Netskope Help

Netskope Transaction Events

The HTTP Transaction events are critical for enterprises for deeper visibility as companies move to adopt cloud products. Netskope already provides page, app events, etc. that are rolled up and summarized to avoid "noisy" web traffic. The rolled up view is great for admins, in addition, transaction events provide granular information about the web sites that users have accessed.

Configure Transaction Events

You will need a subscription endpoint URL and subscription key to access the streamed events. Log in to your Netskope UI and go to Settings > Tools > Event Streaming. Copy your subscription endpoint and generate your download key from the Event Streaming page.

Important

The REGENERATE ENDPOINT button generates a new subscription path. Once a new subscription path is generated, a new subscription key must be generated by clicking on the GENERATE AND DOWNLOAD KEY button.

The old subscription path and key expires. With a new subscription path, event streaming will start fresh from the beginning of the retention period, i.e., 7 days ago by default.

TRX_Event_Streaming.jpg

Once the transaction events feature is enabled in your account, you’ll be able to consume the data from the subscription endpoint.

To receive the events from the subscription, refer to the Receiving messages from Lite subscriptions link . You can receive messages with various Client libraries. Netskope retains transaction events for seven days by default if not consumed.

There are different access methods for transaction events:

  • Google SDK

  • Netskope Splunk Integration

  • Netskope Cloud Exchange

Google SDK

The enhanced transaction events streaming is delivered through a streaming mechanism. 

The transaction event near real-time subscription messages have the following format:

Attributes

  • Content-Encoding. gzip - currently the only available value

  • Log-Count - number of events enclosed in the message data

  • Fields - transaction event fields for each transaction event

Data

  • The message data contains gzip compressed transaction events

Refer to the sample code to receive and decode the transaction events.

Netskope Splunk Integration

The Netskope App (Add-on) for Splunk has dashboards for visualization of Events, Alerts, and Web Transaction details. This information is populated on the dashboard.

Users can get  information related to data collected in addition to transforming and parsing data with the Add-on app available from splunkbase.

Click the following links to set up the Netskope Splunk Integration:

Netskope Cloud Exchange

Netskope Cloud Exchange is available for download on GitHub and accompanying installation documentation is available: