User Activity Reports

View details of user activity for a single user or for all users combined.

If you want to see what a particular user has been doing, just locate that user on the Users page and view the details, complete with charts.

If you want to see what all users, or a specific list of users have been doing, run the User activity report from the Reports page.

User Details: Activity for One User

View reports of all the activity for a single user.

When you select a particular user on the Users page, two user activity reports appear. The reports are filtered to show parameters that Oracle CASB Cloud Service uses when assessing the user's overall risk score.

Select Users from the Navigation menu. If the Navigation Menu is not displayed, click the Navigation Menu icon to display it.
On the Users page, click a user name of interest, for example, a user with a high-risk score.

The user details page for that user opens, with the "speedometer" on the left indicating the user's average risk score, with the user's maximum risk score displayed below. The USER RISK SCORE TRENDING chart on the right displays the user's risk score as it has changed over the past 30 days:

Hover over any point on the graph to see the user’s precise score on that date.
To switch to the interactive USER ACTIVITIES chart, click the User Activities icon in the upper-right corner.

Click a section of a chart bar to display information for that activity in the detail area at the bottom of the page.

Click the User Risk Score Trending icon in the upper-right corner again to switch back to the USER RISK SCORE TRENDING chart.

Note:
If the application involved is using an Oracle Identity Cloud Service IDP instance to authenticate, then you can suspend the user by clicking the ACTIONS link, above the RISK FACTORS label and clicking the Suspend user link in the ACTIONS dialog box.
To focus on various activities of interest in the ISSUES BY ACTIVITIES chart:
- Click the colored box next to an item in the list of activities (Actions in Network Acl, Network Prefix, ...) to remove the activity from the chart. Click the same box again to restore the item.
- Click the Single Selection button to turn off all of the colored boxes except the top one, and then you can easily select just a few.
- Click the Multi Selection button to turn on all of the colored boxes, and then you can easily deselect just a few.
With either chart displayed, scroll down the page to see all activity data for the user.
Click the links to the right of the RISK FACTORS box on the left, just below the charts, to scroll quickly to those sections.

User Activity Report: Activity for All Users

View a report of all the activity for all users or select users, or a specific list of users.

The Reports page contains a User activity report that shows activity for all users in all of your registered cloud applications and services. The report shows three days of activity by default, which can be expanded up to 90 days. You can filter this report by date range, user name, access (source) IP address, and client device type. This report is useful when you want details about a particular user.

Select Reports from the Navigation menu. If the Navigation Menu is not displayed, click the Navigation Menu icon to display it.
On the Reports page, click anywhere in the row for the User activity report.

The report opens showing all activity for all users over the last three days.
Filter the report to focus on parameters of interest:
Caution:

If you set filter values that return too much data, the retrieval process may time out before it can complete. Except for the date range, all other parameters are set to all by default. Avoid extending the date range without limiting some of the other parameters.
- From and To — set a different date range
- User — limit one or more specific users
- Client type — limit to specific client types
- Instance — limit to a specific application instance
- Source IP address — limit to a specific IP address
Click Search to filter the list with your current settings.
To save the report by exporting the data to a CSV file, continue with Exporting a Report.