Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Next Generation API Data Protection Platform
    Next Generation API Data Protection Policy Wizard
    Activities Monitored by Netskope

    Activities Monitored by Netskope

    Once you have successfully set up the app instance, Netskope can start monitoring activities on your SaaS environment. Here is a list of activities Netskope can monitor:

    AppsActivities Monitored
    Anthropic Claude EnterpriseEvents to trigger a DLP scan:

    • Conversation created
      All messages (user prompts + AI responses) and file attachments in the new conversation.

    • Conversation updated
      All messages and file attachments in the updated conversation.

    • File uploaded
      The uploaded file.

    • Project file uploaded
      A binary file uploaded to a project (e.g., PDFs, images).

    • Project document uploaded
      A plain text document added to a project (used as knowledge base / context).

    • Claude Code or Cowork session created — All messages in a new Claude Code or Cowork session: user prompts, Claude responses, and tool activity (tool invocations, and tool results such as file contents read by Claude and command output).

    • Claude Code or Cowork session updated — New messages added to an existing Claude Code or Cowork session, including a session resumed after a pause.

      • Note: Claude Code and Cowork session scanning covers Claude Code (terminal, Claude Desktop, and IDE extensions), Cowork in Claude Desktop, and Cowork on claude.ai web and mobile. Netskope polls for new session activity every 5 minutes. Ongoing scanning applies to Claude Code and to Cowork in Claude Desktop, while Netskope scans Cowork sessions on claude.ai web and mobile only through Retro Scan and inventory. Scanning starts when you enable the feature, and retroactive scan covers earlier sessions by looking back 90 days. Netskope can’t scan files and images attached in a Claude Code or Cowork session because the Anthropic Compliance API doesn’t provide them, but it records the number of attachments on the message. Netskope doesn’t scan Claude for Microsoft 365 or Claude for Science sessions.

    Events to trigger a threat protection scan:

    • File uploaded
      The uploaded file.

    • Project file uploaded
      A binary file uploaded to a project (e.g., PDFs, images).

    • Project document uploaded
      A plain text document added to a project (used as knowledge base / context).

    Atlassian ConfluenceEvents to trigger DLP scan:
    All spaces under the Atlassian Confluence site, including personal spaces. Inventory changes scanned:

    • Page created or updated.

    • Blog post created or updated.

    • Comment created or updated.

    • Attachment created or updated.

    Atlassian JiraEvents to trigger a DLP scan:

    • Ticket (Issue) created or updated.

    • Attachment created or updated.

    • Comment created or updated.


    Events to trigger a threat protection scan:

    • Attachment created or updated.

    BoxEvents to trigger a DLP scan:

    • New file created or uploaded

    • File edit, rename, move, copy, and share.



    Note


    Netskope does not support scanning web shortcut files.
    ChatGPT EnterpriseEvents to trigger a DLP scan:

    • New and updated messages and file attachments sent by a user in ChatGPT.

    • Fine-tuning file uploads and memory data.

    Cisco WebexEvents to trigger a DLP scan:

    • New and updated chat messages and file attachments posted in 1-1 chats, group chats, public spaces, private spaces, and team spaces.

    Citrix ShareFileEvents to trigger a DLP scan:

    • New file upload.

    • New folder upload.


    Events to trigger alert:

    • New group creation.

    • New user creation.



    Note


    Netskope does not monitor content inside the email Inbox folder of ShareFile.
    Netskope does not scan files & folders when shared by link.
    DropboxEvents to trigger a DLP scan:

    • New file created or uploaded.

    • File edit, rename, move, and copy.



    Note


    Netskope does not support scanning Google related files like Google docs, Google sheets, et al, and web shortcut files.
    EgnyteEvents to trigger a DLP scan:

    • New file created or uploaded.

    • File edit, rename, move, or copy.

    GitHubEvents to trigger DLP scan:

    • Commits pushed to a repository.

    • Individual file-level incident - With file-based alerts, Netskope can provide DLP alerts with detailed file-level information. Each section of a commit that includes any violations will result in a unique incident with a URL linking to that section of the commit. The alert will specify the violating commit, the associated file, and the specific code block that breaches the DLP rule. Additionally, it includes a URL that allows customers to easily view the identified violation within GitHub. To view a DLP incident, navigate to Incidents > DLP, look for a GitHub incident, and click it.



    Note



    • Netskope can scan for DLP and threat protection on plain text source code only. Netskope does not scan binary files such as Microsoft Office docs, PDFs, images, executable files, and likes. This is due to GitHub API limitations downloading the content.

    • Netskope does not scan repositories outside the GitHub organization.


    GmailEvents to trigger a DLP scan:
    All emails sent by all organizations’ users (sent folder). This includes email subject, body, and attachment.
    Events to trigger a threat protection scan:
    Email attachment
    Google CalendarEvents to trigger a DLP scan:

    • Calendar:
      • Edit, create ownership changes, share.


    • Calendar events:
      • Create, edit, share.


    • Notes/attachments:
      • Add/edit notes and attachments



    Events to trigger a threat protection scan:
    • Add/edit notes and attachments.
    Google DriveEvents to trigger DLP scan:

    • New file created or uploaded.

    • File edited or renamed.

    • File deleted.



    Note



    • Scanning Google Workspace files over 10 MB is not recommended. Google’s export methods may fail for large files, even though Next Generation API Data Protection scans do not enforce a fixed size limit.

    • Netskope cannot scan externally-owned files shared with internal users due to a Google API limitation. In these cases, Google does not generate an event for Netskope to detect this type of sharing.


    Microsoft CopilotEvents to trigger a DLP scan:

    • New or updated messages from Microsoft Copilot interactions, including those generated by Copilot agent responses.

