Release Notes
2.3.1 (Requires minimum Cloud Exchange version 6.1.0 and minimum Netskope Provider version 1.6.1)
Added
- Added coordinated cleanup of the shared client status iterator so it is removed only when no Netskope plugin (Risk Exchange or Log Shipper) is using it. This feature requires Netskope Provider plugin v1.6.1 and Cloud Exchange version v6.0.0 or above.
2.3.0
Added
- Added support for pulling forensics fields for DLP Incidents, To pull and ingest these fields update your Netskope Tenant version to 1.5.0 and CE version to 5.1.2.
- Added fields to download originalfile and subfile in Incident events.
2.2.1
Added
- Fixed compatibility issue when using a newer Log Shipper plugin with older provider versions.
2.2.0
Added
- Added support for Client status events, To pull and ingest this event type update your Netskope Tenant version to 1.4.0.
2.1.0
Added
- Added support for device and content alerts.
2.0.0
Changed
- The Log Shipper plugin has been restructured and is now available in the Default repository.
1.0.0
Added
- Initial release.
This document explains how to configure the Log Shipper v2.3.1 plugin in the Cloud Exchange platform. This plugin is used to fetch Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, and Content) and Events (Page, Application, Audit, Infrastructure, Network, Incident, Endpoint and Client Status) from your Netskope Tenant.
Prerequisites
To complete this configuration, you need:
- A Netskope Tenant (or multiple, for example, production and development/test instances).
- The Netskope tenant plugin already configured and the Log Shipper module enabled.
- Connectivity to a Netskope tenant with permission to generate v2/RBACv3 tokens.
- Have a 3rd-party plugin like Syslog already configured in Cloud Exchange.
Log Shipper Plugin Support
This plugin is used to fetch Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, and Content) and Events (Page, Application, Audit, Infrastructure, Network, Incident, Endpoint and Client Status) from Netskope Tenant.
| Data Type | Description |
|---|---|
| Event Types | Yes (Audit, Application, Infrastructure, Network, Incident, Page, Endpoint, Client Status) |
| Alert Types | Yes (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, CTEP, UBA, Device, Content) |
| WebTx | No |
Note
- Device and Content alerts are supported starting from Cloud Exchange CE v5.1.0 and Tenant Plugin v1.2.0
- Client status event is supported starting from Cloud Exchange v5.1.1 and Tenant Plugin v1.4.0
- Forensics Data for Incident events is supported starting from Cloud Exchange v5.1.2 and Tenant Plugin v1.5.0
- Coordinated cleanup of the shared client status iterator is supported from Cloud Exchange v6.1.0 and Tenant (Provider) v1.6.1
Mappings
Mapping File for Forensics Data
For ingesting forensics fields in CEF format you replace the mapping for incident event with the below snippet. This is just the suggested snippet, you can edit/update this as per your need. Make sure to only replace the incident event snippet in your mapping and not the entire mapping.
"incident": {
"header": {
"Device Vendor": {
"default_value": "Netskope",
"transformation": "String"
},
"Device Product": {
"default_value": "$tenant_name",
"transformation": "String"
},
"Device Version": {
"default_value": "NULL",
"transformation": "String"
},
"Device Event Class ID": {
"mapping_field": "type",
"default_value": "incident",
"transformation": "String"
},
"Name": {
"default_value": "NULL",
"transformation": "String"
},
"Severity": {
"default_value": "Unknown",
"transformation": "String"
}
},
"extension": {
"NetskopeJustificationType": {
"mapping_field": "justification_type",
"transformation": "String",
"default_value": "test"
},
"NetskopeJustificationReason": {
"mapping_field": "justification_reason",
"transformation": "String"
},
"fileId": {
"mapping_field": "object",
"transformation": "String"
},
"sourceServiceName": {
"mapping_field": "site",
"transformation": "String"
},
"outcome": {
"mapping_field": "status",
"transformation": "String"
},
"duser": {
"mapping_field": "assignee",
"transformation": "String"
},
"cfp3Label": {
"mapping_field": "severity",
"transformation": "String"
},
"deviceExternalId": {
"mapping_field": "instance_id",
"transformation": "String"
},
"cfp4Label": {
"mapping_field": "exposure",
"transformation": "String"
},
"c6a4Label": {
"mapping_field": "acting_user",
"transformation": "String"
},
"suser": {
"mapping_field": "user",
"transformation": "String"
},
"filePath": {
"mapping_field": "file_path",
"transformation": "String"
},
"fsize": {
"mapping_field": "file_size",
"transformation": "Integer"
},
"fileType": {
"mapping_field": "file_type",
"transformation": "String"
},
"msg": {
"mapping_field": "dlp_match_info",
"transformation": "String"
},
"inlineMsg": {
"mapping_field": "inline_dlp_match_info",
"transformation": "String"
},
"requestMethod": {
"mapping_field": "access_method",
"transformation": "String"
},
"act": {
"mapping_field": "activity",
"transformation": "String"
},
"reportedResourceID": {
"mapping_field": "instance",
"transformation": "String"
},
"request": {
"mapping_field": "url",
"transformation": "String"
},
"reason": {
"mapping_field": "object_type",
"transformation": "String"
},
"c6a3Label": {
"mapping_field": "owner",
"transformation": "String"
},
"sourceZoneURI": {
"mapping_field": "owner_pdl",
"transformation": "String"
},
"c6a1Label": {
"mapping_field": "file_lang",
"transformation": "String"
},
"reportedResourceName": {
"mapping_field": "true_obj_category",
"transformation": "String"
},
"reportedResourceType": {
"mapping_field": "true_obj_type",
"transformation": "String"
},
"customerKey": {
"mapping_field": "dlp_incident_id",
"transformation": "Integer"
},
"dvcpid": {
"mapping_field": "latest_incident_id",
"transformation": "Integer"
},
"rawEvent": {
"mapping_field": "dlp_parent_id",
"transformation": "Integer"
},
"suid": {
"mapping_field": "from_user",
"transformation": "String"
},
"fileHash": {
"mapping_field": "md5",
"transformation": "String"
},
"spid": {
"mapping_field": "connection_id",
"transformation": "Integer"
},
"dpid": {
"mapping_field": "app_session_id",
"transformation": "Integer"
},
"sourceDnsDomain": {
"mapping_field": "referer",
"transformation": "String"
},
"destinationZoneExternalID": {
"mapping_field": "dst_location",
"transformation": "String"
},
"sourceTranslatedZoneExternalID": {
"mapping_field": "src_location",
"transformation": "String"
},
"requestCookies": {
"mapping_field": "channel",
"transformation": "String"
},
"duid": {
"mapping_field": "to_user",
"transformation": "String"
},
"cfp1Label": {
"mapping_field": "cc",
"transformation": "String"
},
"cfp2Label": {
"mapping_field": "bcc",
"transformation": "String"
},
"cat": {
"mapping_field": "classification",
"transformation": "String"
},
"IncidentID": {
"mapping_field": "transaction_id",
"transformation": "String"
},
"requestClientApplication": {
"mapping_field": "app",
"transformation": "String"
},
"dlpFile": {
"mapping_field": "dlp_file",
"transformation": "String"
},
"timestamp": {
"mapping_field": "timestamp",
"transformation": "Integer"
},
"eventId": {
"mapping_field": "_id",
"transformation": "String"
},
"forensics_originalfile_url": {
"mapping_field": "forensics_originalfile_url",
"transformation": "String8000"
},
"forensics_subfile_url": {
"mapping_field": "forensics_subfile_url",
"transformation": "String8000"
},
"forensics_content": {
"mapping_field": "forensics_content",
"transformation": "String8000"
},
"forensics_metadata_content": {
"mapping_field": "forensics_metadata_content",
"transformation": "String8000"
},
"forensics_dlp_match_info": {
"mapping_field": "forensics_dlp_match_info",
"transformation": "String8000"
}
}
}
Permissions
- Access to the required permissions is available in the link provided in the v2 REST API scopes.
