REST API Events and Alerts Response Descriptions - Netskope Technical Documentation

These are the response descriptions for the Get Events Data and Get Alerts Data endpoints.

Parameter Grouping	Parameter Name	Descriptions	Data Type	Example Responses	App Events	Page Events	Alerts
General	`timestamp`	Timestamp when the event/alert happened. Event timestamp in Unix epoch format.	Integer	1443811033	Y	Y	Y
General	`_insertion_epoch_timestamp`	Insertion timestamp	Integer	1485025255	Y	Y	Y
General	`src_timezone`	Source timezone. Shows the long format timezone designation.	String	America/Los_Angeles	Y	Y	Y
General	`dst_timezone`	Destination timezone	String	America/New_York	Y	Y	Y
General	`type`	Shows if it is an application event or a connection event. Application events are recorded to track user events inside a cloud app. Connection events shows the actual HTTP connection.	String	Value for Application Events: nspolicy Value for Page Events: connection Values for Alerts: nspolicy, connection, breach, anomaly, malsite	Y	Y	Y
General	`access_method`	Cloud app traffic can be steered to the Netskope cloud using different deployment methods such as Client (Netskope Client), Secure Forwarder etc. Administrators can also upload firewall and/or proxy logs for log analytics. This field shows the actual access method that triggered the event. For log uploads this shows the actual log type such as PAN, Websense, etc.	String	Client, Secure Forwarder, API Connector, Proxy Chaining, Reverse Proxy	Y	Y	Y
General	`traffic_type`	Type of the traffic: CloudApp or Web. CloudApp indicates CASB and web indicates HTTP traffic. Web traffic is only captured for inline access method. It is currently not captured for Risk Insights.	String	CloudApp, Web	Y	Y	Y
General	`action`	Action taken on the event for the policy	String	useralert, Detection, bypass, block, alert, restrictToView, disableDownload, legalHold, expireLink, restrictAccess, delete, quarantine	Y	Y	Y
General	`fromlogs`	Shows if the event was generated from the Risk Insights log.	String	yes	Y	Y	Y
General	`user_generated`	Tells whether it is user generated page event	Boolean	yes, no	N	Y	Y
General	`tunnel_id`	Shows the Client installation ID. Only available for the Client steering configuration.	String	c5b07447-e86e-4722-b59e-81144	Y	Y	Y
General	`request_id`	Unique request ID for the event	Integer	1,590	Y	N	Y
General	`transaction_id`	Unique ID for a given request/response	String	1843244978932892112	Y	Y	Y
General	`connection_id`	Each connection has a unique ID. Shows the ID for the connection event.	LongInt	117073088998365	Y	Y	Y
General	`conn_duration`	Duration of the connection in milliseconds. Useful for querying long-lived sessions.	Integer	59000	Y	Y	Y
General	`conn_starttime`	Connection start time	Float	1480330369	N	Y	Y
General	`conn_endtime`	Connection end time	Float	1480330428	N	Y	Y
General	`latency_min`	Min latency for a connection in milliseconds	Integer	47	N	Y	Y
General	`latency_max`	Max latency for a connection in milliseconds	Integer	651	N	Y	Y
General	`latency_total`	Total latency from proxy to app in milliseconds	Integer	3797	N	Y	Y
General	`req_cnt`	Total number of HTTP requests (equal to number of transaction events for this page event) sent from client to server over one underlying TCP connection.	Integer	21	Y	Y	Y
General	`resp_cnt`	Total number of HTTP responses (equal to number of transaction events for this page event) from server to client	Integer	21	Y	Y	Y
General	`http_transaction_count`	HTTP transaction count	Integer	300	N	Y	Y
General	`numbytes`	Total number of bytes that were transmitted for the connection – numbytes = client_bytes + server_bytes	Integer	18177	Y	Y	Y
General	`client_bytes`	Total number of bytes uploaded from client to server	Integer	1093	Y	Y	Y
General	`server_bytes`	Total number of downloaded from server to client.	Integer	17084	Y	Y	Y
General	`suppression_key`	To limit the number of events. Example: Suppress block event for browse	String	2019-01-07_1135.zip	Y	N	Y
General	`suppression_start_time`	When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.	Integer	1443811033	Y	Y	Y
General	`suppression_end_time`	When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.	Integer	1443811078	Y	Y	Y
General	`count`	Number of raw log lines/events sessionized or suppressed during the suppressed interval.	Integer	1	Y	Y	Y
General	`bypass_traffic`	Tells if traffic is bypassed by Netskope	Boolean	yes, no	N	Y	Y
