Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Transaction Events
    Event Streaming Client Deployment

    Event Streaming Client Deployment

    Before deployment, please:

    • review Event Streaming Client Architectures and define the target architecture.
    • review Event Streaming Client Requirements

    The deployment of Event Streaming Client requires the following steps:

    1. Setting up API Access
    2. Client installation for each Event Streaming Client to deploy.
    3. One format configuration to define what data will be forwarded to the SIEM
    4. One destination configuration to define the SIEM targets for each client and the active format
    5. Log streaming configuration will then enable Event Streaming Client Destination

    API access

    Creating a role and token is covered in Event Streaming Client API Access

    Client Installation

    Client installation is done in 2 steps:

    1. Declaring a new client via API and generating a token
    2. Deploying the client on the host device

    Client Configuration

    After successful authentication to Netskope API Swagger, the Event Streaming Client configuration is available with /api/v2/streamingclient/clients endpoints:

    • Create a new Client with the POST method by using “Try it out” button:
    • It is possible to check created Clients with GET method

    For more details, check Event Streaming Client Configuration

    Download the installer

    From Swagger

    From Linux

    Command:

    curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ

    Example:

    root@lab-esc1:~# curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10796  100 10796    0     0  57922      0 --:--:-- --:--:-- --:--:-- 58994
root@lab-esc1:~# tar -zxvf NS_StreamingClient_Installer.tar.gz
netskope_event_streamingclient_installer.py
README.md

    Instance Deployment

    1. Connect to the Linux Server
    2. Make sure Python3 and Docker are installed
    3. Get the installer from the previous step
    4. Check dedicated configuration for your system
      To use docker with an HTTP Proxy, refer to Proxy configuration for Docker
      To use RHEL with Podman, refer to Red Hat and Podman configuration
      1. Run the installer script
      python3 netskope_event_streamingclient_installer.py

      6. Select install option and answer all requested inputs:

      • location of the files, by default /root/ns
      • Enter the client key is the token generated with the API /api/v2/streamingclient/clients/{id}/token
      • Day and time of the week for the auto update
      • Optionally define the HTTP Proxy

      Example

      root@lab-esc2:~# python3 netskope_event_streamingclient_installer.py
NETSKOPE LOG STREAM CLIENT INSTALLER I.2025.11.1

Please specify an option:
1. install   - Set up and configure the container
2. reinstall - Remove and recreate the container
3. uninstall - Remove the container and cleanup

Enter option (install/reinstall/uninstall): 1
INSTALLATION

>>> Checking if operating system is supported...
SUCCESS: Check for operating system passed.

>>> Checking if hardware architecture is supported...
SUCCESS: Check for Architecture passed.

>>> Checking if Docker is installed and running...
SUCCESS: Docker is installed.
SUCCESS: Docker daemon is running.

SUCCESS: All the systems checks passed.

Configuring container ...

Enter the directory path to store the installation files and logs [default: /root/ns]:
Enter the client key : eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhb
Client key: eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhbWluZ2NsaWVudC1h

Please set up a weekly schedule for automatic Docker image updates.

Do you want to use the default schedule (Thursday at 23:00)? [y/n]: y

>>> Configuring proxy settings...

Do you need proxy setup for Streaming Client? [y/n] (default: n): y
INFO: Configuring proxy for containers

--- Streaming Client Container Proxy Configuration ---
This proxy will be used by the running containers for their operations.
HTTPS Proxy URL (e.g., http://proxy.company.com:8080 or https://proxy.company.com:8080): http://163.xxx.xxx.80:80
INFO: Container HTTPS proxy configured: http://163.xxx.xxx.80:80

>>> Setting up and starting the container...
INFO: Using existing installation directory: /root/ns

>>> Pulling Docker image: netskope/nsstreamingclient:stable
The process might take a moment...
stable: Pulling from netskope/nsstreamingclient
645635fbf4d2: Pull complete
c9debdf8207a: Pull complete
94e09fa58eb4: Pull complete
c5b5b574d9eb: Pull complete
9a47257481ca: Pull complete
2f5e1dfb2cd4: Pull complete
f9514487b3cf: Pull complete
78e884c4c39d: Pull complete
2aac2ff272d9: Pull complete
da51ee03c947: Pull complete
a84060cbac16: Pull complete
477d64974173: Pull complete
9a1325d79269: Pull complete
a71a358f9aef: Pull complete
44d06538ce68: Pull complete
14477cceda61: Pull complete
8fb98c22d537: Pull complete
db9fdfbf3f52: Pull complete
4958661942a9: Pull complete
1540d139dc0c: Pull complete
b1f4e241f375: Pull complete
94bfc05d13f2: Pull complete
7f247b6c83f6: Pull complete
a8cda5c427fe: Pull complete
28eedd26b6c7: Pull complete
b9ce487eef38: Pull complete
0f452909bfe0: Pull complete
bcdfc9f5c9e1: Pull complete
082b67164622: Pull complete
336355755be8: Pull complete
9e505fd59acf: Pull complete
c4a41b87cf93: Pull complete
de55d536641a: Pull complete
11aacba49461: Pull complete
Digest: sha256:ea143d8520
Status: Downloaded newer image for netskope/nsstreamingclient:stable
docker.io/netskope/nsstreamingclient:stable
SUCCESS: Docker image pulled successfully!
INFO: Configuring container volumes and environment variables...
INFO: Initialized installer information log file.
INFO: Container configuration file created successfully
INFO: Creating proxy configuration file...
INFO: Creating proxy configuration file...
SUCCESS: Proxy configuration saved to proxy.env
INFO: Starting container...
INFO: Adding HTTPS proxy to container: http://163.xxx.xxx.80:80
e9fe4c230e5cc191
SUCCESS: Container 'nsstreamingclient' started successfully!
Container files and Log files will be stored in: /root/ns