- For Device and Content alerts and Client Status events, you will require the following permissions:
- /api/v2/events/dataexport/alerts/device (Read)
- /api/v2/events/dataexport/alerts/content (Read)
- /api/v2/events/dataexport/iterator (Read+Write)
- For pulling forensics data for incident events, you will require the below permission:
- /api/v2/incidents/dlpincidents (Read)
API Details
List of APIs Used
Validation
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v1/app_instances | GET | To validate v1 token. |
| /api/v2/events/dataexport/events/alert | GET | To validate v2 token while configuring tenant. |
Alerts
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/events/dataexport/alerts/dlp | GET | Pull DLP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malware | GET | Pull Malware Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/remediation | GET | Pull Remediation Alerts from Netskope tenant |
| /api/v2/events/dataexport/alerts/securityassessment | GET | Pull Security Assessment Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/ctep | GET | Pull CTEP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malsite | GET | Pull Malsite Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/policy | GET | Pull Policy Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/quarantine | GET | Pull Quarantine Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/uba | GET | Pull UBA Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/watchlist | GET | Pull Watchlist Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/device | GET | Pull Device Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/content | GET | Pull Content Alerts from the Netskope tenant. |
Events
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/events/dataexport/events/page | GET | Pull Page Events from the Netskope tenant. |
| /api/v2/events/dataexport/events/application | GET | Pull Application Events from the Netskope tenant. |
| /api/v2/events/dataexport/events/audit | GET | Pull Audit Events from the Netskope tenant. |
| /api/v2/events/dataexport/events/infrastructure | GET | Pull Infrastructure Events from the Netskope tenant. |
| /api/v2/events/dataexport/events/network | GET | Pull Network Events from the Netskope tenant. |
| /api/v2/events/dataexport/events/incident | GET | Pull Incident Events from the Netskope tenant. |
| /api/v2/incidents/dlpincidents/{id}/forensics | GET | Pull Incident Forensics per dlp_incident_id. |
| /api/v2/events/dataexport/events/endpoint | GET | Pull Endpoint Events from the Netskope tenant. |
| api/v2/events/dataexport/iterator/netskope_ce_cs_iterator?eventtype=clientstatus | POST | Create a Client Status Iterator. |
| /api/v2/events/dataexport/iterator/<iterator_name> | GET | Check the Status of a Client Status Iterator. |
| /api/v2/events/dataexport/iterator/<iterator_name>/events?operation=next | GET | Fetch data from a Client Status Iterator. |
| api/v2/events/dataexport/iterator/<iterator_name> | DELETE | Delete a Client Status Iterator. |
Validate a v1 token
API Endpoint: https://<tenant-url>/api/v1/app_instances
Method: GET
Request Headers
| Key | Value |
|---|---|
| User-Agent | netskope-ce-6.1.0 |
Request Parameters
| Key | Value |
|---|---|
| op | list |
| limit | 1 |
Payload
{"token": <netskope_api_v1_token>}
Sample API Response
{
"status": "success",
"data": [
{
"app": "Oracle Aconex",
"instance_name": "46",
"instance_id": "46",
"type": "Custom",
"tags": [
"Unsanctioned"
],
"last_modified": "2025-02-24 09:59:54",
"custom": "0",
"app_id": "46"
}
]
}
Validate a v2 Token
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/alert
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "abc350cdb1e1958a03ccd13c",
"access_method": "Endpoint",
"acked": "false",
"action": "block",
"activity": "Insert",
"alert": "yes",
"alert_name": "TestBlock",
"alert_type": "Device",
"app": "",
"category": "",
"cci": 0,
"ccl": "unknown",
"count": 1,
"device_classification": "not configured",
"organization_unit": "",
"os": "macOS",
"other_categories": [],
"policy": "TestBlock",
"timestamp": 1719994603,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"to_object": "",
"account_id": "",
"CononicalName": "",
"malsite_country": "",
"src_geoip_src": 0,
"object": "",
"fromlogs": "",
"ext_labels": [],
"last_timestamp": 0,
"justification_type": "",
"tss_mode": "",
"user_id": "",
"password_type": "",
"suppression_key": "",
"connection_id": 0,
"sha256": "",
"site": "",
"src_longitude": 0.0,
"os_version": "",
"resp_cnt": 0,
"src_timezone": "",
"user_confidence_index": 0,
"browser_version": "",
"dst_region": "",
"last_app": "",
"dlp_rule_count": 0,
"sessionid": "",
"profile_id": "",
"threshold": 0,
"org": "",
"suppression_end_time": 0,
"nsdeviceuid": "",
"parent_id": "",
"compliance_standards": [],
"true_obj_category": "",
"severity": "",
"sa_profile_id": 0,
"malsite_longitude": 0.0,
"sa_rule_id": "",
"region_name": "",
"device": "",
"dlp_mail_parent_id": "",
"evt_src_chnl": "",
"malsite_latitude": 0.0,
"request_id": 0,
"sa_rule_severity": "",
"dst_latitude": 0.0,
"universal_connector": "",
"malsite_ip_host": "",
"referer": "",
"dst_geoip_src": 0,
"severity_level": "",
"conn_starttime": 0,
"dsthost": "",
"last_location": "",
"useragent": "",
"breach_description": "",
"shared_domains": "",
"asset_object_id": "",
"malicious": "",
"sa_rule_name": "",
"breach_target_references": "",
"justification_reason": "",
"conn_duration": 0,
"object_id": "",
"userPrincipalName": "",
"alert_id": "",
"exposure": "",
"mime_type": "",
"true_obj_type": "",
"user_generated": "",
"total_collaborator_count": 0,
"browser_session_id": 0,
"dst_timezone": "",
"appsuite": "",
"retro_scan_name": "",
"page_site": "",
"last_device": "",
"dlp_unique_count": 0,
"sAMAccountName": "",
"src_zipcode": "",
"file_size": 0,
"domain": "",
"title": "",
"conn_endtime": 0,
"dst_location": "",
"telemetry_app": "",
"netskope_pop": "",
"malsite_region": "",
"serial": "",
"web_universal_connector": "",
"modified": 0,
"iaas_remediated": "",
"internal_collaborator_count": 0,
"object_type": "",
"domain_ip": "",
"orig_ty": "",
"threshold_time": 0,
"src_location": "",
"dlp_profile": "",
"data_type": "",
"web_url": "",
"src_time": "",
"severity_level_id": 0,
"resource_category": "",
"browser": "",
"region_id": "",
"dlp_incident_id": 0,
"last_country": "",
"threat_match_value": "",
"netskope_activity": "",
"server_bytes": 0,
"dlp_file": "",
"two_factor_auth": "",
"breach_date": 0,
"url": "",
"policy_actions": [],
"req_cnt": 0,
"external_collaborator_count": 0,
"dst_country": "",
"log_file_name": "",
"scan_type": "",
"src_region": "",
"threat_source_id": 0,
"notify_template": "",
"malsite_category": [],
"numbytes": 0,
"dlp_is_unique_count": "",
"account_name": "",
"file_path": "",
"file_lang": "",
"suppression_start_time": 0,
"custom_attr": {},
"email_source": "",
"sanctioned_instance": "",
"owner": "",
"bypass_traffic": "",
"src_latitude": 0.0,
"page": "",
"dstip": "",
"hostname": "",
"dstport": 0,
"matched_username": "",
"src_country": "",
"file_cls_encrypted": false,
"md5": "",
"iaas_asset_tags": [],
"file_type": "",
"malsite_id": "",
"app_session_id": 0,
"protocol": "",
"userip": "",
"breach_media_references": "",
"instance": "",
"app_activity": "",
"client_bytes": 0,
"sa_profile_name": "",
"instance_id": "",
"http_transaction_count": 0,
"breach_id": "",
"transaction_id": 0,
"from_user": "",
"last_region": "",
"managementID": "",
"shared_with": "",
"resource_group": "",
"appcategory": "",
"event_type": "",
"asset_id": "",
"srcip": "",
"managed_app": "",
"dlp_parent_id": 0,
"breach_score": "",
"dst_zipcode": "",
"dlp_rule_severity": "",
"orignal_file_path": "",
"threat_match_field": "",
"dst_longitude": 0.0,
"external_email": 0,
"policy_id": "",
"dlp_rule": ""
}
Get Compromised Credential Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/compromisedcredential
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "20575270a59c8ef1d85d535c",
"acked": "false",
"alert": "yes",
"alert_name": "Secret share",
"alert_type": "Compromised Credential",
"app": "Friend2Friend",
"category": "Cloud Storage",
"cci": 29,
"ccl": "poor",
"count": 1,
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"timestamp": 1727659690,
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0495t@test.netskope.com",
"user": "dte1953ce410-0495t@test.netskope.com",
"userkey": "dte1953ce410-0495t@test.netskope.com",
"division": "",
"external_email": 0,
"mail": "",
"sAMAccountName": "",
"password_type": "",
"userPrincipalName": "",
"breach_date": 0,
"sAMAccountType": "",
"breach_id": "",
"breach_score": "",
"department": "",
"employeeType": "",
"matched_username": "",
"breach_media_references": "",
"email_source": "",
"breach_description": "",
"breach_target_references": "",
"distinguishedName": ""
}
Get DLP Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/dlp
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "31365da11ecc94a0d7edfb6f",
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"alert": "yes",
"alert_name": "GDrive Customer metadata shared externally",
"alert_type": "DLP",
"app": "Google Drive",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "high",
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 1,
"dst_latitude": 37.40599060058594,
"dst_location": "Mountain View",
"dst_longitude": -122.0785140991211,
"dst_region": "California",
"dstip": "172.217.14.78",
"exposure": "organisation_wide_link",
"ext_labels": [
{
"data_classification_label": "pym/uducbb2126/encryption_level_11",
"id": "6e05576c-782b-42b4-b8f7-71dfb9ffb5a0",
"instance": "uducbb2126",
"name": "encryption_level_11",
"vendor": "pym"
},
{
"data_classification_label": "ydu/ldmwyo2852/encryption_level_11",
"id": "20c2b17d-7612-4349-b1e1-62d0d6b48ccb",
"instance": "ldmwyo2852",
"name": "encryption_level_11",
"vendor": "ydu"
},
{
"data_classification_label": "uwa/eqpoco8593/encryption_level_9",
"id": "6f77b892-3888-4148-8168-d954856d2fea",
"instance": "eqpoco8593",
"name": "encryption_level_9",
"vendor": "uwa"