General	`ssl_decrypt_policy`	Applicable to only bypass events. There are 2 ways to create rules for bypass: Bypass due to Exception Configuration Bypass due to SSL Decrypt Policy The existing flag bypass_traffic only gives information that a flow has been bypassed, but does not tell exactly which policy was responsible for it. `ssl_decrypt_policy` field will provide this extra information. In addition, policy field will be also set for every Bypass event.	String	yes, no	N	Y	Y
General	`dynamic_classification`	URLs were categorized by NSURLC machine or not	String	yes, no	N	N	Y
General	`dst_geoip_src`	Source from where the location of Destination IP was derived	Integer	1	Y	Y	Y
General	`src_geoip_src`	Source from where the location of Source IP was derived	Integer	2	Y	Y	Y
General	`modified`	Timestamp corresponding to the modification time of the entity (file, etc.)	DateTime	2017-01-17T08:56:05	Y	Y	Y
Alert	`alert`	Indicates whether alert is generated or not. Populated as `yes` for all alerts.	String	yes, no	Y	Y	Y
Alert	`alert_name`	Name of the alert	String	proximity, rare_event, risky_country, user_shared_credentials, data_exfiltration, mlad	Y	Y	Y
Alert	`alert_type`	Type of the alert	String	Values for Alerts: watchlist, policy, DLP, Legal Hold, quarantine, Malware, malsite, anomaly, Compromised Credential, Security Assessment Values for App Events: policy, DLP, quarantine, Legal Hold, Malware, Security Assessment, Remediation	Y	Y	Y
Alert	`acked`	Whether user acknowledged the alert or not	Boolean	false, true	Y	Y	Y
Alert	`severity`	Severity used by watchlist and malware alerts	String	low, medium, high, unknown, null	Y	Y	Y
Alert	`severity_id`	Severity ID used by watchlist and malware alerts	Integer	1, 2, 3, null	Y	N	Y
Alert	`policy_id`	The Netskope internal ID for the policy created by an admin	Integer	1, 8	Y	N	Y
Alert	`policy`	Name of the policy configured by an admin	String	PCI Files in OneDrive	Y	Y	Y
Alert	`profile_emails`	List of profile emails per policy	String	[“dlp_policy@netskope.com”]	Y	N	Y
Alert	`justification_reason`	Justification reason provided by user. For following policies, justification events are raised. User is displayed a notification popup, user enters justification and can select to proceed or block: useralert policy dlp block policy block policy with custom template which contains justification text box	String	Provided reason	Y	N	Y
Alert	`justification_type`	Type of justification provided by user when user bypasses the policy block	String	falsePositive, justification	Y	N	Y
Application	`app`	Specific cloud application used by the user (e.g. app = Dropbox).	String	Google Drive	Y	Y	Y
Application	`appcategory`	Application Category as designated by Netskope	String	Collaboration, Customer Relationship Management, Cloud Storage, IaaS/PaaS	Y	Y	Y
Application	`ccl`	Cloud Confidence Level. CCL measures the enterprise readiness of the cloud apps taking into consideration those apps security, auditability and business continuity. Each app is assigned one of five cloud confidence levels: excellent, high, medium, low, or poor. Useful for querying if users are accessing a cloud app with a lower CCL.	String	excellent, high, medium, low, poor, unknown, not_defined	Y	Y	Y
Application	`site`	For traffic_type = CloudApp, site = app and for traffic_type = Web, it will be the second level domain name + top-level domain name. For example, in “www.cnn.com”, it is “cnn.com”.	String	cnn.com	Y	Y	Y
Application	`url`	URL of the application that the user visited as provided by the log or data plane traffic	String	www.evernote.com/shard/s2 31/notestore	Y	Y	Y
Application	`page`	The URL of the originating page	String	www.google.co.in/search?q= railway	Y	Y	Y
Application	`domain`	Domain value. This will hold the host header value or SNI or extracted from absolute URI.	String	google.co.in	Y	Y	Y
Application	`sessionid`	Populated by Risk Insights	Integer	34014529	Y	Y	Y
Application	`app_session_id`	Unique App/Site Session ID for traffic_type = CloudApp and Web. An app session starts when a user starts using a cloud app/site on and ends once they have been inactive for a certain period of time(15 mins). Use app_session_id to check all the user activities in a single app session. app_session_id is unique for a user, device, browser and domain.	String	1.42333E+14	Y	Y	Y
Application	`referer`	Referer URL of the application(with http) that the user visited as provided by the log or data plane traffic	String	https://portal.office.com/Admi nPortal/Home	Y	Y	Y
Application	`managed_app`	Whether or not the app in question is managed	Boolean	yes, no	Y	N	Y
Application	`telemetry_app`	Typically SaaS app web sites use web analytics code within the pages to gather analytic data. When a SaaS app action or page is shown, there is subsequent traffic generated to tracking apps such as doubleclick.net, Optimizely, etc. These tracking apps are listed if applicable in the Telemetry App field.	String	doubleclick, Amazon S3, google, Microsoft Office 365 Suite, Adswizz, fbcdn	Y	N	Y
