Activities Monitored by Netskope - Netskope Technical Documentation

Once you have successfully set up the app instance, Netskope can start monitoring activities on your SaaS environment. Here is a list of activities Netskope can monitor:

Apps	Activities Monitored
Anthropic Claude Enterprise	Events to trigger a DLP scan: Conversation created All messages (user prompts + AI responses) and file attachments in the new conversation. Conversation updated All messages and file attachments in the updated conversation. File uploaded The uploaded file. Project file uploaded A binary file uploaded to a project (e.g., PDFs, images). Project document uploaded A plain text document added to a project (used as knowledge base / context). Events to trigger a threat protection scan: File uploaded The uploaded file. Project file uploaded A binary file uploaded to a project (e.g., PDFs, images). Project document uploaded A plain text document added to a project (used as knowledge base / context).
Atlassian Confluence	Events to trigger DLP scan: All spaces under the Atlassian Confluence site, including personal spaces. Inventory changes scanned: Page created or updated. Blog post created or updated. Comment created or updated. Attachment created or updated.
Atlassian Jira	Events to trigger a DLP scan: Ticket (Issue) created or updated. Attachment created or updated. Comment created or updated. Events to trigger a threat protection scan: Attachment created or updated.
Box	Events to trigger a DLP scan: New file created or uploaded File edit, rename, move, copy, and share. Note Netskope does not support scanning web shortcut files.
ChatGPT Enterprise	Events to trigger a DLP scan: New and updated messages and file attachments sent by a user in ChatGPT. Fine-tuning file uploads and memory data.
Cisco Webex	Events to trigger a DLP scan: New and updated chat messages and file attachments posted in 1-1 chats, group chats, public spaces, private spaces, and team spaces.
Citrix ShareFile	Events to trigger a DLP scan: New file upload. New folder upload. Events to trigger alert: New group creation. New user creation. Note Netskope does not monitor content inside the email Inbox folder of ShareFile. Netskope does not scan files & folders when shared by link.
Dropbox	Events to trigger a DLP scan: New file created or uploaded. File edit, rename, move, and copy. Note Netskope does not support scanning Google related files like Google docs, Google sheets, et al, and web shortcut files.
Egnyte	Events to trigger a DLP scan: New file created or uploaded. File edit, rename, move, or copy.
GitHub	Events to trigger DLP scan: Commits pushed to a repository. Individual file-level incident - With file-based alerts, Netskope can provide DLP alerts with detailed file-level information. Each section of a commit that includes any violations will result in a unique incident with a URL linking to that section of the commit. The alert will specify the violating commit, the associated file, and the specific code block that breaches the DLP rule. Additionally, it includes a URL that allows customers to easily view the identified violation within GitHub. To view a DLP incident, navigate to Incidents > DLP, look for a GitHub incident, and click it. Note Netskope can scan for DLP and threat protection on plain text source code only. Netskope does not scan binary files such as Microsoft Office docs, PDFs, images, executable files, and likes. This is due to GitHub API limitations downloading the content. Netskope does not scan repositories outside the GitHub organization.
Gmail	Events to trigger a DLP scan: All emails sent by all organizations’ users (sent folder). This includes email subject, body, and attachment. Events to trigger a threat protection scan: Email attachment
Google Calendar	Events to trigger a DLP scan: Calendar: Edit, create ownership changes, share. Calendar events: Create, edit, share. Notes/attachments: Add/edit notes and attachments Events to trigger a threat protection scan: Add/edit notes and attachments.
Google Drive	Events to trigger DLP scan: New file created or uploaded. File edited or renamed. File deleted. Note Scanning Google Workspace files over 10 MB is not recommended. Google’s export methods may fail for large files, even though Next Generation API Data Protection scans do not enforce a fixed size limit. Netskope cannot scan externally-owned files shared with internal users due to a Google API limitation. In these cases, Google does not generate an event for Netskope to detect this type of sharing.
Microsoft Copilot	Events to trigger a DLP scan: New or updated messages from Microsoft Copilot interactions, including those generated by Copilot agent responses. file attachments uploaded as part of AI interactions. Events to trigger a threat protection scan: file attachments uploaded as part of AI interactions. Note To enable full DLP coverage, configure Microsoft 365 OneDrive for the Next Generation API Data Protection. Next Generation API Data Protection can scan file attachments used in Copilot prompts, including those generated by Copilot agent responses. These attachments are stored in OneDrive folders. However, because Microsoft does not provide webhook notifications for Copilot file attachments, Netskope cannot directly scan them. Setting up OneDrive scanning ensures these attachments are covered by DLP policies.