}
],
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "edd7df8bb5a774a7531a389287a3bd71cf8e62197d93a205860003ed8339a4de",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "Tenant Migration across MPs",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "unknown",
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Google Drive",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1716551379,
"title": "Tenant Migration across MPs",
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "rowkuxqaxdxnlnlw",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "RoWkuxQAxDxNlNLw",
"userkey": "RoWkuxQAxDxNlNLw",
"record_type": "alert",
"page_site": "",
"act_user": "",
"src_longitude": 0.0,
"dst_timezone": "",
"device_classification": "",
"to_user": "",
"dlp_file": "",
"connection_id": 0,
"external_collaborator_count": 0,
"incident_id": 0,
"dlp_fingerprint_classification": "",
"activity": "",
"from_storage": "",
"user_confidence_index": 0,
"browser_version": "",
"dynamic_classification": "",
"smtp_to": [],
"dlp_rule_severity": "",
"shared_with": "",
"outer_doc_type": 0,
"orignal_file_path": "",
"channel": "",
"data_type": "",
"userip": "",
"sanctioned_instance": "",
"src_region": "",
"true_filetype": "",
"dlp_rule_count": 0,
"shared_domains": "",
"owner_pdl": "",
"dlp_unique_count": 0,
"transaction_id": 0,
"browser_session_id": 0,
"userCountry": "",
"bcc": "",
"displayName": "",
"srcip": "",
"dlp_mail_parent_id": "",
"hostname": "",
"classification_name": "",
"protocol": "",
"sAMAccountName": "",
"violating_user": "",
"manager": "",
"src_time": "",
"src_country": "",
"true_obj_category": "",
"message_size": 0,
"dlp_fingerprint_score": 0,
"src_geoip_src": 0,
"os_version": "",
"true_type_id": 0,
"to_storage": "",
"tss_mode": "",
"managed_app": "",
"file_password_protected": "",
"dlp_incident_id": 0,
"managementID": "",
"dlp_fingerprint_match": "",
"src_timezone": "",
"mail": "",
"total_collaborator_count": 0,
"from_user": "",
"app_activity": "",
"user_id": "",
"custom_attr": {},
"group": "",
"file_cls_encrypted": false,
"universal_connector": "",
"message_id": "",
"file_category": "",
"dlp_parent_id": 0,
"sub_type": "",
"src_latitude": 0.0,
"userPrincipalName": "",
"dlp_is_unique_count": "",
"dlp_rule_score": 0,
"src_zipcode": "",
"dlp_rule": "",
"referer": "",
"app_session_id": 0,
"parent_id": "",
"retro_scan_name": "",
"src_location": "",
"dst_zipcode": "",
"dlp_profile": "",
"true_obj_type": "",
"violating_user_type": "",
"policy_id": "",
"web_universal_connector": "",
"appsuite": "",
"severity": "",
"sha256": "",
"collaborated": "",
"page": ""
}
Get Malware Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malware
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"TSS-scan": "TSS-Scan-V3",
"_id": "389551cd1bdaa1ae4947c334",
"access_method": "Client",
"acked": "false",
"action": "Detection",
"activity": "Browse",
"alert": "yes",
"alert_name": "GT:JS.Adware.Popunder.4.34B7F109",
"alert_type": "Malware",
"app": "hitomi",
"app_name": "hitomi",
"app_session_id": 4113602168491103340,
"appcategory": "Adult Content - Pornography",
"browser_session_id": 2610528494199657827,
"category": "Adult Content - Pornography",
"cci": "",
"ccl": "",
"connection_id": 5767115909713174088,
"count": 1,
"detection_engine": "Netskope AV",
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "UA",
"dst_latitude": 50.45465850830078,
"dst_location": "Kyiv",
"dst_longitude": 30.523799896240234,
"dst_region": "Kyiv",
"dst_timezone": "Europe/Kyiv",
"dst_zipcode": "N/A",
"dstip": "185.255.122.62",
"file_category": "Text",
"file_id": "1dda26cbf77944ccb931f3444b554c74",
"file_size": 2277,
"file_type": "text/html",
"hostname": "ub20-50-5-28",
"incident_id": 7718454634228557343,
"instance": "",
"local_md5": "cda70ab0130f915723a53a5d9270e7a5",
"malware_id": "3d81bec28fff68180bf8baa5727924ba",
"malware_name": "GT:JS.Adware.Popunder.4.34B7F109",
"malware_profile": "1",
"malware_severity": "high",
"malware_type": "Virus",
"managed_app": "no",
"md5": "cda70ab0130f915723a53a5d9270e7a5",
"ml_detection": "None",
"object_type": "File",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 20.04",
"page": "hitomi.la/",
"page_site": "Web Background",
"policy": "Threat-Malware-Policy-Crest-SRE-Test",
"policy_id": "342F7551F4D4469E47D7736209486319 2024-07-01 16:28:12.174470",
"protocol": "HTTPS/1.1",
"request_id": 2907585389470724608,
"scanner_result": "malicious",
"severity": "High",
"severity_id": 3,
"sha256": "d330ea88b7a0c2f9190717d8f39a2e3942474c3fefe8b68112e7b93fde0fa9d4",
"site": "hitomi",
"src_country": "IN",
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_time": "Wed Aug 14 13:48:00 2024",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "382350",
"srcip": "110.226.17.67",
"timestamp": 1723623535,
"traffic_type": "Web",
"transaction_id": 7718454634228557343,
"true_filetype": "HTML",
"tss_mode": "inline",
"type": "nspolicy",
"ur_normalized": "nipun.brahmbhatt@crestdata.ai",
"url": "hitomi.la/",
"user": "nipun.brahmbhatt@crestdata.ai",
"user_id": "nipun.brahmbhatt@crestdata.ai",
"userip": "10.50.5.28",
"record_type": "alert",
"department": "",
"scan_time": 0,
"tss_scan_failed": "",
"usr_udf_supervisorname": "",
"instance_id": "",
"nsdeviceuid": "",
"modified_date": 0,
"dst_geoip_src": 0,
"local_sha256": "",
"sha1": "",
"usr_udf_primarydomain": "",
"fastscan_results": "",
"sanctioned_instance": "",
"company": "",
"user_confidence_index": 0,
"src_geoip_src": 0,
"usr_udf_businesssegmentlevel1": "",
"referer": "",
"parent_id": "",
"created_date": 0,
"usr_udf_businesssegmentlevel2": "",
"filename": "",
"from_user": "",
"file_path": "",
"manager": "",
"browser": "",
"detection_type": "",
"title": "",
"object_id": "",
"mime_type": "",
"usr_display_name": "",
"usr_udf_businesssegmentlevel4": "",
"userPrincipalName": "",
"appsuite": "",
"scan_type": "",
"tss_license": "",
"managementID": "",
"usr_status": "",
"object": "",
"custom_attr": {},
"userCountry": "",
"usr_title": "",
"usr_udf_businesssegmentlevel3": "",
"file_name": "",
"shared_type": "",
"usr_udf_companyname": "",
"shared_with": "",
"tss_fail_reason": "",
"usr_udf_supervisorid": "",
"browser_version": "",
"usr_udf_employeeid": ""
}
Get Remediation Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/remediation
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "448ca50ee6142a954d64c577",
"access_method": "API Connector",
"acked": "true",
"action": "alert",
"activity": "Download",
"alert": "yes",
"alert_name": "Remediation alert",
"alert_type": "Remediation",
"app": "Clanwilliam Health",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 9,
"ccl": "poor",
"count": 1,
"device": "Other",
"dst_country": "NL",
"dst_geoip_src": 2,
"dst_latitude": 52.3759,
"dst_location": "Amsterdam",
"dst_longitude": 4.8975,
"dst_region": "North Holland",
"dst_zipcode": "1012",
"dstip": "31.186.239.8",
"file_size": 118585,
"file_type": "application/vnd.google-apps.document",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"object": "VTRapjqhGbaDXqHR",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 7.0",
"policy": "policy_ga34",
"request_id": "2459149802892628500",
"site": "Clanwilliam Health",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.8",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0268t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0268t@test.netskope.com",
"managementID": "",
"from_user": "",
"os_version": "",
"app_session_id": 0,
"malware_severity": "",
"actions_taken": "",
"transaction_id": 0,
"notify_template": "",
"page": "",
"browser_session_id": 0,
"src_time": "",
"tss_mode": "",
"managed_app": "",
"severity": "",
"nsdeviceuid": "",
"remediation_profile": "",
"dlp_profile": "",
"malware_name": "",
"endpoints": "",
"connection_id": 0,
"policy_id": "",
"endpoint_count": 0,
"dst_timezone": "",
"profile_hits": [],
"malware_id": "",
"hostname": "",
"edr_app": "",
"device_classification": "",
"userip": "",
"appsuite": "",
"protocol": "",
"incident_id": 0,
"src_timezone": "",
"sanctioned_instance": "",
"page_site": "",
"malware_type": "",
"all_policy_matches": []
}
Get Security Assessment Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/securityassessment
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "15bbca35f014e9618efdc629",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"activity": "Introspection Scan",
"alert": "yes",
"alert_name": "security-accessment-alert",
"alert_type": "Security Assessment",
"app": "LinkedIn",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "medium",
"count": 1,
"device": "Other",
"dst_country": "FR",
"dst_geoip_src": 1,
"dst_latitude": 48.883411,
"dst_location": "Puteaux",
"dst_longitude": 2.23894,
"dst_region": "Ile-de-France",
"dstip": "193.248.155.211",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "OlWmGNTVpEVLCgWo",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"sa_profile_id": 1,
"sa_profile_name": "CRzpqYgDBoKRThmb",
"sa_rule_id": "icveiWoIMGqmEfUy",
"sa_rule_name": "RLYnpTzcFeiRcQYr",
"sa_rule_severity": "High",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "LinkedIn",
"src_country": "FR",
"src_geoip_src": 1,
"src_latitude": 48.883411,
"src_location": "Puteaux",
"src_longitude": 2.23894,
"src_region": "Ile-de-France",
"srcip": "193.248.155.211",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Get CTEP Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/ctep
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_correlation_id": "d54406dc-5457-4699-8754-c8eece88a804",
"_event_id": "8de38a44-4ae5-44ac-a097-f9e3ce2aac2a",
"_forwarded_by": "na",
"_generator_id": "ad4c77a8-ac83-4493-936c-8d6394038556",
"_id": "d62273697847e13a884e7562",
"_insertion_epoch_timestamp": 1727659690,
"_raw_event_inserted_at": 1676185709059,
"_seq_id": 117219,
"_service_identifier": "na",
"_skip_geoip_lookup": "yes",
"access_method": "API Connector",
"acked": "false",
"action": "block",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "c2",
"alert_type": "c2",
"app": "X3host",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 16,
