Before deployment, please:
- review Event Streaming Client Architectures and define the target architecture.
- review Event Streaming Client Requirements
The deployment of Event Streaming Client requires the following steps:
- Setting up API Access
- Client installation for each Event Streaming Client to deploy.
- One format configuration to define what data will be forwarded to the SIEM
- One destination configuration to define the SIEM targets for each client and the active format
- Log streaming configuration will then enable Event Streaming Client Destination
API access
Creating a role and token is covered in Event Streaming Client API Access
Client Installation
Client installation is done in 2 steps:
- Declaring a new client via API and generating a token
- Deploying the client on the host device
Client Configuration
After successful authentication to Netskope API Swagger, the Event Streaming Client configuration is available with /api/v2/streamingclient/clients endpoints:
- Create a new Client with the POST method by using “Try it out” button:
- It is possible to check created Clients with GET method
For more details, check Event Streaming Client Configuration
Download the installer
From Swagger
From Linux
Command:
curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
Example:
root@lab-esc1:~# curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 10796 100 10796 0 0 57922 0 --:--:-- --:--:-- --:--:-- 58994
root@lab-esc1:~# tar -zxvf NS_StreamingClient_Installer.tar.gz
netskope_event_streamingclient_installer.py
README.md
Instance Deployment
- Connect to the Linux Server
- Make sure Python3 and Docker are installed
- Get the installer from the previous step
- Check dedicated configuration for your system
To use docker with an HTTP Proxy, refer to Proxy configuration for Docker
To use RHEL with Podman, refer to Red Hat and Podman configuration - Run the installer script
python3 netskope_event_streamingclient_installer.py
6. Select install option and answer all requested inputs:
- location of the files, by default
/root/ns Enter the client keyis the token generated with the API /api/v2/streamingclient/clients/{id}/token- Day and time of the week for the auto update
- Optionally define the HTTP Proxy
Example
root@lab-esc2:~# python3 netskope_event_streamingclient_installer.py NETSKOPE LOG STREAM CLIENT INSTALLER I.2025.11.1 Please specify an option: 1. install - Set up and configure the container 2. reinstall - Remove and recreate the container 3. uninstall - Remove the container and cleanup Enter option (install/reinstall/uninstall): 1 INSTALLATION >>> Checking if operating system is supported... SUCCESS: Check for operating system passed. >>> Checking if hardware architecture is supported... SUCCESS: Check for Architecture passed. >>> Checking if Docker is installed and running... SUCCESS: Docker is installed. SUCCESS: Docker daemon is running. SUCCESS: All the systems checks passed. Configuring container ... Enter the directory path to store the installation files and logs [default: /root/ns]: Enter the client key : eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhb Client key: eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhbWluZ2NsaWVudC1h Please set up a weekly schedule for automatic Docker image updates. Do you want to use the default schedule (Thursday at 23:00)? [y/n]: y >>> Configuring proxy settings... Do you need proxy setup for Streaming Client? [y/n] (default: n): y INFO: Configuring proxy for containers --- Streaming Client Container Proxy Configuration --- This proxy will be used by the running containers for their operations. HTTPS Proxy URL (e.g., http://proxy.company.com:8080 or https://proxy.company.com:8080): http://163.xxx.xxx.80:80 INFO: Container HTTPS proxy configured: http://163.xxx.xxx.80:80 >>> Setting up and starting the container... INFO: Using existing installation directory: /root/ns >>> Pulling Docker image: netskope/nsstreamingclient:stable The process might take a moment... stable: Pulling from netskope/nsstreamingclient 645635fbf4d2: Pull complete c9debdf8207a: Pull complete 94e09fa58eb4: Pull complete c5b5b574d9eb: Pull complete 9a47257481ca: Pull complete 2f5e1dfb2cd4: Pull complete f9514487b3cf: Pull complete 78e884c4c39d: Pull complete 2aac2ff272d9: Pull complete da51ee03c947: Pull complete a84060cbac16: Pull complete 477d64974173: Pull complete 9a1325d79269: Pull complete a71a358f9aef: Pull complete 44d06538ce68: Pull complete 14477cceda61: Pull complete 8fb98c22d537: Pull complete db9fdfbf3f52: Pull complete 4958661942a9: Pull complete 1540d139dc0c: Pull complete b1f4e241f375: Pull complete 94bfc05d13f2: Pull complete 7f247b6c83f6: Pull complete a8cda5c427fe: Pull complete 28eedd26b6c7: Pull complete b9ce487eef38: Pull complete 0f452909bfe0: Pull complete bcdfc9f5c9e1: Pull complete 082b67164622: Pull complete 336355755be8: Pull complete 9e505fd59acf: Pull complete c4a41b87cf93: Pull complete de55d536641a: Pull complete 11aacba49461: Pull complete Digest: sha256:ea143d8520 Status: Downloaded newer image for netskope/nsstreamingclient:stable docker.io/netskope/nsstreamingclient:stable SUCCESS: Docker image pulled successfully! INFO: Configuring container volumes and environment variables... INFO: Initialized installer information log file. INFO: Container configuration file created successfully INFO: Creating proxy configuration file... INFO: Creating proxy configuration file... SUCCESS: Proxy configuration saved to proxy.env INFO: Starting container... INFO: Adding HTTPS proxy to container: http://163.xxx.xxx.80:80 e9fe4c230e5cc191 SUCCESS: Container 'nsstreamingclient' started successfully! Container files and Log