This document describes the Cloud Exchange REST APIs you can use to configure plugins, business rules, and sharing for each Cloud Exchange module: Log Shipper, Threat Exchange, Ticket Orchestrator, Risk Exchange, Exact Data Match, and Custom File Classification.
Prerequisites
To use these APIs, you need:
- The URL of your Cloud Exchange instance (<CE_URL>).
- Cloud Exchange user credentials with the required permissions for the module you want to configure.
- An access token generated using the Authentication API. Pass this token in the
Authorizationheader of every other request.
Note: Replace all values in angle brackets, such as <CE_URL>, <tenant_name>, and <client_secret>, with values from your environment. Plugin versions and fields in the sample responses can differ based on your Cloud Exchange and plugin versions.
API Details
Here’s a list of the APIs used.
Authentication
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/auth | POST | Generate an access token used to authenticate all other Cloud Exchange API calls. |
Log Shipper (CLS)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/cls/configurations | POST | Create a Netskope Log Shipper (CLS) plugin configuration. |
| /api/cls/configurations | POST | Create a QRadar (CLS) plugin configuration. |
| /api/cls/business_rules | POST | Create a CLS business rule with alert and event type filters. |
| /api/cls/business_rule | PATCH | Update a CLS business rule to map a source configuration to a destination configuration. |
Threat Exchange (CTE)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/cte/plugins/configurations/netskope.plugins.Default.netskope.main | POST | Create a Netskope Threat Exchange (CTE) plugin configuration. |
| /api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main | POST | Create a CrowdStrike (CTE) plugin configuration. |
| /api/cte/business_rules | POST | Create a CTE business rule that filters indicators from the Netskope CTE source. |
| /api/cte/business_rules | POST | Create a CTE business rule that filters URL indicators from the CrowdStrike CTE source. |
| /api/cte/business_rules | POST | Create a CTE business rule that filters MD5 and SHA256 indicators from the CrowdStrike CTE source. |
| /api/cte/business_rule | PATCH | Update a CTE business rule to share Netskope indicators with CrowdStrike. |
| /api/cte/business_rule | PATCH | Update a CTE business rule to share CrowdStrike URL indicators to a Netskope URL list. |
| /api/cte/business_rule | PATCH | Update a CTE business rule to share CrowdStrike file hashes to a Netskope file hash list. |
Ticket Orchestrator (CTO)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/itsm/configuration | POST | Create a Netskope Ticket Orchestrator (CTO) plugin configuration. |
| /api/itsm/configuration | POST | Create a Jira (CTO) plugin configuration. |
| /api/itsm/business_rules | POST | Create a CTO business rule. |
| /api/itsm/business_rule | PATCH | Update a CTO business rule to add a queue with field mappings. |
Risk Exchange (CRE)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/cre/configurations | POST | Create a Netskope Risk Exchange (CRE) plugin configuration with entity mappings. |
| /api/cre/configurations | POST | Create a CrowdStrike (CRE) plugin configuration with entity mappings. |
| /api/cre/business_rules | POST | Create a CRE business rule for the Users entity. |
| /api/cre/business_rules | POST | Create a CRE business rule for the Devices entity. |
| /api/cre/business_rules | POST | Create a CRE business rule for the Applications entity. |
| /api/cre/business_rules | PATCH | Update a CRE business rule to add an action. |
Exact Data Match (EDM)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main | POST | Create a Netskope Exact Data Match (EDM) plugin configuration. |
| /api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main | POST | Create a Linux File Share (EDM) plugin configuration. |
| /api/edm/business_rules | POST | Share EDM hashes from the Linux File Share EDM configuration to the Netskope EDM configuration. |
Custom File Classification (CFC)
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main | POST | Create a Netskope Custom File Classification (CFC) plugin configuration. |
| /api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main | POST | Create a Linux File Share (CFC) plugin configuration. |
| /api/cfc/business_rule | POST | Create a CFC business rule. |
| /api/cfc/sharing | POST | Share CFC hashes from the Linux File Share CFC configuration to the Netskope CFC configuration. |
Authentication
Generate an Authentication Token
API Endpoint: https://<CE_URL>/api/auth
Method: POST
Request Headers
| Key | Value |
|---|---|
| Content-Type | application/x-www-form-urlencoded |
Request Body
| Key | Value |
|---|---|
| grant_type | password |
| username | <ce_username> |
| password | <ce_password> |
Sample API Response
{
"access_token": "<generated_access_token_value>",
"token_type": "bearer",
"scopes": [
"admin",
"api",
"me",
"cte_read",
"cto_read",
"cls_read",
"cre_read",
"settings_read",
"logs",
"cte_write",
"cto_write",
"cre_write",
"cls_write",
"settings_write",
"edm_read",
"cfc_read",
"edm_write",
"cfc_write",
"ai_read",
"ai_write"
],
"firstLogin": false,
"passwordPolicyViolation": false,
"passwordPolicy": null
}
Log Shipper (CLS)
Use these APIs to configure Log Shipper plugins, create a business rule, and map the business rule to a SIEM destination for log delivery.
