Kolide By 1Password Plugin for Risk Exchange

This document explains how to configure the Kolide v1.0.0 plugin with the Risk Exchange module on the Netskope Cloud Exchange platform. This plugin is used to fetch provisioned and deprovisioned users. Provisioned users are retrieved from the People page, and devices are retrieved from the Devices page in Kolide.

This plugin also supports enriching device records with open issue counts and device compliance status (via the Kolide Shared Signals Framework stream). This plugin supports the Manage Device Group action to add devices to or remove devices from a Kolide device group. This plugin does not support performing any actions on the users entity.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to a Kolide By 1Password instance.

Kolide By 1Password Plugin Support

This plugin is used to fetch provisioned and deprovisioned users. Provisioned users are retrieved from the ‘People’ page and devices are retrieved from the ‘Devices’ page in Kolide. It also supports enriching device records with open issue counts and device compliance status (via the Kolide Shared Signals Framework stream). This plugin supports the ‘Manage Device Group’ action to add devices to or remove devices from a Kolide device group. This plugin does not support performing any actions on the user’s entity.

Mappings

Mappings are used to view the pulled Users and Devices along with their respective details. Fields mapped during the plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mapping for Devices

Pull Mapping for Users

Permissions

API Key must have below listed permissions:

• Manage Device Groups
• Manage Shared Signals Framework Streams

{
    "organization_id": 6064,
    "organization_name": "Netskope Sandbox"
}

{
    "data": [
        {
            "id": "500001",
            "name": "Alex Carter",
            "email": "alex.carter@netskope.com",
            "created_at": "2026-07-01T06:41:15.653Z",
            "last_authenticated_at": null,
            "has_registered_device": true,
            "usernames": [
                "alex.carter@netskope.com"
            ]
        },
        {
            "id": "500002",
            "name": "Jordan Reyes",
            "email": "jordan.reyes@netskope.com",
            "created_at": "2026-07-14T09:07:15.804Z",
            "last_authenticated_at": null,
            "has_registered_device": false,
            "usernames": [
                "jordan.reyes@netskope.com"
            ]
        }
    ],
    "pagination": {
        "next": "",
        "next_cursor": "",
        "current_cursor": "",
        "count": 2
    }
}

{
    "data": [
        {
            "id": "500101",
            "name": "Morgan Lee",
            "email": "morgan.lee@netskope.com",
            "created_at": "2026-04-16T18:14:42.954Z",
            "last_authenticated_at": null,
            "has_registered_device": false,
            "api_url": "https://api.kolide.com/people/500101"
        },
        {
            "id": "500102",
            "name": "Taylor Kim",
            "email": "taylor.kim@netskope.com",
            "created_at": "2026-04-30T13:13:56.248Z",
            "last_authenticated_at": null,
            "has_registered_device": false,
            "api_url": "https://api.kolide.com/people/500102"
        }
    ],
    "pagination": {
        "next": "",
        "next_cursor": "",
        "current_cursor": "",
        "count": 2
    }
}

{
    "data": [
        {
            "id": "700001",
            "name": "WKS-LNX-01",
            "registered_at": null,
            "last_authenticated_at": null,
            "last_seen_at": "2026-07-15T07:18:14.000Z",
            "registered_owner_info": {
                "identifier": "",
                "link": null
            },
            "operating_system": "Ubuntu 20.04.6 LTS (Focal Fossa)",
            "hardware_model": "Generic Desktop",
            "serial": "SN-7F3A9C21B6D4",
            "hardware_uuid": "3F2A9B10-55C4-4E7A-9D21-8B6C4F0A1234",
            "note": null,
            "auth_state": "Good",
            "will_block_at": null,
            "product_image_url": "https://assets1.kolide.com/assets/inventory/devices/generic-desktop.png",
            "auth_configuration": null,
            "device_type": "Linux",
            "form_factor": "computer"
        },
        {
            "id": "700002",
            "name": "WKS-WIN-02",
            "registered_at": "2026-07-17T12:26:12.469Z",
            "last_authenticated_at": null,
            "last_seen_at": "2026-07-20T04:29:58.000Z",
            "registered_owner_info": {
                "identifier": "500001",
                "link": "https://api.kolide.com/people/500001"
            },
            "operating_system": "Microsoft Windows 11 Enterprise",
            "hardware_model": "Generic Laptop",
            "serial": "SN-4B2E7A88F310",
            "hardware_uuid": "9C1D4E20-77A5-4B3E-8F12-1A2B3C4D5E6F",
            "note": null,
            "auth_state": "Good",
            "will_block_at": null,
            "product_image_url": "https://assets1.kolide.com/assets/inventory/devices/generic-laptop.png",
            "auth_configuration": {
                "device_id": "700002",
                "authentication_mode": "anyone",
                "person_groups": []
            },
            "device_type": "Windows",
            "form_factor": "computer"
        }
    ],
    "pagination": {
        "next": "",
        "next_cursor": "",
        "current_cursor": "",
        "count": 2
    }
}