Application	`instance_id`	Unique ID associated with an organization application instance	String	nammazone.com	Y	N	Y
Application	`instance`	Instance associated with an organization application instance	String	nammazone.com	Y	Y	Y
Application	`instance_name`	Instance name associated with an organization application instance	String	netskope.com	Y	N	Y
Application	`instance_type`	Instance type	String	VirtualPrivateCloud, Server, Image, Document, Managed Instance, LoadBalancer	Y	N	Y
Application	`object`	Name of the object which is being acted on. It could be a filename, folder name, report name, document name, etc.	String	Resume.doc	Y	Y	Y
Application	`object_id`	Unique ID associated with an object	String	3214	Y	N	Y
Application	`object_type`	Type of the object which is being acted on. Object type could be a file, folder, report, document, message, etc.	String	File, User, Note	Y	N	Y
Application	`from_object`	Initial name of an object that has been renamed, copied or moved	String	test1	Y	N	Y
Application	`to_object`	Changed name of an object that has been renamed, copied, or moved	String	test2	Y	N	Y
Application	`object_count`	Displayed when the activity is Delete. Shows the number of objects being deleted	Integer	3	Y	N	Y
Application Specific	`enterprise_id`	EnterpriseID in case of Slack for Enterprise	String	E8D23NJ1H	Y	N	Y
Application Specific	`enterprise`	Enterprise name in case of Slack for Enterprise	String	Netskope enterprise	Y	N	Y
Application Specific	`workspace_id`	Workspace ID in case of Slack for Enterprise	String	TDFHG3CLF	Y	N	Y
Application Specific	`workspace`	Workspace name in case of Slack for Enterprise	String	Netskope workspace	Y	N	Y
Application Specific	`team`	Slack team name	String	Netskope team	Y	N	Y
Application Specific	`channel`	Channel of the user for slack and slack enterprise apps	String	channel1	Y	N	Y
Application Specific	`sub_type`	Workplace by Facebook post sub category (files, comments, status etc)	String	file, comment, post	Y	N	Y
Application Specific	`violating_user`	User who caused a vioaltion. Populated for Workplace by Facebook	String	example@netskope.com	Y	N	Y
Application Specific	`violating_user_type`	Category of the user who caused a violation. Populated for Workplace by Facebook.	String	Internal, External	Y	N	Y
Application Specific	`logintype`	Salesforce login type	String	Remote Access 2.0, Other Apex API, Remote Access Client	Y	N	Y
Application Specific	`loginurl`	Salesforce login URL	String	my.salesforce.com	Y	N	Y
Application Specific	`new_value`	New value for a given file for salesforce.com	String	2019-01-18 3:33:58	Y	N	Y
Application Specific	`old_value`	Old value for a given file for salesforce.com	String	2019-01-17 3:33:58	Y	N	Y
Application Specific	`scopes`	List of permissions for google apps	String	[“https://www.googleapis.com /auth/cloud-platform”, “https://www.googleapis.com/ auth/userinfo.email”]	Y	N	Y
Application Specific	`session_id`	Session ID for Dropbox application	Integer	1.77573E+14	Y	N	Y
Application Specific	`user_role`	Roles such as admin, owner etc for Box	String	Admin, coadmin, user	Y	N	Y
Application Specific	`role`	Roles for Box	String	Editor, Previewer, Previewer Uploader, Uploader, Viewer, Viewer Uploader, Owner, Co- owner	Y	N	Y
Activity	`activity`	Description of the user performed activity	String	Download, Invite, Issue, Join, Login Attempt, Login Failed, Login Successful, Logout, Mark, Markup, Move, Upload, View, View All	Y	Y	Y
Activity	`activity_type`	Displayed when only admins can perform the activity in question	String	Admin	Y	N	Y
Activity	`act_user`	User doing an activity	String	user@netskope.com	Y	N	Y
Activity	`activity_status`	Displayed when the user is denied access while performing some activity	String	Access Denied	Y	N	Y
Activity	`Url2Activity`	Populated if the activity from the URL matches certain activities. This field applies to Risk Insights only.	String	Yes	Y	N	Y
Activity	`ns_activity`	Maps app activity to Netskope standard activity.	String	Download, Upload, view, unlock	Y	N	Y
Activity	`audit_category`	The subcategories in an application such as IAM, EC in AWS, login, token, file, etc., in case of Google.	String	IAM, Lambda, S3, access, Compute Engine, Elasticloadbalancing, EC2, event_change, acl_change	Y	N	Y
Activity	`audit_type`	The sub category in audit according to SaaS / IaaS apps	String	download, edit, create, view, HeadBucket	Y	N	Y
User	`userkey`	User ID or email	String	user@netskope.com	Y	Y	Y
User	`user_id`	User email	String	user@netskope.com	Y	N	Y
