Event Streaming Client Configuration

Configuration on the Event Streaming Client is currently only available via REST APIv2. To learn how to setup API access refer to, Event Streaming Client Deployment .

This page provides reference for each API Endpoint.

To learn more:

• Proxy configuration for Docker
• Red Hat and Podman configuration
• Format examples
• Event Streaming Client API Access

To view a step-by-step configuration refer to, Event Streaming Client Deployment.

API Endpoint Standard Definition

For each object, there are five standard endpoints:

• GET {object endpoint}: List all objects with their configuration, pagination is available for long lists
• POST {object endpoint}: Create a new object
• GET {object endpoint}/{id}: Retrieve the definition of a single object
• PATCH {object endpoint}/{id}: Update the definition of a single object, it’s possible to only change one of the parameters
• DELETE {object endpoint}/{id}: Delete a single object, which is only possible if the object is not referenced in another configuration

Here is an example of the Format:

Each object is identified by its id attribute. This id is read only after creation and is unique per object type.

Creation example

POST endpoint can be easily used to create a new object. Use the “Try it out” button and customize the json to define parameters.

In the following example, a new client is created by defining only its name:

In the response, undefined parameters have a default value. If id is not defined at creation, a new one is automatically generated:

Read example

Both GET endpoints can be used to read existing configuration. The “List” will return all objects while adding the /{id} endpoint allows to read only one object

Example read for the object previously created:

Partial edit example

PATCH endpoint can be used to edit an object.

In the following example, we will only enable the client:

The response will return the full configuration, allowing to control the status of all parameters:

Delete example

DELETE endpoint is used to delete any unreferenced object.

Example:

Client Configuration

Client Object Definition

{
  "id": "0198",
  "name": "Client-1",
  "description": "Primary streaming client for production environment",
  "enabled": true,
  "create_by": "esc",
  "create_time": "2025-08-27T13:59:51.83Z",
  "modify_by": "esc",
  "modify_time": "2025-08-27T13:59:51.83Z"
}

• id: UUID of the object, can defined at the creation time but read only after creation
• name: name of the object
• description: description of the object
• enabled: define if the client is disable or enabled. A disabled client can be installed but will not receive any log.
• create_by: admin account used for object creation (read only)
• create_time: creation time (read only)
• modify_by: admin account used for the last edit (read only)
• modify_time: time of the last edit (read only)

Client Object API Endpoints

Client Token Generation

/api/v2/streamingclient/clients/{id}/token allows an admin to enroll an Event Streaming Client by returning a jwtToken. This token is requested when running the installer.

Example:

Format Configuration

Format object is used to define fields selected to the message sent via Syslog.

