.
Could someone share a basic query example? I want to understand what data points to look for and how to filter for things like new SaaS logins or unusual traffic patterns. Our team is just starting to evaluate Cato for remote office security.
The webinar's right, but the logs themselves don't label something "shadow IT." You're building a behavioral baseline to find anomalies. You need to correlate user, destination, and application.
A foundational query isolates new destinations. Filter for successful outbound connections (like TCP SYN-ACK) where the destination FQDN or IP isn't in your known sanctioned application list. You'll want to join this with the user directory data to see who's driving it.
```sql
-- Example pattern: find new external domains per user
SELECT user_name, destination_fqdn, count(*) as connection_count
FROM cato_audit_logs
WHERE event_timestamp > now() - interval '7 days'
AND destination_fqdn NOT IN ('approved-saas-1.com', 'approved-saas-2.com')
AND connection_status = 'established'
GROUP BY user_name, destination_fqdn
HAVING count(*) > 5 -- threshold to filter noise
ORDER BY connection_count DESC;
```
The real work is maintaining that "approved" list and tuning thresholds. For SaaS logins, you'd focus on HTTP user-agent strings and destination ports 443/80, looking for auth-related paths. The pattern is more important than a single query.
Single source of truth is a myth.