The Cloud Service Username is the user that was logged in to the SaaS is missing from the investigate activity.
The Cloud Service Username may be listed as the same user reported as the CloudSOC User's Email.
The Cloud Service Username is captured and then cache'd during the login while the traffic is flowing through WSS\CASB.
The username can be see in the browser Cache as Elastica_UNAME
In the event the Cloud Service Username is not cached the value will be reported as the same as the CloudSOC User's Email.
Enforcing Session Control at the SaaS will help ensure that CloudSOC get the most accurate logged in user.
Browser Cache ELASTICA_UNAME