"ccl": "poor",
"count": 1,
"device": "11-inch iPad Pro",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 45.8234,
"dst_location": "Boardman",
"dst_longitude": -119.7257,
"dst_region": "Oregon",
"dst_zipcode": "97818",
"dstip": "52.218.153.131",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 118783,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"legal_hold_profile_name": "oejTJocnOabNirPx",
"lh_custodian_email": "ELGkdoczLAkrQMuq",
"lh_custodian_name": "iRwQlRYvjwsFlVpg",
"lh_dest_app": "dOkImPvoHqwfXFaU",
"lh_dest_instance": "LKMHXgSCmGTmVbZL",
"lh_fileid": "taAjyAQRSWraghfP",
"lh_filename": "rsjjtAjqpCcYjaOU",
"lh_filepath": "IhYDbjTXhzqtUZeD",
"lh_original_filename": "vWijvCFegHYDULbn",
"lh_shared": "WCLXYCUEBjqOlWHt",
"lh_shared_with": "SwUYQdzFHslSQoxr",
"lh_version": 1,
"local_sha256": "fd856057ed7703e9b53458c7dbb6a3dc4ce9b957f3b307d81f06bf09c9bd8de3",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "OLizsiNCpTCziLEC",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "iOS 9.6",
"other_categories": [],
"owner": "dte1953ce410-0778t@test.netskope.com",
"policy": "policy_ga13",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "X3host technologies",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.204",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0494t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0494t@test.netskope.com",
"userkey": "dte1953ce410-0494t@test.netskope.com"
}
Get Malsite Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malsite
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "01f6ca78bec577883076a738",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "bget.ru",
"alert_type": "malsite",
"app": "",
"app_session_id": 4910069257574835437,
"appcategory": "Security Risk - Compromised/malicious sites",
"browser_session_id": 1141245448937753175,
"category": "Security Risk - Compromised/malicious sites",
"cci": 0,
"ccl": "unknown",
"connection_id": 0,
"count": 1,
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "RU",
"dst_latitude": 59.9417,
"dst_location": "St Petersburg",
"dst_longitude": 30.3096,
"dst_region": "St.-Petersburg",
"dst_timezone": "Europe/Moscow",
"dst_zipcode": "195213",
"dstip": "5.101.158.143",
"dstport": 443,
"hostname": "ip-172-31-37-148",
"incident_id": 7989528656047608655,
"ja3": "07ff1e545ef8ab3fcf8a4dc9272221c2",
"ja3s": "NotAvailable",
"malicious": "yes",
"malsite_category": [
"Malicious Site"
],
"malsite_country": "RU",
"malsite_id": "ae7c3ade12353ae7165e9b2f",
"malsite_ip_host": "5.101.158.143",
"malsite_latitude": 59.9417,
"malsite_longitude": 30.3096,
"malsite_region": "St.-Petersburg",
"managed_app": "no",
"notify_template": "block_page.html",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 22.04",
"other_categories": [
"Security Risk",
"Security Risk - Compromised/malicious sites"
],
"page": "bget.ru/",
"page_site": "bget",
"policy": "TestMalsite2",
"policy_id": "F1AE7109B6FC54098C582D3B0F149521 2024-05-28 13:48:56.784091",
"protocol": "HTTPS/1.1",
"request_id": 2851228580036571136,
"severity_level": "med",
"severity_level_id": 1,
"site": "bget",
"src_country": "US",
"src_latitude": 39.0469,
"src_location": "Ashburn",
"src_longitude": -77.4903,
"src_region": "Virginia",
"src_time": "Tue May 28 10:07:00 2024",
"src_timezone": "America/New_York",
"src_zipcode": "20149",
"srcip": "18.209.94.135",
"telemetry_app": "",
"threat_match_field": "domain",
"threat_match_value": "bget.ru",
"threat_source_id": 1,
"timestamp": 1716905279,
"traffic_type": "Web",
"transaction_id": 7989528656047608655,
"type": "malsite",
"ur_normalized": "keshavhazard@gmail.com",
"url": "bget.ru/",
"user": "keshavhazard@gmail.com",
"useragent": "python-requests/2.25.1",
"userip": "172.31.37.148",
"record_type": "alert",
"malsite_reputation": "",
"object": "",
"org": "",
"fromlogs": "",
"log_file_name": "",
"req_cnt": 0,
"browser_version": "",
"numbytes": 0,
"department": "",
"division": "",
"retro_scan_name": "",
"sfwder": "",
"browser": "",
"custom_attr": {},
"malsite_confidence": 0,
"server_bytes": 0,
"client_bytes": 0,
"malsite_first_seen": 0,
"co": "",
"sAMAccountName": "",
"src_geoip_src": 0,
"gateway": "",
"referer": "",
"suppression_start_time": 0,
"resp_cnt": 0,
"conn_duration": 0,
"serial": "",
"malsite_hostility": "",
"dsthost": "",
"dst_geoip_src": 0,
"universal_connector": "",
"malsite_active": "",
"from_user": "",
"object_type": "",
"suppression_end_time": 0,
"malsite_last_seen": 0,
"severity": "",
"aggregated_user": "",
"malsite_consecutive": "",
"appsuite": ""
}
Get Policy Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/policy
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3ceffe626afca6f5d46befb6",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "testprivateapp with2nd opt",
"alert_type": "policy",
"app": "[ExtraHop-Demo]",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"client_bytes": 0,
"client_packets": 0,
"count": 1,
"device": "Windows",
"dsthost": "netskope.atlassian.net",
"dstip": "",
"dstport": 443,
"end_time": "2025-02-28T08:22:47+00:00",
"hostname": "WIN11-50-12-151",
"ip_protocol": "TCP",
"network_session_id": "9452921695540616650",
"num_sessions": 1,
"numbytes": 0,
"organization_unit": "",
"os": "Windows",
"os_version": "11.0.22621",
"other_categories": [],
"policy": "testprivateapp with2nd opt",
"protocol": "Http",
"protocol_port": "TCP:443",
"publisher_cn": "",
"publisher_name": "",
"server_bytes": 0,
"server_packets": 0,
"session_duration": 0,
"site": "netskope.atlassian.net",
"srcip": "",
"srcport": 30700,
"start_time": "2025-02-28T08:22:32+00:00",
"timestamp": 1740731072,
"total_packets": 0,
"traffic_type": "PrivateApp",
"tunnel_id": "53125",
"tunnel_type": "NPA",
"tunnel_up_time": 0,
"type": "network",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userip": "",
"record_type": "alert",
"suppression_key": "",
"app_activity": "",
"file_type": "",
"url": "",
"policy_id": "",
"custom_connector": "",
"quarantine_profile": "",
"q_original_shared": "",
"file_path": "",
"profile_emails": [],
"referer": "",
"md5": "",
"redirect_url": "",
"page_site": "",
"malware_name": "",
"suppression_end_time": 0,
"user_id": "",
"distinguishedName": "",
"severity": "",
"src_timezone": "",
"tss_mode": "",
"managed_app": "",
"tss_fail_reason": "",
"src_geoip_src": 0,
"owner": "",
"aggregated_user": "",
"group": "",
"total_collaborator_count": 0,
"userCountry": "",
"browser": "",
"to_user": "",
"from_object": "",
"ext_labels": [],
"shared_with": "",
"useragent": "",
"sessionid": "",
"network": "",
"malicious": "",
"quarantine_file_id": "",
"appsuite": "",
"remediation_profile": "",
"universal_connector": "",
"mime_type": "",
"browser_version": "",
"src_zipcode": "",
"access_key_id": "",
"src_latitude": 0.0,
"malware_type": "",
"dynamic_classification": "",
"src_region": "",
"q_original_version": "",
"instance_id": "",
"message_id": "",
"sfwder": "",
"q_admin": "",
"q_app": "",
"object_type": "",
"log_file_name": "",
"malware_severity": "",
"retro_scan_name": "",
"displayName": "",
"justification_reason": "",
"q_instance": "",
"src_location": "",
"gateway": "",
"forward_to_proxy_xau": "",
"justification_type": "",
"smtp_to": [],
"app_session_id": 0,
"request_id": 0,
"app_scopes": "",
"parent_id": "",
"file_category": "",
"file_id": "",
"dlp_profile": "",
"nsdeviceuid": "",
"risk_level": "",
"encrypt_failure": "",
"quarantine_file_name": "",
"src_longitude": 0.0,
"file_size": 0,
"org": "",
"user_tmp": "",
"activity_status": "",
"threat_match_value": "",
"malsite_category": [],
"dst_timezone": "",
"all_policy_matches": [],
"incident_id": 0,
"orignal_file_path": "",
"object_id": "",
"act_user": "",
"http_status": "",
"dst_country": "",
"from_user": "",
"req_cnt": 0,
"transaction_id": 0,
"browser_session_id": 0,
"sanctioned_instance": "",
"from_storage": "",
"tss-mode": "",
"cc": "",
"activity": "",
"sAMAccountName": "",
"scan_type": "",
"serial": "",
"src_time": "",
"managementID": "",
"object": "",
"q_original_filepath": "",
"custom_attr": {},
"shared_domains": "",
"q_original_filename": "",
"notify_template": "",
"connection_id": 0,
"telemetry_app": "",
"threat_source_id": 0,
"user_confidence_index": 0,
"TSS-scan": "",
"internal_collaborator_count": 0,
"last_name": "",
"mail": "",
"sAMAccountType": "",
"memberOf": "",
"smtp_status": "",
"Title": "",
"dst_location": "",
"bcc": "",
"dst_geoip_src": 0,
"exposure": "",
"activity_type": "",
"dlp_fail_reason": "",
"dst_zipcode": "",
"message_size": 0,
"suppression_start_time": 0,
"trust_computer_checked": "",
"device_classification": "",
"instance": "",
"to_storage": "",
"dst_latitude": 0.0,
"division": "",
"object_count": 0,
"to_object": "",
"modified": 0,
"sender": "",
"dst_region": "",
"page": "",
"conn_duration": 0,
"two_factor_auth": "",
"dst_longitude": 0.0,
"data_type": "",
"quarantine_profile_id": "",
"malware_id": "",
"manager": "",
"src_country": "",
"event_type": "",
"external_collaborator_count": 0,
"resp_cnt": 0,
"threat_match_field": "",
"tss_scan_failed": "",
"dlp_scan_failed": "",
"sha256": ""
}
Get Quarantine Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/quarantine
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "63d6a681f0d64a6f41cc084c",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "quarantine-sahil",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "quarantine-alert",
"alert_type": "quarantine",
"app": "Dropbox",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 81,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 33.1432,
"dst_location": "San Marcos",
"dst_longitude": -117.1666,
"dst_region": "California",
"dst_zipcode": "92069",
"dstip": "98.176.143.16",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "weclTNVzKoULFCYX",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"q_admin": "KgBNclCNvMfSfwAe",
"q_app": "Box",
"q_instance": "IXlwfxAfRQMyUbso",
"q_original_filename": "huSgEkeGhFjPDLhS",
"q_original_filepath": "oJmMLhuvhIyXlarC",
"q_original_shared": "private",
"q_original_version": "1",