User	`user`	User email	String	user@netskope.com	Y	Y	Y
User	`user_name`	Name of user	String	TestUser	Y	N	Y
User	`ur_normalized`	All lower case user email	String	user@netskope.com	Y	Y	Y
User	`user_normalized`	All lower case user email	String	user@netskope.com	N	N	Y
User	`userip`	IP address of User	String	xxx.xxx.xxx.xx	Y	Y	Y
User	`useragent`	Browser HTTP user agent header	String	Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0	Y	Y	Y
User	`user_category`	Type of user in an enterprise – external / internal	String	Internal	Y	N	Y
User	`organization_unit`	Org Units for which the event correlates to. This ties to user information extracted from Active Directory using the Directory Importer/AD Connector application.	String	Maximum of 5 levels: “OU1/OU2/OU3/OU4/OU5”	Y	Y	Y
User	`org`	Search for events from a specific organization. Organization name is derived from the user ID.	String	sampleorganization.org	Y	Y	Y
User	`os`	Operating system of the host who generated the event.	String	Yosemite	Y	Y	Y
User	`os_version`	OS version of the host	String	Windows 7	Y	Y	Y
User	`browser`	Shows the actual browser from where the cloud app was accessed.	String	BlackBerry, Chrome, Firefox, iCab, Mobile, MSIE, Native, Opera, RockMelt, Safari, Skyfire, Tencent, Thunderbird	Y	Y	Y
User	`browser_version`	Browser version	String	50	Y	Y	Y
User	`browser_session_id`	Browser session ID. If there is an idle timeout of 15 minutes, it will timeout the session.	LongInt	75256867583232	Y	Y	Y
User	`device`	Device type from where the user accessed the cloud app. It could be Macintosh Windows device, iPad etc.	String	Android Device, iOS Device. iPad, iPhone, Linux Device, Mac Device, Windows Device, Other Device	Y	Y	Y
User	`device_classification`	Designation of device as determined by the Netskope Client as to whether the device is managed or not.	String	managed, not configured, unknown, unmanaged	Y	N	Y
User	`hostname`	Host name	String	example’s Macbook Pro	Y	Y	Y
User	`nsdeviceuid`	Device identifiers on macOS and Windows	String	zndbgI=	Y	N	Y
User	`managementID`	Management ID	String	FFD2E8A	Y	N	Y
Source	`srcip`	IP address of source/user	String	xxx.xxx.xxx.xx	Y	Y	Y
Source	`src_location`	User’s city as determined by the Maxmind or IP2Location Geodatabase	String	San Jose	Y	Y	Y
Source	`src_region`	Source state or region as determined by the Maxmind or IP2Location Geodatabase	String	California	Y	Y	Y
Source	`src_latitude`	Latitude of the user as determined by the Maxmind or IP2Location Geodatabase	Integer	[xx.xxxx]	Y	Y	Y
Source	`src_longitude`	Longitude of the user as determined by the Maxmind or IP2Location Geodatabase	Integer	[-xxx.xxx]	N	Y	N
Source	`src_country`	User’s country’s two-letter Country Code as determined by the Maxmind or IP2Location Geodatabase	String	US	Y	Y	Y
Source	`src_zipcode`	Source zip code as determined by the Maxmind or IP2Location Geodatabase	String	95134	Y	Y	Y
Destination	`dstip`	IP address where the destination app is hosted	String	xxx.xxx.xxx.xx	Y	Y	Y
Destination	`dst_location`	Application’s city as determined by the Maxmind or IP2Location Geodatabase	String	Mountain View	Y	Y	Y
Destination	`dst_region`	Application’s state or region as determined by the Maxmind or IP2Location Geodatabase	String	California	Y	Y	Y
Destination	`dst_latitude`	Latitude of the Application as determined by the Maxmind or IP2Location Geodatabase	Integer	[xx.xxxx]	Y	Y	Y
Destination	`dst_longitude`	Longitude of the Application as determined by the Maxmind or IP2Location Geodatabase	Integer	[-xxx.xxx]	N	Y	N
Destination	`dst_country`	Application’s two-letter country code as determined by the Maxmind or IP2Location Geodatabase	String	US	Y	Y	Y
Destination	`dst_zipcode`	Application’s zip code as determined by the Maxmind or IP2Location Geodatabase	String	94043	Y	Y	Y
Destination	`dstport`	Destination port	Integer	443, 80 (1-65535)	Y	Y	Y
Destination	`dsthost`	Destination host	String	mail.yahoo.com	Y	Y	Y
Introspection	`retro_scan_name`	Retro scan name	String	Retro_Scan_box_netskope.com_20181213_1616	Y	Y	Y
Introspection	`scan_type`	Generated during retroactive scan or new ongoing activity	String	Ongoing, ongoing, retroactive, Retroactive	Y	N	Y
File	`file_id`	Unique identifier of the file	String	0B3jELp0mSNw2dTZDNUhpUGpjUGgxQUY5OUZI	Y	N	Y
File	`filename`	Name of the file	String	PandasDFTests.py	Y	N	Y
File	`title`	Title of the file	String	PandasDFTests.py	Y	Y	Y
File	`mime_type`	MIME type of the file	String	application/pdf	Y	N	Y
File	`data_type`	Content type of upload/download	String	application/xml	Y	Y	Y
File	`md5`	md5 of the file	String	295a6f156624f73c31a9a670 d9a41914	Y	Y	Y
File	`file_size`	Size of the file in bytes	Integer	22854	Y	N	Y
