Service user count in Audit Dashboard report does not match Audit query

Products

• CASB Gateway Advanced

Issue/Introduction

Audit Dashboard report shows a larger number of users for Audit services than the user count for those same services in the Audit -> Services section in CloudSOC

Cause

Events from a data source that does not have 'Ignore Indirect Traffic' option set

Resolution

When 'Ignore Indirect Traffic' is not checked, there will be data stored to Audit for users that were redirected to the service and blocked.

The solution is to filter out users who were blocked from the service. A filter like Blocked Bytes <= 0 will remove users who were blocked and show users that were not blocked when accessing the service.