Netskope Log Streaming is a near real-time system that streams all events and logs generated in the Netskope platform directly to customer-owned cloud object storage buckets, such as Azure Blob Storage, Google Cloud Storage, or AWS Simple Storage Service (S3). Admins can ingest these events and logs to their SIEM solutions using the SIEM’s out-of-the-box connectors.
It is recommended (not required) that admins configure storage in a region close to their account’s Netskope home PoP for best performance. For example, a tenant ID in the Netskope AM2 PoP can select a cloud provider region in the Netherlands.
Destination types include:
Storage Bucket Naming Convention
A top-level container is created as below
<stream_id>
Directory structure under the <Stream_id> follows the best practices to optimize the query performance and data management.
<stream_id>/hour=HH/day=DD/month=MM/year=YYYY/
Eventually the files with the below prefix are uploaded for the configured stream.
<stream_id>/hour=HH/day=DD/month=MM/year=YYYY/data-<timestamp>-<uid>.<suffix>
e.g.
stream_2/hour=1/day=02/month=04/year=2025/data-1743555444198557-4dd5913619e9427e8a7e265a0f2cbc39.csv.gz
stream_2/hour=10/day=02/month=04/year=2025/data-1743587761589649-4dd5913619e9427e8a7e265a0f2cbc39.csv.gz
- The timestamp is system-generated in microseconds to provide fine granularity for cases of bursts of logs arriving in the same few milliseconds as they are split across batches.
- The unique ID is system-generated to identify each batch loader and protect the parallel loaders from overstepping on respective files.