File	`file_type`	File type	String	text/plain, application/pdf, etc.	Y	Y	Y
File	`file_lang`	Language of the file	String	SWEDISH	Y	Y	Y
File	`path_id`	Path ID of the file in the application	Integer	3.94218E+11	Y	N	Y
File	`file_path`	Path of the file in the application	String	/sample/file.pdf	Y	N	Y
File	`owner`	Owner of the file	String	example@netskope.com	Y	N	Y
File	`original_file_path`	If the file is moved, then keep original path of the file in this field	String	29208ee0-021e-4cb2-87b4-c9303880	Y	N	Y
File	`from_user`	Email address used to login to the SAAS app	String	example@netskope.com	Y	N	Y
File	`from_user_category`	Type of from_user	String	Internal, External	Y	N	Y
File	`to_user`	Used when a file is moved from user A to user B. Shows the email address of user B	String	example@netskope.com	Y	N	Y
File	`to_user_category`	Type of user to which move is done	String	Internal, External	Y	N	Y
File	`shared_with`	Array of emails with whom a document is shared with	String	[aaaa@netskope.com,nnnn@netskope.com,dddd@netskope.com]	Y	Y	Y
File	`shared`	If the file is shared or not	Boolean	true, false	Y	N	Y
File	`shared_type`	Shared Type	String	internal, external, private, enterprise	Y	N	Y
File	`shared_domains`	List of domains of users the document is shared with	String	[netskope.com, yahoo.com]	Y	N	Y
File	`exposure`	Exposure of a document	String	private, public, public_on_web, enterprise, external, internal, anyone_with_link	Y	Y	Y
File	`attachment`	File name	String	image001.png	Y	N	Y
File	`encrypt_failure`	Reason of failure while encrypting	String	Failed getting encryption Key	Y	N	Y
File	`log_file_name`	Log file name for Risk Insights	String	20190205T0917_0.csv.gz	Y	Y	Y
File	`file_passwd_protected`	Tells if the file is password protected	Boolean	TRUE	Y	N	Y
File	`web_url`	File preview URL	String	https://drive.google.com/open?id=1234	Y	N	Y
File	`external_collaborator_count`	Count of external collaborators on a file/folder. Supported for some apps.	Integer	4	Y	Y	Y
File	`internal_collaborator_count`	Count of internal collaborators on a file/folder. Supported for some apps.	Integer	3	Y	N	Y
File	`total_collaborator_count`	Count of collaborators on a file/folder. Supported for some apps.	Integer	7	Y	N	Y
DLP	`dlp_incident_id`	Incident ID associated with sub-file. In the case of main file, this is same as the parent incident ID.	LongInt	146831431522000	Y	Y	Y
DLP	`dlp_parent_id`	Incident ID associated with main container (or non-container) file that was scanned	LongInt	146831431522000	Y	Y	Y
DLP	`dlp_file`	File/Object name extracted from the file/object	String	Credit Report.pdf	Y	N	Y
DLP	`dlp_profile`	DLP profile name	String	DLP-PCI	Y	Y	Y
DLP	`dlp_rule`	DLP rule that triggered	String	Name-Credit Card (CC)	Y	Y	Y
DLP	`dlp_rule_count`	Count of rule hits	Integer	5	Y	Y	Y
DLP	`dlp_rule_severity`	Severity of rule	String	Low, Medium, High, Critical	Y	Y	Y
DLP	`dlp_fingerprint_classification`	Fingerprint classification	String	Senstive Customer Information, PII	Y	N	Y
DLP	`dlp_fingerprint_match`	Fingerprint classification match file name	String	Top_100_Existing_Accounts_11_1_18.xlsx	Y	N	Y
DLP	`dlp_fingerprint_score`	Fingerprint classification score	Integer	0-100	Y	N	Y
DLP	`dlp_rule_score`	DLP rule score for weighted dictionaries	Integer	13	Y	N	Y
DLP	`dlp_is_unique_count`	True or false depending upon if rule is unique counted per rule data	Boolean	true, false	Y	Y	Y
DLP	`dlp_unique_count`	Integer value of number of unique matches seen per rule data. Only present if rule is uniquely counted.	Integer	10	Y	N	Y
Quarantine	`quarantine_file_id`	File ID of the quarantined file	String	435bd35a-e021-4a2c-bc41-ba281f91	Y	N	Y
Quarantine	`quarantine_profile_id`	Quarantine profile ID	Integer	2	Y	N	Y
Quarantine	`quarantine_profile`	Quarantine profile name of policy for quarantine action	String	Quarantine Data – OneDrive	Y	N	Y
Quarantine	`quarantine_failure`	Reason of failure	String	Quarantine failed; file transfer failure	Y	N	Y
Quarantine	`quarantine_action_reason`	Reason for the action taken for quarantine	String	Previously quarantined file still blocked because admin decision is pending	Y	N	Y
Quarantine	`q_admin`	Quarantine profile custodian email/name	String	example@netskope.com	Y	N	Y
Quarantine	`q_app`	Quarantine app name	String	Box	Y	N	Y
Quarantine	`q_instance`	Quarantine instance name	String	Box Production	Y	N	Y
Quarantine	`q_original_filename`	Original file name which got quarantined	String	Sensitive File	Y	N	Y
Quarantine	`q_original_filepath`	Original file path which got quarantined	String	All/Folder1/Folder2	Y	N	Y
Quarantine	`q_original_shared`	Original file shared user details	String	Private	Y	N	Y
