Why SharePoint asset owner is shown as "SharePoint app"?
There are types of assets in SharePoint that cannot be associated with a specific user of the application or document owner. The owners of these assets are identified as the "SharePoint app" as designed in O365 SharePoint. Hence Prisma SaaS shows the owner of the cases listed below as the "SharePoint app".
System created folders and files. e.g., SharePoint root folders, sites.
Files with a deleted owner. SharePoint keeps files owned by deleted users, but since Prisma SaaS cannot look up the user, it shows it as owned by "SharePoint app".