CASB Investigate & Protect showing large amount of Box Unknown Users

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Standard
• CASB Security Standard
• CASB Security Premium

Issue/Introduction

Client sees many Box  "Unknown" Users in CloudSOC  - Box Securlet activities, Investigate activities, or Protect incident modules

 

 

 

 

 

Resolution

Working as designed

Box Securlet "Unknown" Users was investigated by Box Securlet Team and determined to be what CloudSOC receives from the Box API.

Box classifies multiple activities as  "Downloads" but does not always provide User Name.