Quarantine	`q_original_version`	Original version of file which got quarantined	String	1	Y	N	Y
Quarantine	`quarantine_file_name`	File name of the quarantine file	String	sensitivefile.txt	Y	N	Y
Legal Hold	`legal_hold_profile_name`	Legal hold profile name	String	Legal hold Test Profile	Y	N	Y
Legal Hold	`lh_custodian_email`	Custodian email of legal hold profile	String	example@netskope.com	Y	N	Y
Legal Hold	`lh_custodian_name`	Custodian name of legal hold profile	String	Kelly Oar	Y	N	Y
Legal Hold	`lh_dest_app`	Destination appname of legalhold action	String	Box	Y	N	Y
Legal Hold	`lh_dest_instance`	Destination instance of legal hold action	String	Box Production	Y	N	Y
Legal Hold	`lh_fileid`	File ID of legal hold file	String	3.97035E+11	Y	N	Y
Legal Hold	`lh_filename`	File name of legal hold file	String	Sensitive file_v1_2016-04-2707-00-15(UTC)	Y	N	Y
Legal Hold	`lh_filepath`	File path of legal hold file	String	All/Folder1/Folder2	Y	N	Y
Legal Hold	`lh_original_filename`	Original filename of legal hold file	String	Sensitive File	Y	N	Y
Legal Hold	`lh_shared`	Shared type of legal hold file	String	Internal	Y	N	Y
Legal Hold	`lh_shared_with`	User shared with the legal hold file	String	[“example1@netskope.com”, “example2@netskope.com”]	Y	N	Y
Legal Hold	`lh_version`	File version of original file	String	1	Y	N	Y
Anomaly	`orig_ty`	Event Type of original event	String	nspolicy, connection	N	Y	Y
Anomaly	`last_timestamp`	Last timestamp (timestamp in the first/older event). Applies to only proximity anomaly alert.	LongInt	1549296669	N	Y	Y
Anomaly	`last_app`	Last application (app in the first/older event). Applies to only proximity anomaly alert.	String	Facebook	N	Y	Y
Anomaly	`last_device`	Last device name (Device Name in the first/older event). Applies to only proximity anomaly alert.	String	Windows Device	N	Y	Y
Anomaly	`last_country`	Last location (Country). Applies to only proximity anomaly alert.	String	US	N	Y	Y
Anomaly	`last_location`	Last location (City). Applies to only proximity anomaly alert.	String	Chicago	N	Y	Y
Anomaly	`last_region`	Applies to only proximity anomaly alert.	String	Pennsylvania	N	Y	Y
Anomaly	`download_app`	Applicable to only data exfiltration. Download App (App in the download event).	String	Google Gmail	N	N	Y
Anomaly	`shared_credential_user`	Applicable to only shared credentials. User with whom the credentials are shared with.	String	Michael Sam	N	N	Y
Anomaly	`threshold_time`	Applicable to: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type. Threshold Time	LongInt	Default time (86400 Seconds)	N	N	Y
Anomaly	`bin_timestamp`	Applicable to only: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/Download/Delete) and Failed Login Anomaly type. Bin TimeStamp (is a window used that is used for certain types of anomalies – for breaking into several windows per day/hour).	LongInt	1549411200	N	N	Y
Anomaly	`threshold`	Threshold (Count at which the anomaly should trigger). Applicable to Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type	Integer	205	N	Y	Y
Anomaly, MLAD	`event_type`	Anomaly type	String	App Events: Info, error Alerts: proximity, rare_event, risky_country, user_shared_credentials, data_exfiltration, bulk_upload, bulk_download, mlad	Y	Y	Y
Anomaly, MLAD	`profile_id`	Anomaly profile ID	String	NS_101 which means proximity alert NS_103, NS_102, NS_307, NS_306, NS_304, NS_303, NS_305, NS_301, NS_403, NS_401	Y	Y	Y
Anomoly, MLAD	`risk_level_id`	This field is set by both role-based access (RBA) and MLAD	Integer	1,2,0	N	Y	Y
Anomoly, MLAD	`risk_level`	Corresponding field to risk_level_id. Name	String	low, med, high	Y	Y	Y
Malsite	`malicious`	Only exists if some HTTP transaction belonging to the page event resulted in a malsite alert.	Boolean	TRUE	Y	Y	Y
Malsite	`malsite_active`	Since how many days malsite is Active	Integer	2	N	N	Y
Malsite	`malsite_as_number`	Malsite ASN Number	String	AS35838 CCANet Limited	N	N	Y
Malsite	`malsite_confidence`	Malsite confidence score	Integer	100	N	N	Y
Malsite	`malsite_consecutive`	How many times that malsite is seen	Integer	1	N	N	Y
Malsite	`malsite_category`	Category of malsite [ Phishing / Botnet / Malicous URL, etc. ]	String	[“Malcious Site”]	Y	N	Y
Malsite	`malsite_country`	Malsite country	String	US	N	N	Y
Malsite	`malsite_region`	Region of the malsite URL/IP/Domain	String	Texas	N	N	Y
Malsite	`malsite_city`	Malsite city	String	Los Angeles	N	N	Y
Malsite	`malsite_dns_server`	DNS server of the malsite URL/Domain/IP	String	xxx.xxx.com	N	N	Y
Malsite	`malsite_first_seen`	Malsite first seen timestamp	Integer	1485302400	N	N	Y
Malsite	`malsite_hostility`	Malsite hostility score	Integer	5	N	N	Y
Malsite	`malsite_ip_host`	Malsite IP	String	xxx.xxx.x.xxx	N	N	Y