"q_shared_with": "PqtCjqtPLVOOFkWk",
"quarantine_action_reason": "TuJbfomareEgmNNT",
"quarantine_app": "Amazon S3",
"quarantine_failure": "mDsCCrKldEQdhrEF",
"quarantine_file_id": "jeCCFYBKuaBggvol",
"quarantine_file_name": "GEXNzZEGpZFQAuUv",
"quarantine_profile": "fQECcfyXhgGUOJSO",
"quarantine_profile_id": "xfFlQTBQWxjnIsXZ",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "Dropbox",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Get UBA Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/uba
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "b7dce8f570123bdd868a8315",
"access_method": "UCI Impact API",
"acked": "false",
"action": "anomaly_detection",
"activity": "ActivityForUciImpactAPI",
"alert": "yes",
"alert_id": "505464b05529c82e34d31970",
"alert_name": "External alert from Netskope due to Risky User",
"alert_type": "uba",
"anomaly_type": "Fact",
"app": "",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"count": 1,
"createdTime": "2025-02-24 08:15:55.461000",
"device": "Other",
"event_type": "uba_analytics",
"instance_id": "",
"organization_unit": "",
"policy": "External alert received via REST API",
"score": 1,
"severity": "informational",
"src_country": "IN",
"src_geoip_src": 2,
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_zipcode": "380009",
"srcip": "122.170.162.148",
"timestamp": 1740384954,
"type": "nspolicy",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userkey": "tanushree.kurup@crestdata.ai",
"windowId": 1740355200000,
"record_type": "alert",
"last_device": "",
"surhn": "",
"policy_id": "",
"uba_ap1": "",
"evt_src_chnl": "",
"all_policy_matches": [],
"threshold": 0,
"web_universal_connector": "",
"user_category": "",
"managementID": "",
"division": "",
"download_app": "",
"user_id": "",
"dst_longitude": 0.0,
"audit_type": "",
"object_count": 0,
"policy_name": "",
"activity_status": "",
"group": "",
"act_user": "",
"referer": "",
"connection_id": 0,
"app_category": "",
"bin_timestamp": 0,
"hostname": "",
"app_activity": "",
"md5": "",
"risk_level_id": 0,
"suppression_end_time": 0,
"protocol": "",
"request_type": "",
"request_id": 0,
"app_session_id": 0,
"User_SPACE_Id": "",
"user_name": "",
"last_timestamp": 0,
"netskope_activity": "",
"dst_geoip_src": 0,
"tss_scan_failed": "",
"loginurl": "",
"threshold_time": 0,
"risk_level": "",
"managed_app": "",
"browser_version": "",
"file_category": "",
"from_user_category": "",
"page": "",
"last_location": "",
"url": "",
"uba_ap2": "",
"sanctioned_instance": "",
"object_id": "",
"dst_timezone": "",
"custom_attr": {},
"to_object": "",
"dst_country": "",
"traffic_type": "",
"telemetry_app": "",
"page_site": "",
"file_size": 0,
"scopes": [],
"anomalyData": {},
"os": "",
"audit_category": "",
"tss_fail_reason": "",
"userip": "",
"last_app": "",
"incident_id": 0,
"suppression_start_time": 0,
"dst_zipcode": "",
"dstip": "",
"policy_actions": [],
"browser": "",
"src_time": "",
"sAMAccountName": "",
"two_factor_auth": "",
"uba_inst2": "",
"site": "",
"displayName": "",
"sha256": "",
"object": "",
"last_country": "",
"to_user": "",
"object_type": "",
"manager": "",
"last_region": "",
"dst_region": "",
"dst_latitude": 0.0,
"shared_credential_user": "",
"file_type": "",
"tss_mode": "",
"appsuite": "",
"device_classification": "",
"logintype": "",
"AccountType": "",
"os_version": "",
"parent_id": "",
"TSS-scan": "",
"user_role": "",
"dst_location": "",
"to_user_category": "",
"user_confidence_index": 0,
"mail": "",
"browser_session_id": 0,
"src_timezone": "",
"useragent": "",
"employeeType": "",
"from_user": "",
"uba_inst1": "",
"User_SPACE_Name": "",
"userPrincipalName": "",
"transaction_id": 0,
"distinguishedName": "",
"profile_id": ""
}
Get Watchlist Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/watchlist
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "ad921f96aaf7dc5b6fe5d628",
"access_method": "API Connector",
"acked": "true",
"activity": "Upload",
"alert": "yes",
"alert_name": "watchlist fired",
"alert_type": "watchlist",
"app": "Amazon App Suite",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 89,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "IN",
"dst_geoip_src": 2,
"dst_latitude": 19.0748,
"dst_location": "Mumbai",
"dst_longitude": 72.8856,
"dst_region": "Maharashtra",
"dst_zipcode": "400072",
"dstip": "182.75.130.70",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 119268,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "aa477dd147d603cd0bd65b6dfb09021654e212aa3200ceb03e3a1e1d0fb37fdb",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "uVwtiXcnOjCdpJHt",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 8.0",
"owner": "dte1953ce410-0545t@test.netskope.com",
"policy": "policy_ga26",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Amazon App Suite",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0191t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0191t@test.netskope.com",
"userkey": "dte1953ce410-0191t@test.netskope.com",
"dst_timezone": "",
"two_factor_auth": "",
"dlp_fail_reason": "",
"title": "",
"conn_duration": 0,
"shared_domains": "",
"user_id": "",
"notify_template": "",
"severity_id": 0,
"TSS-scan": "",
"universal_connector": "",
"to_user_category": "",
"web_url": "",
"severity": "",
"netskope_activity": "",
"malware_severity": "",
"dlp_is_unique_count": "",
"sAMAccountName": "",
"hostname": "",
"sanctioned_instance": "",
"object_count": 0,
"dlp_rule": "",
"protocol": "",
"file_id": "",
"audit_type": "",
"internal_collaborator_count": 0,
"dlp_scan_failed": "",
"appsuite": "",
"dlp_rule_severity": "",
"telemetry_app": "",
"to_user": "",
"true_obj_category": "",
"useragent": "",
"shared_with": "",
"justification_reason": "",
"dlp_parent_id": 0,
"referer": "",
"src_timezone": "",
"connection_id": 0,
"app_session_id": 0,
"from_user_category": "",
"client_bytes": 0,
"malware_name": "",
"total_collaborator_count": 0,
"policy_id": "",
"workspace": "",
"data_type": "",
"dlp_profile": "",
"act_user": "",
"malware_profile": "",
"file_name": "",
"fromlogs": "",
"ml_detection": "",
"app_activity": "",
"malware_id": "",
"dstport": 0,
"transaction_id": 0,
"detection_engine": "",
"to_storage": "",
"parent_id": "",
"managed_app": "",
"external_collaborator_count": 0,
"nsdeviceuid": "",
"tss_fail_reason": "",
"managementID": "",
"workspace_id": "",
"true_obj_type": "",
"justification_type": "",
"aggregated_user": "",
"network": "",
"org": "",
"page_site": "",
"userPrincipalName": "",
"tss_mode": "",
"suppression_end_time": 0,
"true_type_id": 0,
"server_bytes": 0,
"manager": "",
"suppression_start_time": 0,
"file_category": "",
"app_name": "",
"audit_category": "",
"incident_id": 0,
"serial": "",
"resp_cnt": 0,
"browser_version": "",
"all_policy_matches": [],
"enterprise": "",
"numbytes": 0,
"device_classification": "",
"from_object": "",
"dlp_rule_count": 0,
"dsthost": "",
"src_time": "",
"user_category": "",
"browser_session_id": 0,
"sfwder": "",
"scanner_result": "",
"dlp_file": "",
"os_version": "",
"to_object": "",
"malware_type": "",
"log_file_name": "",
"web_universal_connector": "",
"enterprise_id": "",
"dlp_incident_id": 0,
"from_user": "",
"userip": "",
"page": "",
"req_cnt": 0,
"from_storage": "",
"tss_scan_failed": "",
"local_md5": ""
}
Get Device Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/device
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "983681ec8804b23e77c2c292",
"access_method": "Endpoint",
"action": "block",
"activity": "Insert",
"alert": "yes",
"alert_name": "TestBlock",
"alert_type": "Device",
"computer_name": "N49J4M9T3C",
"count": 1,
"device_classification": "not configured",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"policy": "TestBlock",
"policy_action": "block",
"policy_name_enforced": "TestBlock",
"timestamp": 1720005433,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_id": "USB\\VID_03f0&PID_1985&REV_0110",
"usb_device_name": "USB Flash Drive",
"usb_device_sn": "070D2C206FCFA597",
"usb_device_type": "usb mass storage",
"usb_product_id": "6533",
"usb_vendor_id": "HP",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"connection_type": "",
"driver": "",
"os_user_name": "",
"usb_is_encrypted": false,
"location": "",
"custom_attr": {}
}
Get Content Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/content
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3f14cdb17c8385f9a6acfab4",
"access_method": "Endpoint",
"action": "block",
"activity": "Create",
"alert": "yes",
"alert_name": "mmm1",
"alert_type": "Content",
"app": "DesktopServicesHelper",
"computer_name": "N49J4M9T3C",
"count": 1,
"destination_file_directory": "/Volumes/KALI LINUX",
"destination_file_name": "urls.txt",
"destination_file_path": "/Volumes/KALI LINUX/urls.txt",
"device_classification": "not configured",
"dlp_incident_id": 8329186087212438192,
"dlp_profile": "DLPTest",
"file_size": 52483,
"file_type": "Plain Text file",
"incident_id": 8329186087212438192,
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"os_user_name": "kmaheshwari",
"pid": "0",
"policy": "mmm1",
"policy_action": "block",
"policy_name_enforced": "mmm1",
"process_name": "DesktopServicesHelper",
"process_path": "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources",
"sha256": "23a129d56da1579a68862808a22b7b3e1d64682cc7d4c725fdc8a8c7980310b6",
"site": "DesktopServicesHelper",
"timestamp": 1719993896,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_type": "usb mass storage",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"custom_attr": {},
"process_cert_subject": "",
"device": ""
}
Get Page Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/page
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "56758f371f4e65c4049d423e",
"access_method": "Client",
"app": "Microsoft Accounts",
"appcategory": "Application Suite",
"bypass_reason": "SSL Do Not Decrypt Bypass Policy Matched",
"bypass_traffic": "yes",
"category": "Application Suite",
"cci": 84,
"ccl": "high",
"connection_id": 0,
"count": 1,
"domain": "ecs.office.com",
"dst_country": "US",
