You are using Skope IT to analyze and correlate a security incident. You are seeing too many events generated by API policies. You want to filter for logs generated by the Netskope client only.
Option A seems like the way to go. I mean, filtering for 'Client' in the access_method makes sense if we want to focus on the Netskope client events, right?
I'm not sure, but I think option D) Use query mode and use access_method neq Client could also work to filter out logs not generated by the Netskope client.
Laurene
6 days agoTuyet
10 days agoVeronika
12 days agoMerissa
16 days ago