To learn more: Event Streaming Client Format Examples

Format Object Definition

{
  "id": "019adf54-4d79-77e4-a224-8d9a941e1dad",
  "name": "Format 1 CEF",
  "description": "Transaction Event Format 1",
  "type": "CEF",
  "definition": {
    "remove_empty_fields": true,
    "customize": true,
    "custom_fields": [
      {
        "name": "date",
        "source": "date",
        "default": ""
      },
      {
        "name": "time",
        "source": "time",
        "default": ""
      },
      {
        "name": "time-taken",
        "source": "time-taken",
        "default": ""
      },
      {
        "name": "cs-bytes",
        "source": "cs-bytes",
        "default": ""
      },
      {
        "name": "sc-bytes",
        "source": "sc-bytes",
        "default": ""
      },
      {
        "name": "bytes",
        "source": "bytes",
        "default": ""
      },
      {
        "name": "c-ip",
        "source": "c-ip",
        "default": ""
      },
      {
        "name": "s-ip",
        "source": "s-ip",
        "default": ""
      },
      {
        "name": "cs-username",
        "source": "cs-username",
        "default": ""
      },
      {
        "name": "cs-method",
        "source": "cs-method",
        "default": ""
      },
      {
        "name": "cs-uri-scheme",
        "source": "cs-uri-scheme",
        "default": ""
      },
      {
        "name": "cs-uri-query",
        "source": "cs-uri-query",
        "default": ""
      },
      {
        "name": "cs-user-agent",
        "source": "cs-user-agent",
        "default": ""
      },
      {
        "name": "cs-content-type",
        "source": "cs-content-type",
        "default": ""
      },
      {
        "name": "sc-status",
        "source": "sc-status",
        "default": ""
      },
      {
        "name": "sc-content-type",
        "source": "sc-content-type",
        "default": ""
      },
      {
        "name": "cs-dns",
        "source": "cs-dns",
        "default": ""
      },
      {
        "name": "cs-host",
        "source": "cs-host",
        "default": ""
      },
      {
        "name": "cs-uri",
        "source": "cs-uri",
        "default": ""
      },
      {
        "name": "cs-uri-port",
        "source": "cs-uri-port",
        "default": ""
      },
      {
        "name": "cs-referer",
        "source": "cs-referer",
        "default": ""
      },
      {
        "name": "x-cs-session-id",
        "source": "x-cs-session-id",
        "default": ""
      },
      {
        "name": "x-cs-access-method",
        "source": "x-cs-access-method",
        "default": ""
      },
      {
        "name": "x-cs-app",
        "source": "x-cs-app",
        "default": ""
      },
      {
        "name": "x-s-country",
        "source": "x-s-country",
        "default": ""
      },
      {
        "name": "x-s-latitude",
        "source": "x-s-latitude",
        "default": ""
      },
      {
        "name": "x-s-longitude",
        "source": "x-s-longitude",
        "default": ""
      },
      {
        "name": "x-s-location",
        "source": "x-s-location",
        "default": ""
      },
      {
        "name": "x-s-region",
        "source": "x-s-region",
        "default": ""
      },
      {
        "name": "x-s-zipcode",
        "source": "x-s-zipcode",
        "default": ""
      },
      {
        "name": "x-c-country",
        "source": "x-c-country",
        "default": ""
      },
      {
        "name": "x-c-latitude",
        "source": "x-c-latitude",
        "default": ""
      },
      {
        "name": "x-c-longitude",
        "source": "x-c-longitude",
        "default": ""
      },
      {
        "name": "x-c-location",
        "source": "x-c-location",
        "default": ""
      },
      {
        "name": "x-c-region",
        "source": "x-c-region",
        "default": ""
      },
      {
        "name": "x-c-zipcode",
        "source": "x-c-zipcode",
        "default": ""
      },
      {
        "name": "x-c-os",
        "source": "x-c-os",
        "default": ""
      },
      {
        "name": "x-c-browser",
        "source": "x-c-browser",
        "default": ""
      },
      {
        "name": "x-c-browser-version",
        "source": "x-c-browser-version",
        "default": ""
      },
      {
        "name": "x-c-device",
        "source": "x-c-device",
        "default": ""
      },
      {
        "name": "x-cs-site",
        "source": "x-cs-site",
        "default": ""
      },
      {
        "name": "x-cs-timestamp",
        "source": "x-cs-timestamp",
        "default": ""
      },
      {
        "name": "x-cs-page-id",
        "source": "x-cs-page-id",
        "default": ""
      },
      {
        "name": "x-cs-userip",
        "source": "x-cs-userip",
        "default": ""
      },
      {
        "name": "x-cs-traffic-type",
        "source": "x-cs-traffic-type",
        "default": ""
      },
      {
        "name": "x-cs-tunnel-id",
        "source": "x-cs-tunnel-id",
        "default": ""
      },
      {
        "name": "x-category",
        "source": "x-category",
        "default": ""
      },
      {
        "name": "x-other-category",
        "source": "x-other-category",
        "default": ""
      },
      {
        "name": "x-type",
        "source": "x-type",
        "default": ""
      },
      {
        "name": "x-server-ssl-err",
        "source": "x-server-ssl-err",
        "default": ""
      },
      {
        "name": "x-client-ssl-err",
        "source": "x-client-ssl-err",
        "default": ""
      },
      {
        "name": "x-transaction-id",
        "source": "x-transaction-id",
        "default": ""
      },
      {
        "name": "x-request-id",
        "source": "x-request-id",
        "default": ""
      },
      {
        "name": "x-cs-sni",
        "source": "x-cs-sni",
        "default": ""
      },
      {
        "name": "x-cs-domain-fronted-sni",
        "source": "x-cs-domain-fronted-sni",
        "default": ""
      },
      {
        "name": "x-category-id",
        "source": "x-category-id",
        "default": ""
      },
      {
        "name": "x-other-category-id",
        "source": "x-other-category-id",
        "default": ""
      },
      {
        "name": "x-sr-headers-name",
        "source": "x-sr-headers-name",
        "default": ""
      },
      {
        "name": "x-sr-headers-value",
        "source": "x-sr-headers-value",
        "default": ""
      }
    ],
    "header": [
      {
        "name": "device_vendor",
        "source": "vendor_field",
        "default": "Updated Vendor"
      },
      {
        "name": "device_product",
        "source": "product_field",
        "default": "WebTX"
      },
      {
        "name": "device_version",
        "source": "version_field",
        "default": "2.0"
      },
      {
        "name": "signature_id",
        "source": "signature_id_field",
        "default": "unknown_signature"
      },
      {
        "name": "name",
        "source": "name_field",
        "default": "unknown_name"
      },
      {
        "name": "severity",
        "source": "severity_field",
        "default": "medium"
      }
    ],
    "syslog_header": "<%priority%>%timestamp% netskope"
  },
  "create_by": "esc",
  "create_time": "2025-12-02T13:50:35.385Z",
  "modify_by": "esc",
  "modify_time": "2025-12-02T14:00:03.728Z"
}