Microsoft 365 OneDrive (Commercial/GCC)	Events to trigger a DLP scan or threat protection: Note Netskope does not scan any OneNote files for DLP and threat protection on Microsoft 365 OneDrive (Commercial). New file created or uploaded. Make a copy of a file. Replace content of a file. If the permission of a parent folder changes, Netskope will trigger a DLP scan on the child folders and files. Revoke access: User shares a file either through link or directly grant access to a user.
Microsoft 365 Outlook (Commercial/GCC)	Events to trigger a DLP scan: All emails sent by all organizations’ users (sent folder). This includes email subject, body, and attachment. Events to trigger a threat protection scan: Email attachment
Microsoft 365 SharePoint (Commercial/GCC)	Events to trigger a DLP scan or threat protection: Note Netskope does not scan any OneNote files for DLP and threat protection on Microsoft 365 SharePoint (Commercial). New file created or uploaded. Make a copy of a file. Replace content of a file. If the permission of a parent folder changes, Netskope will trigger a DLP scan on the child folders and files. Revoke access: User shares a file either through link or directly grant access to a user.
Microsoft 365 Teams (Commercial)	Events to trigger a DLP scan or threat protection: New and updated chat messages, subjects, and file attachments posted in standard,private, and shared channels. New and updated chat messages and file attachments posted in 1-1, group, and meeting chats.
Microsoft 365 Viva Engage	Events to trigger DLP scan: New Viva Engage message content including: DLP on Viva Engage messages content in DMs DLP on Viva Engage messages content in Groups/Communities
Salesforce	Events to trigger DLP scan: File created or updated. Includes Salesforce content document, document, and attachment. Message sent which represents Salesforce Chatter message. Page created or updated which represents Salesforce feed item. Comment created or updated which represents Salesforce feed comment.
ServiceNow	Events to trigger a DLP scan: A new record created in tables monitored by Netskope. A new record updated in tables monitored by Netskope. A new attachment created for a record in tables monitored by Netskope. A new attachment updated for a record in tables monitored by Netskope. Events to trigger a threat protection scan: A new attachment created for a record in tables monitored by Netskope. A new attachment updated for a record in tables monitored by Netskope. Note For a list of tables monitored Netskope, click here.
Slack Enterprise	Events to trigger DLP scan: Create new messages and attachments. Create new conversations. Upload new files. Create/modify a list. This includes the title, description, field name, record, and attachment. Attachments shared in Slack Canvas. Make edits to conversations. Create new canvas. Make text edits to canvas Limitations: Edits in text snippets are not supported. Events to trigger a threat protection scan: Create/upload new files/attachments. Modify an existing attachment Attachments shared in Slack Canvas.
Smartsheet	Events to trigger a DLP scan: Sheet/Report: Create, update, rename, save as new, delete, restore, move, update share, update workspace share, publish change, ownership change. Discussion: Create: Create a discussion. Update: Add/delete a comment from a discussion. Delete: Delete a discussion. Attachment: Create, update, delete. Note: Netskope only supports file uploads. Only directly uploaded file attachments are scanned. Forms, Workspaces, Dashboards, and URL/third-party uploads are not supported. Events to trigger a threat protection scan: Attachment: Create, update, delete.
Workday	Events to trigger DLP scan: Note Netskope can only monitor files/folders inside the Workday drive. New file upload. Make a copy of a file. Replace a content of a file. Move to trash. Restore from trash. Rename Share by link. Share with user group. Move file/folder. Add to favorites. Remove from favorites. Note Netskope relies on the polling mechanism to monitor the changes of a file. API polling occurs in intervals. If a file is deleted immediately after being created, the file may not be detected due to the polling interval delay.
Zoom	Events to trigger a DLP scan: Team chat direct, channel, group messages for internal and external users. Team chat attachment for internal users. In-meeting chat messages for internal and external users. In-meeting chat attachment for internal and external users. Events to trigger a threat protection scan Team chat attachment for internal users. In-meeting chat attachment for internal and external users. Note: There are a few caveats. To learn more: 3rd Party App Limitations