Plugin Configuration
Configure the Netskope Log Shipper Plugin
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CLS",
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"tenant": "<tenant_name>",
"active": true,
"attributeMappingRepo": null,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
}
}
Sample API Response
{
"name": "Netskope CLS",
"types": [
"alerts",
"events"
],
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"pluginName": "Netskope Log Shipper",
"pluginVersion": "2.3.0",
"pushSupported": true,
"pullSupported": false,
"tenant": "<tenant_name>",
"active": true,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"attributeMapping": null,
"attributeMappingRepo": null,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
Configure the QRadar Plugin
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"active": true,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"useProxy": false
}
Sample API Response
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"pluginName": "QRadar",
"pluginVersion": "3.1.0",
"pushSupported": true,
"pullSupported": false,
"tenant": null,
"active": true,
"pollIntervalUnit": "minutes",
"pollInterval": 60,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
Business Rule Configuration
Create a Log Shipper Business Rule
API Endpoint: https://<CE_URL>/api/cls/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {}
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {},
"isDefault": false
}
Log Delivery Configuration
Configure Log Delivery (SIEM Mapping)
API Endpoint: https://<CE_URL>/api/cls/business_rule
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
Threat Exchange (CTE)
Use these APIs to configure Threat Exchange plugins, create business rules, and configure sharing between plugins.
Plugin Configuration
Configure the Netskope Threat Exchange Plugin
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.netskope.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CTE",
"active": true,
"tenant": "<tenant_name>",
"tagsAggregateStrategy": "append",
"sslValidation": true,
"pollIntervalUnit": "minutes",
"reputation": 5,
"pollInterval": 10,
"ageAfterDays": 90,
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"useProxy": false
}
Sample API Response
{
"name": "Netskope CTE",
"plugin": "netskope.plugins.Default.netskope.main",
"pluginName": "Netskope Threat Exchange",
"pluginVersion": "2.5.0",
"pushSupported": true,
"tenant": "<tenant_name>",
"active": true,
"sslValidation": true,
"pollInterval": 10,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
Configure the CrowdStrike Plugin
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CrowdStrike CTE",
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"reputation": 5,
"ageAfterDays": 90,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"useProxy": false
}
Sample API Response
{
"name": "CrowdStrike CTE",
"plugin": "netskope.plugins.Default.crowdstrike.main",
"pluginName": "CrowdStrike",
"pluginVersion": "2.3.0",
"pushSupported": true,
"tenant": null,
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
Business Rule Configuration
Create a Business Rule for Netskope Indicators
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source Netskope",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Create a Business Rule for CrowdStrike URL Indicators
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Create a Business Rule for CrowdStrike File Hash Indicators
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Sharing Configuration
Share Indicators from Netskope to CrowdStrike
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source Netskope",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
},
"creShare": {}
}
Share URL Indicators from CrowdStrike to a Netskope URL List
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
},
"creShare": {}
}
Share File Hash Indicators from CrowdStrike to a Netskope File Hash List
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
},
"creShare": {}
}
Ticket Orchestrator (CTO)
Use these APIs to configure Ticket Orchestrator plugins, create a business rule, and configure queues.