{
    "data": [
        {
            "id": "460604372",
            "issue_key": null,
            "issue_value": null,
            "title": "Primary Disk Is Low on Free Space",
            "value": {
                "path": "/",
                "device": "/dev/mapper/ubuntu--vg-ubuntu--lv",
                "available_gb": "18.541535232",
                "current_os_version": "20.04.6 LTS (Focal Fossa)",
                "KOLIDE_CHECK_STATUS": "FAIL",
                "available_percentage": "32.5980107815046"
            },
            "exempted": false,
            "resolved_at": null,
            "detected_at": "2026-07-03T11:51:49.799Z",
            "blocks_device_at": null,
            "device_information": {
                "identifier": "700001",
                "link": "https://api.kolide.com/devices/700001"
            },
            "check_information": {
                "identifier": "15806",
                "link": "https://api.kolide.com/checks/15806"
            },
            "last_rechecked_at": "2026-07-15T07:03:31.000Z"
        }
    ],
    "pagination": {
        "next": "https://api.kolide.com/issues?per_page=2&cursor=NDY0MzQ2Mzc4LDQ2NDM0NjM3OA==",
        "next_cursor": "NDY0MzQ2Mzc4LDQ2NDM0NjM3OA==",
        "current_cursor": "NDU5ODk4MzUwLDQ1OTg5ODM1MA==",
        "count": 1
    }
}

{
    "data": [
        {
            "id": "1389",
            "created_at": "2026-07-02T06:55:55.272Z",
            "name": "CRE Netskope",
            "description": "",
            "members_count": 1
        },
        {
            "id": "1403",
            "created_at": "2026-07-19T17:48:10.668Z",
            "name": "Non-Compliant Devices",
            "description": "Kolide Non-Compliant Devices",
            "members_count": 1
        }
    ],
    "pagination": {
        "next": "",
        "next_cursor": "",
        "current_cursor": "",
        "count": 2
    }
}

{
    "device_ids": ["700001", "700002"]
}

[
    {
        "device_id": 700001,
        "group_id": 1389
    },
    {
        "device_id": 700002,
        "group_id": 1389
    }
]

{
    "device_id": 700001,
    "group_id": 1389
}

{
    "name": "Netskope CE Kolide Plugin (<plugin configuration name>)",
    "delivery": {
        "method": "urn:ietf:rfc:8936"
    },
    "events_requested": [
        "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"
    ]
}

{
    "id": "1",
    "iss": "https://api.kolide.com",
    "stream_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "name": "Netskope CE Kolide Plugin (<plugin configuration name>)",
    "delivery_type": "poll",
    "spec_version": "draft",
    "enabled": true,
    "poll_bearer_token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "events_supported": [
        "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"
    ],
    "events_requested": [
        "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"
    ],
    "events_delivered": [
        "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change"
    ],
    "created_at": "2026-01-23T21:45:43.998Z",
    "updated_at": "2026-01-23T21:45:43.998Z",
    "delivery": {
        "method": "urn:ietf:rfc:8936"
    }
}

{
    "sets": {
        "abc123-uuid": "eyJhbGciOiJSUzI1NiIsInR5cCI6InNlY2V2ZW50K2p3dCJ9..."
    }
}

{
    "ack": ["abc123-uuid"]
}

202 Accepted

Performance Matrix

Below is the performance matrix conducted on a Large CE Stack with below-mentioned specifications by pulling 500k Devices and Users.

User Agent

netskope-ce-6.1.0-cre-kolide-v1.0.0

Workflow

1. Get your Secret Token on Kolide By 1Password.
2. Configure the Kolide Plugin.
3. Configure a Risk Exchange Business Rule.
4. Configure Risk Exchange Actions.
5. Validate the plugin.

Watch a Video

Click play to watch a video:

Get your Secret Token on Kolide By 1Password

1. Log in to your Kolide By 1Password instance and go to the Account > Settings.

   

2. Click Developers and open the API Keys page.

   

3. Click Create New Key.

   

4. Enter the Key Name and Primary contact per your needs, and provide these permissions:

   • Manage Device Groups
   • Manage Shared Signals Framework Streams

   

5. Click Save, and then copy the Secret Token as it will be used as the API Key while configuring the plugin.

Configure the Kolide Plugin

1. In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Kolide v1.0.0 (CRE) plugin.

   

2. Enter a plugin configuration name and change sync interval if needed.

   

3. Click Next and enter the Configuration Parameters: 

   • API Token: Kolide Secret Token used to authenticate all API requests. The token must be in the format k2sk_v1_<secret>. Use the Secret Token you obtained earlier.
   • Fetch Deprovisioned People: When set to Yes, deprovisioned (deleted/disabled) users are fetched along with active users and marked with Is Deleted set to true; active users are marked Is Deleted false. When set to No, only active users are fetched.
   • Fetch Open Issues: When set to Yes, all open compliance issues are fetched from Kolide and populate the Open Issues Count and Issue Title fields on Device records. When set to No, open issues are not fetched.
   • Fetch Compliance Status: When set to Yes, device compliance status is fetched from the Kolide SSF (Shared Signals Framework) stream and populates the Compliance Status field on Device records; an SSF stream is created automatically on first use. When set to No, compliance status is not fetched.

