Docy

Get Reports Data

Get Reports Data

This endpoint returns the result of a report generated on one of the fields in the summarization database.

Request Endpoint

https://<tenant-URL>/api/v1/report

Valid query parameters are:

KeyValueDescription
tokenstringRequired. The token obtained from the REST API page in the Netskope UI ( Settings > Tools > Rest API v1) is required. We recommend that you place the token in the body of the request, not in the endpoint URL.
queryValid event query.This acts as a filter for all the cloud app events in the events database.
typeapplication | connection | alert | networkSelects application events, connection events or alerts (Policy, DLP, Quarantine, Watchlist).
groupbyapplication | user | device | activityActivity is only available for type = application or alert.
timeperiod3600 | 86400 | 604800 | 2592000Last 60 mins | Last 24 Hrs | Last 7 Days | Last 30 Days
starttimeUnix epoch timeRestrict events to those that have timestamps greater than this. Needed only if timeperiod or insertionstarttime/insertionendtime is not passed.
endtimeUnix epoch timeRestrict events to those that have timestamps less than or equal to this. Needed only if timeperiod or insertionstarttime/insertionendtime is not passed.
limitPositive integer less than 5000REST API responses can return up to 5000 events in a single response. You can use pagination to retrieve more results.
skipPositive integerSkip over some of the events (useful for pagination in combination with limit).

Example Report Request

POST https://<tenant-URL>/api/v1/report?query=alert_type%20eq%20DLP&type=alert&groupby=user&timeperiod=3600 
{    "token": "f32a973eddd7bc1602fc0f48dc0a"
}

Query for DLP violations grouped by user:

POST https://<tenant-URL>/api/v1/report?query=alert_type eq DLP&type=alert&groupby=user&timeperiod=2592000
{    "token": "f32a973eddd7bc1602fc0f48dc0a"
}
  • Set endpoint name as report
  • Set query=alert_type eq DLP to query for DLP alerts
  • Set type=alert to query for DLP alerts
  • Set groupby=user
Share this Doc
In this topic ...