Plugin Configuration
Configure the Netskope Ticket Orchestrator Plugin
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"pluginName": "Netskope Ticket Orchestrator",
"active": true,
"tenant": "<tenant_name>",
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Sample API Response
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"tenant": "<tenant_name>",
"active": true,
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Configure the Jira Plugin
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"active": true,
"tenant": null,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"receivingSupported": true,
"useProxy": false,
"filters": null
}
Sample API Response
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"tenant": null,
"active": true,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": false
}
Business Rule Configuration
Create a Ticket Orchestrator Business Rule
API Endpoint: https://<CE_URL>/api/itsm/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"muted": false,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {}
}
Queue Configuration
Configure a Queue
API Endpoint: https://<CE_URL>/api/itsm/business_rule
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
Risk Exchange (CRE)
Use these APIs to configure Risk Exchange plugins, create business rules for each entity, and configure actions.
Plugin Configuration
Configure the Netskope Risk Exchange Plugin
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"pluginName": "Netskope Risk Exchange"
}
Sample API Response
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
Configure the CrowdStrike Plugin
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"pluginName": "CrowdStrike"
}
Sample API Response
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
Business Rule Configuration
Create a Business Rule for the Users Entity
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Users Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Users"
}
Sample API Response
{
"name": "CRE Users Rule",
"entity": "Users",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Create a Business Rule for the Devices Entity
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Device Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Devices"
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Create a Business Rule for the Applications Entity
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Applications Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Applications"
}
Sample API Response
{
"name": "CRE Applications Rule",
"entity": "Applications",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Action Configuration
Configure an Action
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Device Rule",
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"requireApproval": true
}
]
}
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"performLater": false,
"requireApproval": true,
"performRevert": false
}
]
},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Exact Data Match (EDM)
Use these APIs to configure Exact Data Match plugins and configure sharing.
Plugin Configuration
Configure the Netskope EDM Plugin
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope EDM",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope EDM",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"pluginName": "Netskope Exact Data Match",
"pluginVersion": "1.0.1",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null,
"pluginType": null,
"tenant": "<tenant_name>"
}
Configure the Linux File Share EDM Plugin
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"lockedAt": null,
"pluginType": null,
"tenant": null
}
Sharing Configuration
Configure EDM Sharing
API Endpoint: https://<CE_URL>/api/edm/business_rules
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
}
}
Sample API Response
{
"name": "80959f82-2c81-4bd4-ab03-91990f95dbaa",
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
},
"status": "scheduled",
"createdAt": "2026-07-18T10:54:00.171621Z",
"updatedAt": "2026-07-18T10:54:00.171624Z",
"sharedAt": null
}
Custom File Classification (CFC)
Use these APIs to configure Custom File Classification plugins, create a business rule, and configure sharing.
Plugin Configuration
Configure the Netskope CFC Plugin
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {},
"sslValidation": true,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope CFC",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"pluginName": "Netskope Custom File Classification",
"pluginVersion": "1.1.0",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": true,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null
}
Configure the Linux File Share CFC Plugin
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Linux File Share CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share CFC",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"lockedAt": null
}
Business Rule Configuration
Create a CFC Business Rule
API Endpoint: https://<CE_URL>/api/cfc/business_rule
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CFC Rule",
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
}
}
Sample API Response
{
"name": "CFC Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
},
"exceptions": [],
"mapped": false,
"updatedBy": "admin",
"updatedAt": "2026-07-19T09:25:14.813000"
}
Sharing Configuration
Configure CFC Sharing
API Endpoint: https://<CE_URL>/api/cfc/sharing
Method: POST
Request Headers
| Key | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierID": "1510609487600855817",
"classifierName": "performance",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
},
"classifierType": "custom"
}
]
}
Sample API Response
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierName": "performance",
"classifierType": "custom",
"classifierID": "1510609487600855817",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
}
}
],
"status": "scheduled",
"errorState": {
"error": false,
"errorMessage": ""
},
"createdAt": "2026-07-19T09:32:57.270695Z",
"createdBy": "admin",
"updatedAt": "2026-07-19T09:32:57.270702Z",
"updatedBy": "admin",
"sharedAt": null
}