Securlet activity log structure is helpful in passing CASB activity to logging analytics software.
The CASB knowledgeable contains technote
CloudSOC Management API.pdf which contains 3 examples of activity logs reported by different application types that can be use to verify against your activity logs.
Use CloudSOC investigate to export your specific securlet.
Compare the csv to the default setting or examples in the documentation.