The reason for the activity being NULL in this scenario is likely because a user accessed a static Web page. In Netskope’s Advanced Analytics, when the activity is reported as NULL, it often indicates that there was no dynamic interaction or transaction to record, which is typical when a static web page is accessed1. Static web pages do not generate the kind of events or activities that are tracked by policies, hence they appear as NULL in the activity field.
[: This explanation is supported by the Netskope Knowledge Portal, which mentions that applications fields with null values indicate incidents generated from web traffic, such as accessing static web pages2. Further information on interpreting NULL values in Advanced Analytics reports can be found in the Netskope documentation1., , In Advanced Analytics, the Activity field is populated only when Netskope can identify a specific app activity (e.g., upload, download, edit, share, delete)., When the traffic is simply generic web browsing — especially static web pages (HTML, images, CSS, JS) — Netskope cannot map the request to an application-level activity, so the Activity field becomes:, ➡️ NULL, This is expected behavior for traffic that is:, Not associated with a sanctioned/unsanctioned cloud app, Does not contain a user action like upload/download, Classified only as generic web content (static website), Why other options are incorrect, A. The SSPM policy was not configured during setupSSPM configuration does not impact the Activity field in Analytics for inline events., B. The REST API v1 token has expiredAPI token expiration would impact API logs collection, not inline event Activity values., C. A policy violation was identified using API ProtectionAPI Protection events always include an activity type (e.g., “Download via API”), so they wouldn’t show NULL., , ]