"dst_latitude": 47.6722,
"dst_location": "Redmond",
"dst_longitude": -122.1257,
"dst_region": "Washington",
"dst_timezone": "America/Los_Angeles",
"dst_zipcode": "98073",
"dstip": "52.123.128.14",
"dstport": 443,
"netskope_pop": "IN-BOM2",
"organization_unit": "",
"os_version": "Windows NT 11.0",
"other_categories": [
"Technology",
"Application Suite"
],
"page": "ecs.office.com",
"policy": "Default Microsoft appsuite SSL do not decrypt rule",
"request_id": 3051109095898995457,
"site": "Microsoft Office 365 Suite",
"src_country": "IN",
"src_latitude": 21.7003,
"src_location": "Bharūch",
"src_longitude": 72.9782,
"src_region": "Gujarat",
"src_time": "Fri Feb 28 14:26:08 2025",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "392012",
"srcip": "103.108.207.58",
"ssl_decrypt_policy": "yes",
"timestamp": 1740732961,
"traffic_type": "CloudApp",
"transaction_id": 0,
"type": "connection",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"url": "ecs.office.com",
"user": "tanushree.kurup@crestdata.ai",
"user_generated": "yes",
"userip": "10.50.12.151",
"userkey": "tanushree.kurup@crestdata.ai",
"record_type": "page",
"useragent": "",
"CononicalName": "",
"forward_to_proxy_profile": "",
"http_transaction_count": 0,
"resp_content_type": "",
"org": "",
"browser_version": "",
"conn_starttime": 0,
"os": "",
"network": "",
"device": "",
"req_cnt": 0,
"src_geoip_src": 0,
"conn_endtime": 0,
"dst_geoip_src": 0,
"hostname": "",
"client_bytes": 0,
"dsthost": "",
"userPrincipalName": "",
"numbytes": 0,
"fromlogs": "",
"rbi_template_name": "",
"resp_cnt": 0,
"browser_session_id": 0,
"resp_content_len": 0,
"server_bytes": 0,
"forward_to_proxy_xau": "",
"conn_duration": 0,
"serial": "",
"sAMAccountName": "",
"log_file_name": "",
"rbi_template_id": "",
"dynamic_classification": "",
"browser": "",
"severity": "",
"suppression_end_time": 0,
"custom_attr": {},
"action": "",
"suppression_start_time": 0,
"sessionid": "",
"protocol": "",
"app_session_id": 0
}
Get Application Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/application
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "5af424a2871523b6e13f853f",
"access_method": "Client",
"activity": "Download",
"alert": "no",
"app": "ContentSquare",
"app_session_id": 8320876311700568950,
"appcategory": "Web Analytics",
"browser": "Edge",
"browser_session_id": 5471226135867547944,
"browser_version": "133.0.0.0",
"category": "Web Analytics",
"cci": 60,
"ccl": "medium",
"connection_id": 0,
"count": 1,
"device": "Windows Device",
"device_classification": "not configured",
"dst_country": "IE",
"dst_latitude": 53.3382,
"dst_location": "Dublin",
"dst_longitude": -6.2591,
"dst_region": "Leinster",
"dst_timezone": "Europe/Dublin",
"dst_zipcode": "D02",
"dstip": "52.48.68.180",
"dstport": 443,
"hostname": "WIN11-50-12-151",
"ja3": "261219d3f4c7b45e9e6014a0084dc181",
"ja3s": "f4febc55ea12b31ae17cfb7e614afda8",
"managed_app": "no",
"netskope_pop": "IN-BOM2",
"object": "pageview",
"object_type": "File",
"organization_unit": "",
"os": "Windows 11",
"os_version": "Windows NT 11.0",
"other_categories": [
"Content Server",
"Web Analytics"
],
"page": "c.contentsquare.net/pageview",
"page_site": "contentsquare",
"policy_id": "8467252215149297331 2025-02-19 10:04:24.766887",
"protocol": "HTTPS/1.1",
"request_id": 3045298505167235584,
"severity": "unknown",
"site": "ContentSquare",
"src_country": "IN",
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_time": "Thu Feb 20 14:00:08 2025",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "380006",
"srcip": "182.69.215.65",
"telemetry_app": "",
"timestamp": 1740040217,
"traffic_type": "CloudApp",
"transaction_id": 1737423402988911503,
"type": "nspolicy",
"universal_connector": "yes",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"url": "c.contentsquare.net/pageview",
"user": "tanushree.kurup@crestdata.ai",
"useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0",
"userip": "10.50.12.151",
"userkey": "tanushree.kurup@crestdata.ai",
"record_type": "application",
"suppression_key": "",
"app_activity": "",
"file_type": "",
"dlp_incident_id": 0,
"custom_connector": "",
"file_path": "",
"referer": "",
"md5": "",
"suppression_end_time": 0,
"user_id": "",
"tss_mode": "",
"channel_id": "",
"dlp_rule_count": 0,
"web_universal_connector": "",
"tss_fail_reason": "",
"src_geoip_src": 0,
"owner": "",
"alert_type": "",
"total_collaborator_count": 0,
"to_user": "",
"ext_labels": [],
"shared_with": "",
"sessionid": "",
"client_bytes": 0,
"appsuite": "",
"mime_type": "",
"dlp_rule_severity": "",
"workspace_id": "",
"instance_id": "",
"logintype": "",
"policy": "",
"log_file_name": "",
"retro_scan_name": "",
"justification_reason": "",
"user_category": "",
"netskope_activity": "",
"justification_type": "",
"smtp_to": [],
"parent_id": "",
"nsdeviceuid": "",
"dlp_profile": "",
"file_lang": "",
"file_size": 0,
"userPrincipalName": "",
"org": "",
"audit_type": "",
"title": "",
"orignal_file_path": "",
"object_id": "",
"dsthost": "",
"from_user": "",
"req_cnt": 0,
"sanctioned_instance": "",
"dlp_rule": "",
"loginurl": "",
"scan_type": "",
"sAMAccountName": "",
"serial": "",
"managementID": "",
"custom_attr": {},
"from_user_category": "",
"notify_template": "",
"dlp_parent_id": 0,
"user_confidence_index": 0,
"internal_collaborator_count": 0,
"dlp_unique_count": 0,
"dlp_mail_parent_id": "",
"true_obj_category": "",
"dst_geoip_src": 0,
"exposure": "",
"dlp_is_unique_count": "",
"numbytes": 0,
"dlp_fail_reason": "",
"suppression_start_time": 0,
"audit_category": "",
"true_obj_type": "",
"data_center": "",
"instance": "",
"server_bytes": 0,
"modified": 0,
"action": "",
"conn_duration": 0,
"data_type": "",
"fromlogs": "",
"resp_cnt": 0,
"workspace": "",
"dlp_file": "",
"CononicalName": "",
"tss_scan_failed": "",
"dlp_scan_failed": "",
"sha256": ""
}
Get Audit Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/audit
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"audit_log_event": "Rest API V2 Call",
"severity_level": 2,
"supporting_data": {
"data_type": "policy",
"data_values": [
"200",
"POST",
"/api/v2/policy/urllist/deploy",
"trid=22f0b0dfb2b8d75d27aa528ff6040e5d.1740723551"
]
},
"timestamp": 1740723551,
"type": "admin_audit_logs",
"user": "DO-NOT-DELETE",
"organization_unit": "",
"ur_normalized": "do-not-delete",
"count": 1,
"_id": "074fdfdb6974f8960bfaede9",
"record_type": "audit",
"sAMAccountName": "",
"details": [],
"ccl": "",
"userPrincipalName": ""
}
Get Infrastructure Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/infrastructure
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"timestamp": 1727659690,
"severity": "high",
"alarm_name": "No_events_from_device",
"device_name": "panw-dpop-1",
"metric_value": 43831789,
"alarm_description": "Events from 仕事 device not received in the last 24 hours",
"serial": "FF00A7BFFA4E6165E",
"_insertion_epoch_timestamp": 1727659690,
"supporting_data": "",
"_id": "613ee55ec9d868fc47654a73"
}
Get Network Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/network
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "f67629951b42c8e556062456",
"access_method": "Client",
"action": "block",
"app": "Domain Name Service (DNS)",
"appcategory": "Shopping",
"category": "Shopping",
"cci": 0,
"ccl": "unknown",
"client_bytes": 0,
"client_packets": 0,
"count": 1,
"device": "Other",
"domain": "",
"dst_geoip_src": 2,
"dsthost": "",
"dstip": "10.50.1.16",
"dstport": 5353,
"end_time": "2025-02-28T09:34:08+00:00",
"flow_status": "close",
"ip_protocol": "UDP",
"numbytes": 0,
"organization_unit": "",
"os": "Windows NT 11.0",
"policy": "default",
"publisher_name": "",
"server_bytes": 0,
"server_packets": 0,
"session_duration": 0,
"site": "dns",
"src_country": "IN",
"src_geoip_src": 2,
"src_latitude": 21.7003,
"src_location": "Bharūch",
"src_longitude": 72.9782,
"src_region": "Gujarat",
"src_zipcode": "392011",
"srcip": "103.108.207.58",
"srcport": 5353,
"start_time": "2025-02-28T09:34:08+00:00",
"timestamp": 1740735248,
"total_packets": 0,
"traffic_type": "non-web",
"tunnel_id": "1138033360427841",
"type": "network",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userip": "10.50.12.151",
"userkey": "tanushree.kurup@crestdata.ai",
"record_type": "network",
"qdomain": "",
"dst_region": "",
"userPrincipalName": "",
"dst_country": "",
"tunnel_type": "",
"dst_zipcode": "",
"num_sessions": 0,
"domain_ip": "",
"dst_longitude": 0.0,
"protocol": "",
"tunnel_up_time": 0,
"protocol_port": "",
"network_session_id": "",
"os_version": "",
"dst_latitude": 0.0,
"sAMAccountName": "",
"hostname": "",
"custom_attr": {},
"publisher_cn": "",
"dst_location": ""
}
Get Incident Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/incident
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "6d462e0db470c7247e75322fd380031271d1be18db9d707ef6f3affc792f11b1",
"access_method": "Endpoint Protection",
"acting_user": "kmaheshwari@netskope.com",
"activity": "Create",
"app": "DesktopServicesHelper",
"assignee": "None",
"dlp_incident_id": 7268524954762607217,
"dlp_match_info": [
{
"dlp_action": "block",
"dlp_forensic_id": 1711868037568704387,
"dlp_policy": "mmm1",
"dlp_profile_name": "DLPTest",
"dlp_rules": []
}
],
"file_path": "/Volumes/KALI LINUX/urls.txt",
"file_size": 52483,
"file_type": "Plain Text file",
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"object": "urls.txt",
"object_id": "hash_kmaheshwari@netskope.com_da3faaff0b406f6aa4685aee47ece41c_7b4a2e1f194ccb4e8eca958a472bfe3c3741d7a6",
"severity": "Low",
"status": "new",
"timestamp": 1719993903,
"title": "urls.txt",
"user": "kmaheshwari@netskope.com",
"record_type": "incident",
"instance": "",
"src_location": "",
"app_session_id": 0,
"zip_file_id": "",
"connection_id": 0,
"destination_site": "",
"to_user": "",
"latest_incident_id": 0,
"from_user": "",
"site": "",
"dst_location": "",
"inline_dlp_match_info": [],
"destination_instance_id": "",
"instance_id": "",
"channel": "",
"original_file_snapshot_id": "",
"bcc": "",
"referer": "",
"dlp_file": "",
"destination_app": "",
"true_obj_type": "",