Malsite	`malsite_isp`	Malsite ISP info	String	CCANET Limited	N	N	Y
Malsite	`malsite_longitude`	Longitude plot of the Malsite URL/IP/Domain	Float	x.xxxx	N	N	Y
Malsite	`malsite_latitude`	Latitude plot of the Malsite URL/IP/Domain	Float	xx.xxx	N	N	Y
Malsite	`malsite_last_seen`	Malsite last seen timestamp	Integer	1486339200	N	N	Y
Malsite	`malsite_reputation`	Reputation score of Malsite IP/Domain/URL	Float	7.4	N	N	Y
Malsite	`malsite_id`	Malicious Site ID – Hash of threat match value	String	9228edb31a922c392ba3746	N	N	Y
Malsite	`severity_level_id`	If the Severity Level ID is 1, it means that URL / IP /Domain is detected from Internal threat feed and if Severity Level ID is 2, then it means the detection happened based on the OEM DB Malsite Category.	Integer	0, 1, 2, 3	N	N	Y
Malsite	`severity_level`	Severity level of the Malsite ( High / Med / Low)	String	low, medium, high	N	N	Y
Malsite	`threat_match_field`	Threat match field, either from domain or URL or IP.	String	domain, url, ip	Y	N	Y
Malsite	`threat_source_id`	Threat source id: 1 – NetskopeThreatIntel, 2 – OEM DB	Integer	1,2	Y	N	Y
Malware	`scan_time`	Time when the scan is done	LongInt	1474308875	Y	N	Y
Malware	`malware_id`	md5 hash of the malware name as provided by the scan engine	String	Any md5 hash string (as hexadecimal string)	Y	N	Y
Malware	`malware_type`	What type (virus, etc) of a threat is this?	String	Adware, Dialer, Malicious App, Spam, Phishing, Spyware, Virus, Heuristic, No Detection, Encrypted/Unscannable, Trojan, Error, Misleading Application	Y	N	Y
Malware	`detection_type`	Same as malware type. Duplicate.	String	virus, trojan	Y	N	Y
Malware	`malware_severity`	How severe is the threat posed by this malware	String	high, medium, low	Y	N	Y
Malware	`malware_name`	What is the detection name for this threat	String	Gen.Ransom.Encrypted.File.ns	Y	N	Y
Malware	`detection_engine`	Customer exposed detection engine name	String	Netskope AV, Netskope Threat Intel, Netskope Advanced Heursitics, Netskope Advanced Sandbox	Y	N	Y
Malware	`tss_mode`	Malware scanning mode, specifies whether it’s Real-time Protection or API Data Protection	String	Introspection, Inline	Y	N	Y
Malware	`malware_profile`	`tss_profile`: profile which user has selected. Data comes from WebUI. Its a json structure.	String	Default Malware Scan	Y	N	Y
Malware	`zip_password`	Zip the malacious file and put pwd to it and send it back to caller	String	netskope	Y	N	Y
Malware	`local_md5`	md5 hash of file generated by the Malware engine	String	3b30d5c68bfe	Y	N	Y
Malware	`local_sha256`	sha256 hash of file generated by the Malware engine	String	3b30d5c68bfe	Y	N	Y
Malware	`local_sha1`	sha1 hash of file generated by the Malware engine	String	3b30d5c68bfe	Y	N	Y
Compromised Credentials	`breach_id`	Breach ID for compromised credentials	String	95e2e98ac17cf08de4b82f94 356dc51e	N	N	Y
Compromised Credentials	`breach_date`	Breach date for compromised credentials	Integer	1524700800	N	N	Y
Compromised Credentials	`breach_score`	Breach score for compromised credentials	Integer	30, 100	N	N	Y
Compromised Credentials	`breach_target_references`	Breach target references for compromised credentials	String	forbes.com	N	N	Y
Compromised Credentials	`breach_media_references`	Media references of breach	String	http://news.something.com/8301- 1009_3-57618945-83/syrian- electronic-army-hacks-forbes-steals-user-data/	N	N	Y
IaaS CSA	`sa_profile_name`	CSA profile name	String	PCI-DSS v3.2.1 (Azure)	Y	N	Y
IaaS CSA	`sa_profile_id`	CSA profile ID	Integer	-2002000	Y	N	Y
IaaS CSA	`sa_rule_id`	CSA rule ID	Integer	-2002041	Y	N	Y
IaaS CSA	`sa_rule_name`	CSA rule name	String	PCI-AZR \| 5.1 Ensure that the endpoint protection for all Virtual Machines is installed	Y	N	Y
IaaS CSA	`sa_rule_severity`	Rule severity	String	Critical, High, Medium, Low	Y	N	Y
IaaS CSA	`account_id`	Account ID (usually is account number as provided by the cloud provider)	String	a776ab3b-0d9d-401e-a31d-2f478a4c	Y	N	Y
IaaS CSA	`account_name`	Account name – in case of AWS this is the instance name set by user. For others, account name is provided by the cloud provider.	String	iaas-azure-dev	Y	N	Y
IaaS CSA	`iaas_asset_tags`	List of tags associated with the asset for which alert is raised. Each tag is a key/value pair	Array of dictionary objects (name/value pairs)	[{“name”: “major environment”, “value”: “test”}, {“name”: “owner”, “value”: “abc” }]	Y	N	Y
IaaS CSA	`run_id`	Run ID	Integer	15	Y	N	N
IaaS CSA	`region_id`	Region ID (as provided by the cloud provider)	String	eastus2	Y	N	Y
IaaS CSA	`region_name`	Region Name (as provided by the cloud provider)	String	East US 2	Y	N	Y
IaaS CSA	`resource_category`	Category of resource as defined in DOM	String	Compute	Y	N	Y