   

4. Click Next and select the required Entity from the Entity dropdown. Provide the field mappings per your needs. You can create a new Entity by clicking Add New Entity.

   

   To create a new field, click Add Field.

   

   Provide the Field Label, Data Type, Normalization, and Aggregate Strategy per your needs, and then click Save.

   

   Map the created fields:

   

   

   

   Refer to the Mappings section before configuring the plugin.

5. Click Save.

   

Configure a Risk Exchange Business Rule for the Kolide Plugin

1. Go to Risk Exchange > Business Rules and click Create New Rule.

2. Enter a Rule Name. Select the Entity for the Fields configured in the Kolide plugin, and configure the query based on your requirements. This example filters the data fetched from the plugin.

   

3. Click Save.

   

Configure Risk Exchange Actions for the Kolide Plugin

The Kolide plugin supports the following action types:

• Manage Device Groups: Add or remove Devices from the Group on Kolide By 1Password.
• No Action: No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Manage Device Groups

1. Go to Risk Exchange > Actions and click Add Action Configuration.
2. Select the required Business Rule, Target Plugin Configuration, and Action from their respective dropdowns.
3. Enable the Require Approval toggle if Approval is needed before performing action on the pulled records. Note that, if Require Approval is enabled, then you need to manually approve the execution of each action from the Risk Exchange > Action Logs page in Cloud Exchange.
4. Set the following Action Parameters:
   • Action Type: Whether to add devices to the group or remove them from it.
   • Device Group Name: Select the Kolide device group to manage. Note that only static mapping is supported for this field.
   • Device IDs: Device IDs to add to or remove from the group. Select the Kolide device ID source field or provide comma-separated device IDs.
5. Click Save.

No Action

1. Go to Risk Exchange > Actions and click Add Action Configuration.
2. Select the required Business Rule, Configuration, and Action from their respective dropdown.
3. Enable the Require Approval toggle if Approval is needed before performing action on the pulled records. Note that, if Require Approval is enabled, then you need to manually approve the execution of each action from the Risk Exchange > Action Logs page in Cloud Exchange.
4. Click Save.

Validate the Kolide Plugin

Validate in Cloud Exchange

Go to Risk Exchange > Records. Select the Entity that is selected while configuring the field mapping to view the pulled records.

To verify the logs related to pulled records, go to Logging and apply the filter with plugin name or plugin configuration name.

Logs for performed Manage Device Groups action:

When a pulled record matches one of the configured business rules, the configured action will be performed on the record. This can be seen at Risk Exchange > Action Logs.

Validate in Kolide

To validate the Devices and Users available on Kolide By 1Password:

In your Kolide By 1Password instance, and go to Devices to view the registered and unregistered devices.

Click on any of the devices to see its details.

Similarly, to view provisioned users, go to People.

Validate the Manage Device Groups Action

To validate the Manage Device Groups, go to Devices and filter the devices with the Group name used while configuring the action.

Troubleshooting the Kolide Plugin

Unable to configure the Koilde plugin

It may be due to invalid API Token or an API Token with insufficient permissions.

What to do: Verify the provided API Token is correct and it has all necessary permissions. Refer to the Generate API Key section.

Compliance Status or User Email on Devices stops updating

If Compliance Status or User Email stop updating on Devices, it could be due to one of these reasons:

• The Kolide SSF stream was deleted or expired on the Kolide side.
• No compliance-change event was delivered for the device during the poll cycle — in this case the field is left unchanged, not cleared.

What to do:

1. Check the plugin logs for a stream-recreation message; the plugin automatically creates a replacement stream when the poll fails and retries once.
2. Note that compliance changes occurring during the gap between the old stream failing and the new stream being created are not backfilled — trigger a new compliance change in Kolide to confirm the update is flowing again.

Plugin configuration fails to save when Fetch Compliance Status is enabled

If the plugin configuration fails to save with Fetch Compliance Status set to Yes, it could be due to one of these reasons:

• The API token does not have permission to manage SSF streams in Kolide.
• Kolide rejected the SSF stream creation request.

What to do:

1. Confirm the API key was created with access to SSF stream management endpoints. Refer to the Generate API Key section.
2. Retry saving the configuration; if it continues to fail, set Fetch Compliance Status to No and re-enable it after stream management access is confirmed.

Known Behaviors

• Disabling a plugin configuration keeps its Kolide SSF stream and stored credentials; the stream is deleted from Kolide only when the plugin configuration itself is deleted.
• If the Kolide SSF stream is deleted manually from the Kolide UI then during the next sync interval the plugin will create a New Kolide SSF stream but with that new stream it will not pull the old data. This is a platform behavior.