"file_lang": "",
"url": "",
"true_obj_category": "",
"cc": "",
"owner_pdl": "",
"classification": "",
"object_type": "",
"ext_labels": [],
"exposure": "",
"dlp_parent_id": 0,
"owner": "",
"user_id": ""
}
Get Incident Forensics
API Endpoint: https://<tenant-url>/api/v2/incidents/dlpincidents/{id}/forensics
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Request Parameters
| Key | Value |
|---|---|
| dlp_incident_id in path param | dlp_incident_id |
{
"status": "success",
"data": {
"meta": "{\"metadata_content\":\"filename: sensitive_data_onedrive_share.txt file_md5: 0bcafac7ce40ad3ebad1664307a046f1 file_type: text/plain file_lang: ENGLISH object_id: {\\\"drive_id\\\": \\\"b!PM0toX-2uEqSwuqUx0SzyDAe0n7GMw1Eok5wsoIE5ALI55tDhn-rSJB-vB4UWs5e\\\", \\\"driveitem_id\\\": \\\"014GLSS7Z2KV57XD3LXNFLWFO3HXHVREJB\\\", \\\"site_collection_id\\\": \\\"a12dcd3c-b67f-4ab8-92c2-ea94c744b3c8\\\"} ns_text_classifier: others \",\"dlp_match_info\":[{\"dlp_profile_name\":\"DLP-PCI\",\"dlp_rules\":[{\"dlp_rule_name\":\"Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":3,\"dlp_data_identifiers\":[[{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"Number\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":78,\"score\":1,\"end_offset\":93,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"378282XXXXX0005\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":96,\"score\":1,\"end_offset\":110,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"371449XXXXX8431\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"371449XXXXX8431\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"},{\"dlp_profile_name\":\"US Financial Data\",\"dlp_rules\":[{\"dlp_rule_name\":\"US-Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":2,\"dlp_data_identifiers\":[[{\"start_offset\":19,\"score\":1,\"end_offset\":29,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"Type\\n\\n\",\"match\":\"Credit Card\",\"suffix\":\" Number\"},{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"3714XXXXXXXX31\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"},{\"start_offset\":203,\"score\":1,\"end_offset\":213,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"...5610591081018250\\n\\n\\n\\n\",\"match\":\"Diners Club\",\"suffix\":\"\\n\\n30569309025904\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"}]}",
"content": " Credit Card Type\n\nCredit Card Number\n\n\n\nAmerican Express\n\n37XXXXXXXXX0005\n\n\n\nAmerican Express\n\n37XXXXXXXXX8431\n\n\n\nAmerican Express Corporate\n\n37XXXXXXXXX1000\n\n\n\nAustralian BankCard\n\n5610XXXXXXXX50\n\n\n\nDiners Club\n\n30569XXXXXXXX5904\n\n\n\nDiners Club\n\n3852XXXXXXXX37\n\n\n\nDiscover\n\n60111XXXXXXXX117\n\n\n\nDiscover\n\n6011XXXXXXXX424\n\n\n\nJCB\n\n35301XXXXXXXX00\n\n\n\nJCB\n\n356XXXXXXXX05\n\n\n\nMasterCard\n\n555XXXXXXXX444\n\n\n\nMasterCard\n\n5105XXXXXXXX00\n\n\n\nVisa\n\n41XXXXXXXX111\n\n\n\nVisa\n\n401XXXXXXXX1881\n\n\n\nVisa\n\n422XXXXXXXX222"
}
}
Get Endpoint Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/endpoint
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "dffd23ac520f696e1c4bd020",
"access_method": "Endpoint",
"activity_type": "Process Start",
"alert": "no",
"alert_generated": false,
"computer_name": "win11-50-1-92",
"device_type": "Bluetooth File Transfer",
"os": "Windows",
"os_details": "Microsoft Windows 11 Pro 10.0.22621 64-bit",
"policy_action": "allow",
"process_name": "python.exe",
"process_path": "\\??\\C:\\Program Files\\Python312\\python.exe",
"sub_type": "SUBTYPE_DEVICE_CONTROL",
"timestamp": 1725847324,
"type": "endpoint",
"user": "shubham.singhal@crestdata.ai",
"record_type": "epdlp",
"executable_hash": "",
"location": "",
"device_sn": "",
"app": "",
"destination_file_name": "",
"printer_identifier": "",
"file_type": "",
"dlp_profile_name": "",
"dlp_profile": "",
"event_recovered": false,
"destination_file_path": "",
"dlp_incident_id": 0,
"device_name": "",
"source_file_directory": "",
"alert_type": "",
"process_cert_subject": "",
"policy_name": "",
"source_file_name": "",
"incident_id": 0,
"action": "",
"policy_name_enforced": "",
"policy_version": "",
"executable_signed": false,
"file_size": 0,
"justification": "",
"product_id": "",
"vendor_id": "",
"device_id": "",
"destination_file_directory": "",
"dlp_rule": "",
"device": "",
"alert_name": "",
"pid": "",
"port": "",
"connection_type": "",
"sha256": "",
"policy_action_enforced": "",
"activity": "",
"driver": "",
"unc_path": "",
"file_origin": "",
"os_user_name": "",
"md5": ""
}
Create a Client Status Iterator
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/netskope_ce_cs_iterator?
Method: POST
Request Headers
| Key | Value |
|---|---|
| User-Agent | netskope-ce-6.1.0 |
| Authorization | Bearer <v2 token> |
Request Parameters
| Key | Value |
|---|---|
| eventtype | clientstatus |
Sample API Response – if created successfully [202]
{"message":"Creation of the iterator, netskope_ce_cs_<unique_id_added> is in progress. Please use the iterator status API to check the status of the iterator. Please note that the iterator name has changed by appending an identifier to ensure uniqueness."
}
Sample API Response – if iterator cannot be created as already exists [400]
{"message":"Only one iterator is allowed per event type. Please use the existing iterator,<iterator_name>, or delete the existing iterator."
}
Check the Status of a Client Status Iterator
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/<iterator_name>
Method: GET
Request Headers
| Key | Value |
|---|---|
| User-Agent | netskope-ce-6.1.0 |
| Authorization | Bearer <v2 token> |
Sample API Response
{
"status": "Ready"
}
Fetch Data from a Client Status Iterator
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/<iterator_name>/events
Method: GET
Request Headers
| Key | Value |
|---|---|
| User-Agent | netskope-ce-6.1.0 |
| Authorization | Bearer <v2 token> |
Request Parameters
| Key | Value |
|---|---|
| operation | next |
Sample API Response
_id,as,asn,city,client_install_time,client_version,count,continent,country,device_hash,device_id,enriched,guid,heart_beat,host_info.client_version,host_info.device_make,host_info.device_model,host_info.hostname,host_info.last_update_timestamp,host_info.mac_addresses,host_info.managementID,host_info.nsdeviceuid,host_info.old_nsdeviceuid,host_info.os,host_info.os_version,host_info.serial_number,host_info.steering_config,isp,last_connected_from_private_ip,last_connected_from_public_ip,last_event_timestamp,last_seen_device_event.actor,last_seen_device_event.event,last_seen_device_event.event_details,last_seen_device_event.npa_status,last_seen_device_event.service_name,last_seen_device_event.status,last_seen_device_event.status_v2,last_seen_device_event.timestamp,latitude,longitude,organization,postal_code,region,timestamp,user_info.device_classification_status,user_info.orgkey,user_info.userkey,user_info.username,zipcode,record_type a7b8a3dd4aa3bebfac869f21,,,,0,123.0.0.2272,1,,,84a3c71061af4152f4e961f9,0AGE55ntv6Lg06dd2F30_092BDAE2-138E-38A4-1BC3-6BC72C4663E8,false,a9981877-c2be-4d8f-bf31-27410d8269d8,false,,"VMware, Inc.","VMware7,1",Win11-50-1-105,1740377213,00:50:56:81:A7:00,,092BDAE2-138E-38A4-1BC3-6BC72C4663E8,AFADEEE3-C9F6-3C54-E215-46EE64F4358C,0,11.0.22621,VMware-42 01 fa 68 fb 6b 7c 57-20 3c 42 df d2 c7 02 32,Default tenant config,,0.0.0.0,,1741034210,0,17,,8,Internet Security,0,0,1741034210,0,0,,,,0,0,lDFAMb4aR2ohwCHthoV,0AGE55ntv6Lg06dd2F30,nilay.modi@crestdata.ai,"396321",clientstatus 1c07aa9d8ad899d02b7c083b,,,,0,123.0.0.2272,1,,,84a3c71061af4152f4e961f9,0AGE55ntv6Lg06dd2F30_092BDAE2-138E-38A4-1BC3-6BC72C4663E8,false,a9981877-c2be-4d8f-bf31-27410d8269d8,false,,"VMware, Inc.","VMware7,1",Win11-50-1-105,1740377213,00:50:56:81:A7:00,,092BDAE2-138E-38A4-1BC3-6BC72C4663E8,AFADEEE3-C9F6-3C54-E215-46EE64F4358C,0,11.0.22621,VMware-42 01 fa 68 fb 6b 7c 57-20 3c 42 df d2 c7 02 32,Default tenant config,,0.0.0.0,,1741034205,0,7,Tunnel Down Due to SSL Error,8,Internet Security,1,0,1741034205,0,0,,,,0,0,lDFAMb4aR2ohwCHthoV,0AGE55ntv6Lg06dd2F30,nilay.modi@crestdata.ai,"396321",clientstatus
Sample API Response Headers
Delete a Client Status Iterator
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/netskope_ce_cs_iterator_28b7611b-da34-4836-8bdb-89caa3320b6e
Method: GET
Request Headers
| Key | Value |
|---|---|
| User-Agent | netskope-ce-6.1.0 |
| Authorization | Bearer <v2 token> |
Sample API Response
{
"message": "Successfully deleted the iterator, netskope_ce_cs_iterator_28b7611b-da34-4836-8bdb-89caa3320b6e."
}
Performance Matrix
This performance reading is conducted on a Large Stack CE with these VM specifications.
| Description | Specifications |
|---|---|
| Stack details | Size: Large RAM: 32 GB CPU: 16 Cores |
| Alerts/Events ingested to SIEM | ~200k EPM |
This figure represents the average performance across all alert and event types; however, the retrieval rate for incidents may fall below the average, with an estimated rate of approximately 1,500 incident events per minute.
User Agent
netskope-ce-6.1.0
Workflow
- Generate a v2 token for your Netskope tenant.
- Configure the Log Shipper Plugin.
- Configure a Business Rule.
- Configure Log Delivery.
- Validate the plugin.
Watch a Video
Click play to watch a video.
Generate a v2 token for your Netskope Tenant
-
In your Netskope tenant, go to Settings > Tools > REST API v2.
-
Click New Token.
-
Enter a Tenant Name.
-
Enter an Expire time. Select from Day(s), Hour(s), Week(s), Year(s).
-
Click Add Endpoint, and select the desired endpoints listed above in API Details, and enable the Read privilege. For more details, refer to the Permissions section and REST API Scopes.
-
Click Save.
-
Copy the token. It will be required when configuring the Netskope Tenant plugin in Cloud Exchange. Go here to configure the Netskope Tenant plugin.
Configure the Log Shipper Plugin
-
In Cloud Exchange, go to Settings > General and make sure the Log Shipper module is enabled. To enable this module. Netskope tenant plugin must be already configured.