>>> Setting up watcher container to monitor the main container...
INFO: Pulling watcher image...
stable: Pulling from netskope/nswatcher
21b919804656: Pull complete
891cc33da41a: Pull complete
e6eb3a86a632: Pull complete
edeb9247ddd4: Pull complete
f988b2dd9cbf: Pull complete
ef090e4f8d13: Pull complete
b935cef6a087: Pull complete
06e748922bc3: Pull complete
49b990c12c1f: Pull complete
fa2956f00aa5: Pull complete
3df31e584803: Pull complete
4164121f60f1: Pull complete
f99197fd9601: Pull complete
1737cff1e8c9: Pull complete
60957cee4d80: Pull complete
964929934f06: Pull complete
5d335edf6f34: Pull complete
26ddf93d0751: Pull complete
141fda38c9b5: Pull complete
093dc20aa13e: Pull complete
Digest: sha256:8eb9a2
Status: Downloaded newer image for netskope/nswatcher:stable
docker.io/netskope/nswatcher:stable
INFO: Starting watcher container...
INFO: Adding container HTTPS proxy to watcher container: http://163.xxx.xxx.80:80
f519daf55cax
SUCCESS: Watcher container started successfully!
>>> Waiting for configuration to complete (max 60 seconds)...
PROGRESS: Client is not enabled
INFO: Installation successful. Waiting for configuration download...
INFO: Monitoring for 15s ...
Successfully downloaded stream configuration
INSTALLATION COMPLETE
root@lab-esc2:~#

      Instance validation

      To verify the instance is running we recommend to check

      • Instance is running
      root@lab-esc1:~# docker ps
CONTAINER ID   IMAGE                               COMMAND                  CREATED         STATUS         PORTS     NAMES
ac518e00355f   netskope/nsstreamingclient:stable   "./start.sh s h ' ' …"   2 minutes ago   Up 2 minutes             nsstreamingclient
bf534b   netskope/nswatcher:stable           "bash start.sh"          2 days ago      Up 2 days                ns-watcher
root@lab-esc1:~#
      • Docker logs
      root@lab-esc1:~# docker logs nsstreamingclient
2025/09/04 13:16:53 Primary config missing (/opt/ns/cfg/container_config). Trying fallback (/app/container_config)...
Install Log: Starting static configuration and token loading process.
Install Log: Configuration variables loaded successfully.
2025/09/04 13:16:53 Start decrypting container and connection keys from the env app.env file
2025/09/04 13:16:53 Starting metrics logging
{"level":"info","timestamp":"2025-09-04T13:16:53.112Z","caller":"log/log.go:86","msg":"Start collecting the system metrics"}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Connected with syslog."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Syslog details verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Configuration verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"Successfully downloaded stream configuration"}
{"level":"info","timestamp":"2025-09-04T13:16:53.202Z","caller":"log/log.go:86","msg":"starting stream config watcher"}
{"level":"info","timestamp":"2025-09-04T13:16:53.209Z","caller":"log/log.go:86","msg":"Creating connections for log streamer","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c","conNum":8}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.582Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.583Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.676Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"starting stream...."}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log streamer","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
      • Log files can also be found under folder container_files/logs inside the selected location at the installation

      Description of log messages is provided in the “Troubleshooting” section at the bottom of the guide.

      Format configuration

      Event Streaming Client supports the following formats:

      • CEF
      • ELFF
      • JSON

      While JSON is the most universal, it’s also the slowest because the structure. CEF is generally a good compromise between wide support and performance. ELFF remains the most performant but is not natively supported by all SIEMs.

      • Use POST to create a first Format
      • PATCH can be used to add or change options after creation
      • The Format ID is required to configure Destination object
      • For more details, check Event Streaming Client Configuration

      Example with Default JSON Format:

      {
  "name": "Default JSON",
  "type": "JSON",
  "definition": {
    "remove_empty_fields": true,
    "customize": false
  }
}

      Destination configuration

      Destination object is used to define the SIEM address for each client.

      To provide a fully working configuration, the following informations are required:

      • The Client ID found in the Client object (the Client object must be enabled)
      • The Format ID found in the Format object
      • The IP/Domain of the SIEM, the port and protocol to use
      • Create a destination with POST API
      • PATCH can be used to add or change options after creation
      • Make sure the Destination has
        • A Target with a working Client ID
        • The target is enabled
        • The Destination object is enabled
        • The Client object is enabled
      • For more details, check Event Streaming Client Configuration

      Example:

      {
    "name": "Sample destination",
    "enabled": true,
    "type": "syslog_tcp",
    "format": "019914ed",
    "targets":
    [
        {
            "client": "0198eb4f",
            "ip": "lab-splunk4.info",
            "port": 5151,
            "enabled": true
        }
    ]
}

      Log Streaming configuration

      Only one Log streaming can be configured for Transaction Events
      There is currently no validation of the Destination ID, make sure the destination ID is correct

      Use POST /api/v2/events/logstreaming/stream API to register the Destination

      {
  "streamType": "transaction",
  "name": "Transaction Stream",
  "provider": "streamingclient",
  "credential": {
    "streamingclient": {
      "client-destination": "REPLACE WITH YOUR DESTINATION ID"
    }
  },
  "compressionType": "zstd"
}
      • To edit an existing configuration, use the PUT /api/v2/events/logstreaming/stream/{streamId} API
      • For more details, check Event Streaming Client Configuration

      In this Topic
      • Event Streaming Client Deployment