• id: UUID of the object, can defined at the creation time but read only after creation
• name: name of the object
• description: description of the object
• type: Format type from the following values: JSON, CEF, ELFF
• definition: configuration of the fields list and content
  • remove_empty_fields: if a field has no value, this option will remove the key (supported for JSON and CEF)
  • customize: enable the custom_fields configuration to customize the content sent to the SIEM. Please note customize = true is now mandatory.
  • custom_fields: ordered list of fields which support field selection, field rename and default value
    • name: field name visible in the SIEM
    • source: Netskope source field name, this value can be empty to create static fields (same value for all events, defined by default value) or must be one of the supported Transaction Events fields.
    • default: if the source field has empty value (or source configuration is empty), Event Streaming Client will replace it with this definition.
  • header: header configuration (only for CEF format)
    • name: name of the CEF field
    • source: Netskope source field name, this value can be empty to create static fields (same value for all events, defined by default value) or must be one of the supported Transaction Events fields.
    • default: if the source field has empty value (or source configuration is empty), Event Streaming Client will replace it with this definition.
  • syslog_header: configuration of the header added at the beginning of each syslog event following RFC 3164. The string can include variables enclosed between %, the following variables are supported:
    • %timestamp%: host system time in UTC/GMT timezone in RFC 3164 format Mmm dd

hh:mm:ss. This is the host time, not the event time.

• %hostname%: system hostname
  • %priority%: event priority
  • %pid%: service running PID
• create_by: admin account used for object creation (read only)
• create_time: creation time (read only)
• modify_by: admin account used for the last edit (read only)
• modify_time: time of the last edit (read only)

Format Object API Endpoints

Only standard Endpoints are available for Format object:

Destination Configuration

Destination object definition

Example with two targets to the same syslog server:

{
    "id": "0198eb",
    "name": "Syslog1",
    "description": "Primary SIEM destination for production logs",
    "enabled": true,
    "type": "syslog_tcp",
    "format": "0198f093",
    "targets": [
      {
        "client": "0198ec",
        "ip": "syslog1.domain.local",
        "port": 514,
        "enabled": true
      },
      {
        "client": "0198f5410",
        "ip": "syslog1.domain.local",
        "port": 514,
        "enabled": true
      }
    ],
    "create_by": "esc",
    "create_time": "2025-08-27T11:44:40.557Z",
    "modify_by": "esc",
    "modify_time": "2025-09-01T12:45:13.966Z"
  }

Format object is used to define fields selected to the message sent via Syslog.

• id: UUID of the object, can defined at the creation time but read only after creation
• name: name of the object
• description: description of the object
• enabled: define if the destination is disable or enabled. A disabled destination will not streal any events. Only one destination can be enabled per tenant.
• type: either syslog_udp or syslog_tcp. We highly recommend syslog_tcp to avoid loss of events.
• format: the id of the format object previously configured
• targets: array which reference a streaming client and a syslog destination. Create a record for each client to syslog definition (the same client id can be used multiple times, the same syslog server destination can be used multiple times)
  • client: the id of the client object previously configured
  • ip: IP or FQDN of the syslog server
  • port: TCP/UDP port of the syslog server
  • enabled: status of the target. A disabled target will not receive any event
• create_by: admin account used for object creation (read only)
• create_time: creation time (read only)
• modify_by: admin account used for the last edit (read only)
• modify_time: time of the last edit (read only)

Destination Object API Endpoints

Only standard Endpoints are available for Destination object:

Log Streaming Configuration

There are currently three endpoints for log streaming configuration. Endpoints are not following API structure defined in the section, API Endpoint Standard Definition.

Create Stream for Event Streaming Client

Example of JSON for stream creation:

{
  "streamType": "transaction",
  "name": "Transaction Stream",
  "provider": "streamingclient",
  "credential": {
    "streamingclient": {
      "client-destination": "019914ea"
    }
  },
  "compressionType": "zstd"
}

Read Stream Configuration

Edit Stream Configuration

Delete a Stream

HTTP Proxy Configuration

If Event Streaming Client requires an HTTP Proxy to download updates (docker pull), it must be configured at the systemd level following Proxy configuration for Docker.

If the Event Streaming Client requires an HTTP Proxy to connect to the Management Plane for configuration and events, it must be configured with the installation script, as covered in Event Streaming Client Deployment.