-
Go to Settings > Plugin Store.
-
Search for and select the Netskope Log Shipper plugin.
-
Enter a configuration name and select a configured Netskope tenant from the dropdown.
-
Click Next and enter the Configuration Parameters:
- Alert Types: Types of alerts to fetch
- Initial Range for Alerts (in days): Number of days to pull the data for the initial run.
- Event Types: Types of events to fetch.
- Pull DLP Incident Forensics: Forensics fields for DLP Incidents will be fetched.
Note
- By default Forensics Originalfile Url (forensics_originalfile_url) and Forensics Subfile Url (forensics_subfile_url) fields will be included irrespective of whether Pull DLP Incident Forensics is YES or NO.
- If either the Netskope Ticket Orchestrator plugin or the Netskope Log Shipper plugin has the “Pull DLP Incident Forensics” field set to Yes, both plugins will automatically retrieve forensic fields for incident events.
- Keeping the Pull DLP Incident Forensics field as Yes might impact the performance of the Netskope log shipper plugin as it will make additional API calls which will impact the performance of the plugin.
- Any change in the value of the “Pull DLP Incident Forensics” field will not be respected once the plugin is configured, unless you restart the core or delete the Tenant plugin and CLS Netskope Log Shipper plugin and re-configure both the plugins.
- Initial Range for Events (in hours): Number of hours to pull the events data for the initial run.
If the plugin is directly upgraded to the latest version from the older version, you will have to edit the plugin and select the Client Status event type to pull it. -
Click Save.
Configure a Business Rule for Log Shipper
- Go to Log Shipper > Business Rule.
- By default, there is a business rule that filters all alerts and events. If you want to filter out any specific type of alert or event, then click Create New Rule and configure a new business rule by adding the rule name and selecting filters, like those shown here.
- Click Save.
Configure Log Delivery
In order to add Log Delivery, a third-party Log Shipper plugin, like Syslog, has to be configured before proceeding. You need both a source and destination plugin (configurations) to create the Log Delivery.
-
Go to Log Shipper > Log Delivery.
-
Select the Source plugin (Netskope Log Shipper), Destination plugin (Syslog), and select a business rule.
-
Click Save.
After the Log Delivery is added, the data will start getting pulled from the Netskope tenant, transformed, and ingested into the Syslog plugin.
Validate the Log Shipper Plugin
Validating Events and Alerts are present in Tenant
To validate Events/Alerts in the Netskope tenant.
- In your Netskope tenant, go to Skope IT.
- For Alerts, go to Alerts > Filters and select an option from the Last x Days dropdown in the top-right corner.
- For Events, go to Skope IT and select Application Events, Page Event, or Network Events.
- For Audit Events, go to Settings > Administrator > Audit Log.
Note
For Client Status events validation on Netskope Tenant currently, there is no way to check the events in any of the pages, but you can refer to the API Details to verify the events.
Validate the Pull
To validate the pulling of Events/Alerts from the Netskope tenant, in Cloud Exchange, go to Logging and search for the pulled logs.
Validate the Push
To validate the plugin workflow in Cloud Exchange, go to Logging and search for ingested Events, Alerts with the filter “message contains ingested”. The ingested logs will be filtered.
Troubleshooting the Log Shipper Plugin
Receiving Error while Configuring the Log Shipper Plugin
Getting the error: The Netskope tenant API V2 token does not have necessary permissions configured. Refer to the list of endpoints for which the token is missing permission. **
Cause: The provided V2 token does not have the minimum required permissions to configure the tenant plugin in Cloud Exchange.
What to do:
- Go to Logging and look for warning log similar to the following pattern:
TENANT Netskope Tenant (Required) [Netskope Tenant]: For Netskope Tenant, received 403 error for following endpoint(s) - Expand the log and get the list of endpoints for which permissions are missing.
- Now update the v2 token permissions and add the permission for the above endpoint list from Netskope Dashboard.
Receiving an Error while Configuring Multiple Plugins
Getting the error: Error: Value error, Error while creating iterator with name netskope_ce_cs_iterator_**. Cannot create Client Status Iterator. One iterator already exists for the Client Status event for your tenant. Delete the existing iterator to continue.
Cause: Due to API Limitations of Client Status iterator, creation of more than one iterator is not possible.
What to do:
- You can delete the already existing iterator using API, and create a new one from the plugin.
- If a user removes the Client Status event type from one plugin or deletes the Tenant plugin with an iterator, it will automatically delete the iterator from Netskope Tenant. And by configuring a new plugin, users can create an iterator.
- For more details on iterator deletion, refer to the documentation and reach out to your Netskope tenant support to delete an iterator.
Receiving cleanup() error while editing/enabling/disabling the plugin
You may encounter an error as shown below, this is due to incompatible cloud exchange version or incompatible tenant plugin version.
What to do: Upgrade your Netskope Log Shipper to the latest version and your issue will be resolved.
Note
- Device and Content alerts are supported starting from Cloud Exchange CE v5.1.0 and Tenant (Provider) v1.2.0
- Client status event is supported starting from Cloud Exchange v5.1.1, Tenant (Provider) v1.4.0
Unable to configure the plugin with Client status event
You may encounter below error because Client status event is supported starting from Cloud Exchange v5.1.1 and Tenant Plugin v1.4.0.
What to do:
- If you want to use this plugin on CE version below 5.1.1 and with Tenant version below v1.4.0, then remove the Client status event from Event Types field under Configuration Parameters, and then save the plugin.
- If you want to pull Client status event then upgrade your Cloud Exchange to v5.1.1, and Tenant Plugin to v1.4.0
Logs are not being ingested to the SIEM platform from the Netskope Log Shipper plugin
This could be due to this reason: when both Netskope Risk Exchange and Netskope Log Shipper are configured, and the Device entity is selected in CRE, a client_status iterator gets created for the tenant. If Client Status is not selected in the Event Types of the Netskope Log Shipper plugin, the existing iterator gets deleted during the CLS cleanup task (on plugin save). Since Client Status is not selected in the Event Types, the required iterator is not maintained. As a result, the task fails.
Steps to check the error:
- Download the diagnostic file.
- Unzip the diagnostic file and check for the below error message in the
core.logfile.
INFO/ForkPoolWorker-76194] Task common.pull[3c539ed9-0aa3-4ea9-b7f8-4d28c4e6b412] succeeded in 0.6612727344036102s: {'success': False, 'message': 'AttributeError("\\'NetskopePluginHelper\\' object has no attribute \\'tenant_name\\'")', 'trace': 'Traceback (most recent call last):
cloudexchange_core_1 | File "/opt/netskope/common/utils/task_decorator.py", line 160, in wrapper
cloudexchange_core_1 | ret = func(*args, **kwargs)
cloudexchange_core_1 | ^^^^^^^^^^^^^^^^^^^^^
cloudexchange_core_1 | File "/opt/netskope/common/celery/pull.py", line 132, in pull
cloudexchange_core_1 | for data, data_sub_type, sub_type_config_mapping, is_expo_backoff in pulled_data:
cloudexchange_core_1 | File "/opt/netskope/plugins/Default/netskope_provider/main.py", line 580, in pull
cloudexchange_core_1 | client.sub_types = sub_type_config_mapping.keys()
cloudexchange_core_1 | ^^^^^^^^^^^^^^^^
cloudexchange_core_1 | File "/opt/netskope/plugins/Default/netskope_provider/utils/iterator_helper.py", line 523, in sub_types
cloudexchange_core_1 | is_iterator_ready = self.netskope_api_plugin_helper.check_iterator_status(
cloudexchange_core_1 | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cloudexchange_core_1 | File "/opt/netskope/plugins/Default/netskope_provider/utils/iterator_api_helper.py", line 728, in check_iterator_status
cloudexchange_core_1 | ...'}
What to do:
- Go to the Log Shipper plugin configuration.
- Select Client Status in the Event Types.
- Save the plugin configuration.
- This updates the iterator and allows event ingestion to the SIEM platform to resume successfully.
Known Behaviors
Fetching 0 Client Status Events in Historical Pulling
Even after providing sufficient permissions to the token used in the Tenant, the Client Status events are not pulled from historical pull tasks.
Getting the logs:
TENANT Netskope Tenant (Required) [tenant_name]: Skipping clientstatus subtype for historical pull as the Client Status does not support historical.
Cause: Due to API Limitations of Client Status iterator, historical pulling is not supported for Client Status events.
Fetching Device/Content alerts on Cloud Exchange v5.1.0 with Tenant v1.0.0
We have observed that in Netskope Log Shipper v2.2.1 there will be logs for pulling Device/Content alerts with Tenant(Provider) v1.0.0 but there will be no filter available in the business rule to filter Device/Content alerts until you upgrade your Tenant to v1.2.0 or above. Also, note that even after upgrading your Tenant to v1.2.0 or above you need to manually create a new business rule to include Device/Content alerts in the filter.
Netskope Log Shipper plugin pulls forensics fields even if “Pull DLP Incident Forensics” field is set to No
It may be due to reasons listed below:
If either the Netskope Ticket Orchestrator plugin or the Netskope Log Shipper plugin has the “Pull DLP Incident Forensics” field set to Yes, both plugins will automatically retrieve forensic fields for incident events.
Any change in the value of the Pull DLP Incident Forensics field will not be respected once the plugin is configured, unless you restart the core or delete the Netskope log shipper plugin as well as tenant plugin and reconfigure both the plugins.
Ingested content may have missing fields/data if you set “Pull DLP Incident Forensics” field as “Yes” or the content of any of the fields is very large
We have observed that some of the fields are very large and they have length beyond the maximum length supported by the Netskope Cloud Exchange. Due to this, you may encounter the below warning and you may observe that the ingested event is incomplete as rest of the values will be skipped.
Only 1 Netskope Tenant Plugin per Netskope Tenant
It is not recommended to use multiple Netskope Tenant plugins with the same Netskope Tenant. If you have configured Netskope Log Shipper or Netskope Risk Exchange plugin with the Netskope Tenant and you delete the client status iterator, then both the plugins will throw an error (example shown below) for deleting the Client Status Iterator, and you will not be able to use the Netskope Log Shipper or Netskope Risk Exchange plugin.
TENANT Netskope Tenant (Required) [crest-plugin-support]: Error occurred while Deleting Client Status Iterator netskope_ce_cs_iterator_1aef2620-80bc-43b2-ac1d-31d652ee0xxx for tenant https://crest-plugin-support.de.goskope.com.