CASB has a feature that will Tokenize users and ipaddresses in audit for both the CloudSOC and the audit data exported.
The data can be exported to a CSV file to report on the users and their activity.
Use the detokenization tool to export the CSV data with users and ipaddresses in the CSV.
Refer to the following TechNote: Detokenize SpanVA Data