files will be stored in: /root/ns >>> Setting up watcher container to monitor the main container... INFO: Pulling watcher image... stable: Pulling from netskope/nswatcher 21b919804656: Pull complete 891cc33da41a: Pull complete e6eb3a86a632: Pull complete edeb9247ddd4: Pull complete f988b2dd9cbf: Pull complete ef090e4f8d13: Pull complete b935cef6a087: Pull complete 06e748922bc3: Pull complete 49b990c12c1f: Pull complete fa2956f00aa5: Pull complete 3df31e584803: Pull complete 4164121f60f1: Pull complete f99197fd9601: Pull complete 1737cff1e8c9: Pull complete 60957cee4d80: Pull complete 964929934f06: Pull complete 5d335edf6f34: Pull complete 26ddf93d0751: Pull complete 141fda38c9b5: Pull complete 093dc20aa13e: Pull complete Digest: sha256:8eb9a2 Status: Downloaded newer image for netskope/nswatcher:stable docker.io/netskope/nswatcher:stable INFO: Starting watcher container... INFO: Adding container HTTPS proxy to watcher container: http://163.xxx.xxx.80:80 f519daf55cax SUCCESS: Watcher container started successfully! >>> Waiting for configuration to complete (max 60 seconds)... PROGRESS: Client is not enabled INFO: Installation successful. Waiting for configuration download... INFO: Monitoring for 15s ... Successfully downloaded stream configuration INSTALLATION COMPLETE root@lab-esc2:~#
Instance validation
To verify the instance is running we recommend to check
- Instance is running
root@lab-esc1:~# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES ac518e00355f netskope/nsstreamingclient:stable "./start.sh s h ' ' …" 2 minutes ago Up 2 minutes nsstreamingclient bf534b netskope/nswatcher:stable "bash start.sh" 2 days ago Up 2 days ns-watcher root@lab-esc1:~#
- Docker logs
root@lab-esc1:~# docker logs nsstreamingclient
2025/09/04 13:16:53 Primary config missing (/opt/ns/cfg/container_config). Trying fallback (/app/container_config)...
Install Log: Starting static configuration and token loading process.
Install Log: Configuration variables loaded successfully.
2025/09/04 13:16:53 Start decrypting container and connection keys from the env app.env file
2025/09/04 13:16:53 Starting metrics logging
{"level":"info","timestamp":"2025-09-04T13:16:53.112Z","caller":"log/log.go:86","msg":"Start collecting the system metrics"}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Connected with syslog."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Syslog details verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Configuration verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"Successfully downloaded stream configuration"}
{"level":"info","timestamp":"2025-09-04T13:16:53.202Z","caller":"log/log.go:86","msg":"starting stream config watcher"}
{"level":"info","timestamp":"2025-09-04T13:16:53.209Z","caller":"log/log.go:86","msg":"Creating connections for log streamer","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c","conNum":8}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.582Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.583Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.676Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"starting stream...."}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log streamer","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
- Log files can also be found under folder
container_files/logsinside the selected location at the installation
Description of log messages is provided in the “Troubleshooting” section at the bottom of the guide.
Format configuration
Event Streaming Client supports the following formats:
- CEF
- ELFF
- JSON
While JSON is the most universal, it’s also the slowest because the structure. CEF is generally a good compromise between wide support and performance. ELFF remains the most performant but is not natively supported by all SIEMs.
- Use POST to create a first Format
- PATCH can be used to add or change options after creation
- The Format ID is required to configure Destination object
- For more details, check Event Streaming Client Configuration
Example with Default JSON Format:
{
"name": "Default JSON",
"type": "JSON",
"definition": {
"remove_empty_fields": true,
"customize": false
}
}
Destination configuration
Destination object is used to define the SIEM address for each client.
To provide a fully working configuration, the following informations are required:
- The Client ID found in the Client object (the Client object must be enabled)
- The Format ID found in the Format object
- The IP/Domain of the SIEM, the port and protocol to use
- Create a destination with POST API
- PATCH can be used to add or change options after creation
- Make sure the Destination has
- A Target with a working Client ID
- The target is enabled
- The Destination object is enabled
- The Client object is enabled
- For more details, check Event Streaming Client Configuration
Example:
{
"name": "Sample destination",
"enabled": true,
"type": "syslog_tcp",
"format": "019914ed",
"targets":
[
{
"client": "0198eb4f",
"ip": "lab-splunk4.info",
"port": 5151,
"enabled": true
}
]
}
Log Streaming configuration
Only one Log streaming can be configured for Transaction Events
There is currently no validation of the Destination ID, make sure the destination ID is correct
Use POST /api/v2/events/logstreaming/stream API to register the Destination
{
"streamType": "transaction",
"name": "Transaction Stream",
"provider": "streamingclient",
"credential": {
"streamingclient": {
"client-destination": "REPLACE WITH YOUR DESTINATION ID"
}
},
"compressionType": "zstd"
}
- To edit an existing configuration, use the PUT /api/v2/events/logstreaming/stream/{streamId} API
- For more details, check Event Streaming Client Configuration