Data Lineage is a new product designed to give you unparalleled visibility into your organization’s data. It provides a comprehensive, visual map of the data’s entire lifecycle, from its origin, through various stages of modification and transformation, all the way to its usage and potential exfiltration.
By giving a full picture of the data’s journey, Data Lineage helps to:
- Enhance incident context: Quickly understand the full story behind an incident.
- Facilitate forensic investigations: Conduct more efficient and thorough investigations.
- Identify risky movements: Proactively spot and address potential data exfiltration risks before they happen.
Key Features
Data Lineage works by automatically reorganizing existing events from existing Netskope products, so there’s no upfront configuration required. It captures individual file activity events across cloud and endpoint environments, then correlates them using file identifiers, file metadata, user context, and timestamps. These connected observations are visualized as a directed graph, enabling investigators to trace a file from origin to destination, even across renames, edits and multiple transfers.
It’s centrally managed and available in the Netskope UI. You can navigate to Data Lineage by using the link in the DLP Incident page.
- Comprehensive File Activity Tracking: Records a wide range of user-initiated file operations, including copying, creating, downloading, editing, moving, renaming, sharing, and uploading.
- Integrated Incident Investigation: Seamlessly link from a DLP incident page directly to the file’s lineage for deeper context.
- Interactive Lineage Graph: A dedicated tab provides a graphical representation of the file’s lineage with rich, interactive features:
- Zoom and Focus: Easily zoom in and out to control the level of detail and shift the focus point.
- Tooltip: Get more information about either the file or the user activity by hovering the mouse over any element in the graph.
- Expandable View: Hide specific components to reduce clutter or expand them for more detail.
- Graph Manipulation: Drag and rearrange the graph to fit the user’s needs.
- Dynamic File Switching: Effortlessly switch the focus to view the lineage of different files.
How Data Lineage Works
Capturing Activity
Data lineage works by continuously monitoring file activity across your entire ecosystem—from endpoints (laptops, mobile devices) to cloud applications. Every time a file is created, moved, copied, uploaded, or downloaded, we capture a detailed record of that event, including:
- Who accessed the file
- When it happened
- Where the file came from and where it went
- The file’s unique characteristics (name, content signature, cloud app ID)
Think of each captured event as a snapshot in time—a single step in the file’s journey.
Connecting the Dots
A file rarely stays in one place. It might be created on a laptop, uploaded to Google Drive, shared to a colleague, downloaded to their device, then uploaded to Slack. Each of these is a separate snapshot, but they represent the same file moving through your environment.
Our platform automatically connects these individual snapshots into a complete journey by:
- Matching unique identifiers: Cloud applications assign unique IDs to files—when we see the same ID across different events, we know it’s the same file
- Comparing content signatures: Even if a file is renamed, its cryptographic fingerprint (hash) remains the same, allowing us to track it across name changes
- Intelligent correlation: When direct identifiers aren’t available, we analyze multiple signals together—file names, user activity, timestamps, locations, and more—to confidently determine when different events represent the same file’s journey
Visualizing the Full Picture
When you search for a file’s lineage, the system:
- Starts from your file of interest (the “starting point”)
- Follows all connections backward to find its origins and forward to see where it traveled
- Assembles these connections into an interactive visual timeline showing the complete path
This gives you a complete end-to-end view. You can trace any sensitive file back to its original source or forward to see everywhere it has spread, even if it was renamed, moved between multiple apps, or transferred through several users.
The Result
Instead of seeing isolated security events, you get the full story: where sensitive data originated, how it moved through your organization, who touched it along the way, and where it exists now. This comprehensive visibility is essential for investigating data breaches, enforcing DLP policies, and maintaining compliance.
Known Limitations
Data Lineage provides visibility into file movement across your cloud applications, but it does not capture every action or scenario. Coverage is limited to file-level activities in application traffic and varies by application, enabled data sources, and available metadata. Missing or inconsistent event details may result in misclassified activities or incomplete connections in the lineage graph.
Recommendations
Data Lineage uses existing event data from supported Netskope data sources, including Inline, CASB API, and Endpoint DLP. Enabling more sources improves the completeness and accuracy of the lineage view.