Configure the Netskope Plugin for Log Shipper
Configure the Netskope Plugin for Log Shipper
This document explains how to configure the Cloud Exchange integration with the Log Shipper module of the Netskope Cloud Exchange platform. The Log Shipper plugin collects alerts/events from the Netskope tenant.
Prerequisites
To complete this configuration, you need a Netskope tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
CE Version Compatibility
This plugin is compatible with all the supported Netskope CE Versions.
Log Shipper Plugin Support
This plugin is used to pull events and alerts data from the Netskope Tenant.
| Event Types | Yes |
| Alert Types | Yes |
| WebTx | No |
Permissions
Access to the required permissions is available in the v2 REST API scopes.
API Details
List of APIs used
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/events/dataexport/alerts/compromisedcredential | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/dlp | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/malware | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/remediation | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/securityassessment | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/ctep | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/malsite | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/policy | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/quarantine | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/uba | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/alerts/watchlist | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/page | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/application | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/audit | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/infrastructure | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/network | GET | Pull the data from the Netskope tenant |
| /api/v2/events/dataexport/events/incident | GET | Pull the data from the Netskope tenant |
Pull the data from Netskope tenant
This section shows the parameters one of the above mentioned APIs. To access the API Response for other APIs, you can utilize the Swagger API provided by Netskope Tenant.
API Endpoint: /api/v2/events/dataexport/alerts/dlp
Method: GET
Parameters:
Index: <name of iterator index>
operation: <epoch time from where want to fetch the data>
Headers:
Netskope-Api-Token: <V2_Token>
Accept: application/json
Content-Type: application/json
Sample API Response:
To access the API Response view, log in to your Netskope tenant and go to Settings > Tools > REST API v2 and click API Documentation. From there, you will be able to request the API mentioned above and obtain the desired API response.
User Agent
The user-agent added in this plugin is in the following format:
netskope-ce-<ce_version>
For example: netskope-ce-5.0.1
Workflow
- Configure the Netskope plugin for Log Shipper.
- Add a Log Shipper Business Rule.
- Configure a 3rd-party Log Shipper plugin.
- Configure Log Shipper SIEM mappings.
- Validate the Netskope plugin for Log Shipper.
- In Cloud Exchange, go to Settings > General and enable the Log Shipper module.
- Go to Log Shipper and click Plugins > Configure New Plugin.
- Search for and select the Netskope (CLS) box to open the plugin creation page.
- Enter a Configuration Name.
- Select your Tenant from the dropdown.
- Click Next.
- Choose Event Types. (This will filter events based on types you select.)
- Enter the number of days to pull the data for initial run.
- Click Save.
- In Log Shipper, go to Business Rules.
- Click Create New Rule.
- By default, we have a business rule that filters all alerts and events. If you want to filter out any specific types of alerts or events, click Create New Rule and configure a new business rule by adding the rule name and filter.
- Click Save.
Before you can configure SIEM mappings here, you need to create a 3rd-party plugin to map to. Refer to the documentation for steps to configure a 3rd-party plugin. After you have created a 3rd-party plugin, use the following section to add SIEM mappings.
- In Log Shipper, go to SIEM Mappings.
- Click Add SIEM Mappings.
- Use the Source and Destination Configuration dropdowns to determine the SIEM mapping. Select the Netskope Log Shipper plugin for the Source, and the 3rd-party plugin as the Destination.
- Click the Business Rule dropdown and select the Business rule you created previously.
- Click Save.
After the SIEM mapping is saved, the data will start getting pulled from the Netskope Tenant, transformed and ingested into the 3rd-party plugin platform.
Validate the Netskope Log Shipper Plugin
Validating Events and Alerts are Present in Tenant
To validate Events/Alerts from the Netskope Tenant
- Log in to Netskope Tenant.
- Click Skope IT.
- Click Alerts > Add Filter and define the Last x Days according to your needs.
- For Events, go to Skope IT > Application Events, Skope IT > Page Events, or Skope IT > Network Events.
- For Audit Events, go to Settings > Administrator > Audit Log.
Validate the Pull
To validate the pulling of Events/Alerts from the Netskope tenant.
- Go to Logging in Cloud Exchange and search for the pulled logs.
Validate the Push
To validate the plugin workflow.
- Go to Logging and search for ingested events with the filter message contains ingested.
- The ingested logs will be filtered.
