"Unknown" users showing up in service usage data

Products

• CASB Audit
• CASB Advanced Threat Protection
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

When looking at service usage data in Audit there are various users showing up as unknown.

Resolution

Unknown users are displayed, when they have a user IP but no information in the Username field. This could happen to on-prem proxy as well as CloudSWG data sources. When you have authentication bypass policy configured in CloudSWG, the traffic logs will only have the IP address but no usernames.