    • file attachments uploaded as part of AI interactions.


    Events to trigger a threat protection scan:

    • file attachments uploaded as part of AI interactions.

      Note


      To enable full DLP coverage, configure Microsoft 365 OneDrive for the Next Generation API Data Protection. Next Generation API Data Protection can scan file attachments used in Copilot prompts, including those generated by Copilot agent responses. These attachments are stored in OneDrive folders. However, because Microsoft does not provide webhook notifications for Copilot file attachments, Netskope cannot directly scan them. Setting up OneDrive scanning ensures these attachments are covered by DLP policies.


    Microsoft 365 OneDrive (Commercial/GCC)Events to trigger a DLP scan or threat protection:

    Note


    Netskope does not scan any OneNote files for DLP and threat protection on Microsoft 365 OneDrive (Commercial).


    • New file created or uploaded.

    • Make a copy of a file.

    • Replace content of a file.

    • If the permission of a parent folder changes, Netskope will trigger a DLP scan on the child folders and files.


    Revoke access:

    • User shares a file either through link or directly grant access to a user.

    Microsoft 365 Outlook (Commercial/GCC)Events to trigger a DLP scan:
    All emails sent by all organizations’ users (sent folder). This includes email subject, body, and attachment.
    Events to trigger a threat protection scan:
    Email attachment
    Microsoft 365 SharePoint (Commercial/GCC)Events to trigger a DLP scan or threat protection:

    Note


    Netskope does not scan any OneNote files for DLP and threat protection on Microsoft 365 SharePoint (Commercial).


    • New file created or uploaded.

    • Make a copy of a file.

    • Replace content of a file.

    • If the permission of a parent folder changes, Netskope will trigger a DLP scan on the child folders and files.


    Revoke access:

    • User shares a file either through link or directly grant access to a user.

    Microsoft 365 Teams (Commercial)Events to trigger a DLP scan or threat protection:

    • New and updated chat messages, subjects, and file attachments posted in standard,private, and shared channels.

    • New and updated chat messages and file attachments posted in 1-1, group, and meeting chats.
    Microsoft 365 Viva EngageEvents to trigger DLP scan:
    New Viva Engage message content including:

    • DLP on Viva Engage messages content in DMs

    • DLP on Viva Engage messages content in Groups/Communities
    SalesforceEvents to trigger DLP scan:

    • File created or updated. Includes Salesforce content document, document, and attachment.

    • Message sent which represents Salesforce Chatter message.

    • Page created or updated which represents Salesforce feed item.

    • Comment created or updated which represents Salesforce feed comment.

    ServiceNowEvents to trigger a DLP scan:

    • A new record created in tables monitored by Netskope.

    • A new record updated in tables monitored by Netskope.

    • A new attachment created for a record in tables monitored by Netskope.

    • A new attachment updated for a record in tables monitored by Netskope.


    Events to trigger a threat protection scan:

    • A new attachment created for a record in tables monitored by Netskope.

    • A new attachment updated for a record in tables monitored by Netskope.



    Note


    For a list of tables monitored Netskope, click here.
    Slack EnterpriseEvents to trigger DLP scan:

    • Create new messages and attachments.

    • Create new conversations.

    • Upload new files.

    • Create/modify a list. This includes the title, description, field name, record, and attachment.

    • Attachments shared in Slack Canvas.

    • Make edits to conversations.

    • Create new canvas.

    • Make text edits to canvas

    • Limitations:


      • Edits in text snippets are not supported.



    Events to trigger a threat protection scan:

    • Create/upload new files/attachments.

    • Modify an existing attachment

    • Attachments shared in Slack Canvas.

    SmartsheetEvents to trigger a DLP scan:

    • Sheet/Report: Create, update, rename, save as new, delete, restore, move, update share, update workspace share, publish change, ownership change.

    • Discussion:

      • Create: Create a discussion.

      • Update: Add/delete a comment from a discussion.

      • Delete: Delete a discussion.



    • Attachment: Create, update, delete.
      Note: Netskope only supports file uploads. Only directly uploaded file attachments are scanned. Forms, Workspaces, Dashboards, and URL/third-party uploads are not supported.


    Events to trigger a threat protection scan:

    • Attachment: Create, update, delete.

    WorkdayEvents to trigger DLP scan:

    Note


    Netskope can only monitor files/folders inside the Workday drive.


    • New file upload.

    • Make a copy of a file.

    • Replace a content of a file.

    • Move to trash.

    • Restore from trash.

    • Rename

    • Share by link.

    • Share with user group.

    • Move file/folder.

    • Add to favorites.

    • Remove from favorites.



    Note


    Netskope relies on the polling mechanism to monitor the changes of a file. API polling occurs in intervals. If a file is deleted immediately after being created, the file may not be detected due to the polling interval delay.
    ZendeskEvents to trigger a DLP scan:

    • Ticket created/updated.

    • Comment created.

    • Ticket attachment uploaded.

    • Topic created.

    • Community post created.

    • Article created.

    • Article attachment uploaded.


    Events to trigger a threat protection scan:

    • Ticket attachment uploaded.

    • Article attachment uploaded.

    ZoomEvents to trigger a DLP scan:

    • Team chat direct, channel, group messages for internal and external users.

    • Team chat attachment for internal users.

    • In-meeting chat messages for internal and external users.

    • In-meeting chat attachment for internal and external users.


    Events to trigger a threat protection scan

    • Team chat attachment for internal users.

    • In-meeting chat attachment for internal and external users.



    Note: There are a few caveats. To learn more: 3rd Party App Limitations
    In this Topic
    • Activities Monitored by Netskope