Parameter Grouping

Parameter Name

Descriptions

Data Type

Example Responses

App Events

Page Events

Alerts

General

timestamp

Timestamp when the event/alert happened. Event timestamp in Unix epoch format.

Integer

1443811033

General

_insertion_epoch_timestamp

Insertion timestamp

Integer

1485025255

General

src_timezone

Source timezone. Shows the long format timezone designation.

String

America/Los_Angeles

General

dst_timezone

Destination timezone

String

America/New_York

General

type

Shows if it is an application event or a connection event. Application events are recorded to track user events inside a cloud app. Connection events shows the actual HTTP connection.

String

Value for Application Events: nspolicy

Value for Page Events: connection

Values for Alerts: nspolicy, connection, breach, anomaly, malsite

General

access_method

Cloud app traffic can be steered to the Netskope cloud using different deployment methods such as Client (Netskope Client), Secure Forwarder etc. Administrators can also upload firewall and/or proxy logs for log analytics. This field shows the actual access method that triggered the event.

For log uploads this shows the actual log type such as PAN, Websense, etc.

String

Client, Secure Forwarder, API Connector, Proxy Chaining, Reverse Proxy

General

traffic_type

Type of the traffic: CloudApp or Web. CloudApp indicates CASB and web indicates HTTP traffic. Web traffic is only captured for inline access method. It is currently not captured for Risk Insights.

String

CloudApp, Web

General

action

Action taken on the event for the policy

String

useralert, Detection, bypass, block, alert, restrictToView, disableDownload, legalHold, expireLink, restrictAccess, delete, quarantine

General

fromlogs

Shows if the event was generated from the Risk Insights log.

String

yes

General

user_generated

Tells whether it is user generated page event

Boolean

yes, no

General

tunnel_id

Shows the Client installation ID. Only available for the Client steering configuration.

String

c5b07447-e86e-4722-b59e-81144

General

request_id

Unique request ID for the event

Integer

1,590

General

transaction_id

Unique ID for a given request/response

String

1843244978932892112

General

connection_id

Each connection has a unique ID. Shows the ID for the connection event.

LongInt

117073088998365

General

conn_duration

Duration of the connection in milliseconds. Useful for querying long-lived sessions.

Integer

59000

General

conn_starttime

Connection start time

Float

1480330369

General

conn_endtime

Connection end time

Float

1480330428

General

latency_min

Min latency for a connection in milliseconds

Integer

General

latency_max

Max latency for a connection in milliseconds

Integer

651

General

latency_total

Total latency from proxy to app in milliseconds

Integer

3797

General

req_cnt

Total number of HTTP requests (equal to number of transaction events for this page event) sent from client to server over one underlying TCP connection.

Integer

General

resp_cnt

Total number of HTTP responses (equal to number of transaction events for this page event) from server to client

Integer

General

http_transaction_count

HTTP transaction count

Integer

300

General

numbytes

Total number of bytes that were transmitted for the connection – numbytes = client_bytes + server_bytes

Integer

18177

General

client_bytes

Total number of bytes uploaded from client to server

Integer

1093

General

server_bytes

Total number of downloaded from server to client.

Integer

17084

General

suppression_key

To limit the number of events. Example: Suppress block event for browse

String

2019-01-07_1135.zip

General

suppression_start_time

When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.

Integer

1443811033

General

suppression_end_time

When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.

Integer

1443811078

General

count

Number of raw log lines/events sessionized or suppressed during the suppressed interval.

Integer

General

bypass_traffic

Tells if traffic is bypassed by Netskope

Boolean

yes, no

General

ssl_decrypt_policy

Applicable to only bypass events. There are 2 ways to create rules for bypass:

Bypass due to Exception Configuration
Bypass due to SSL Decrypt Policy

The existing flag bypass_traffic only gives information that a flow has been bypassed, but does not tell exactly which policy was responsible for it. ssl_decrypt_policy field will provide this extra information. In addition, policy field will be also set for every Bypass event.

String

yes, no

General

dynamic_classification

URLs were categorized by NSURLC machine or not

String

yes, no

General

dst_geoip_src

Source from where the location of Destination IP was derived

Integer

General

src_geoip_src

Source from where the location of Source IP was derived

Integer

General

modified

Timestamp corresponding to the modification time of the entity (file, etc.)

DateTime

2017-01-17T08:56:05

Alert

alert

Indicates whether alert is generated or not.

Populated as yes for all alerts.

String

yes, no

Alert

alert_name

Name of the alert

String

proximity, rare_event, risky_country, user_shared_credentials,

data_exfiltration, mlad

Alert

alert_type

Type of the alert

String

Values for Alerts: watchlist, policy, DLP, Legal Hold, quarantine, Malware, malsite, anomaly, Compromised Credential, Security Assessment

Values for App Events: policy, DLP, quarantine, Legal Hold, Malware, Security Assessment, Remediation

Alert

acked

Whether user acknowledged the alert or not

Boolean

false, true

Alert

severity

Severity used by watchlist and malware alerts

String

low, medium, high, unknown, null

Alert

severity_id

Severity ID used by watchlist and malware alerts

Integer

1, 2, 3, null

Alert

policy_id

The Netskope internal ID for the policy created by an admin

Integer

1, 8

Alert

policy

Name of the policy configured by an admin

String

PCI Files in OneDrive

Alert

profile_emails

List of profile emails per policy

String

[“dlp_policy@netskope.com”]

Alert

justification_reason

Justification reason provided by user.

For following policies, justification events are raised. User is displayed a notification popup, user enters justification and can select to proceed or block:

useralert policy
dlp block policy
block policy with custom template which contains justification text box

String

Provided reason

Alert

justification_type

Type of justification provided by user when user bypasses the policy block

String

falsePositive, justification

Application

app

Specific cloud application used by the user (e.g. app = Dropbox).

String

Google Drive

Application

appcategory

Application Category as designated by Netskope

String

Collaboration, Customer Relationship Management, Cloud Storage, IaaS/PaaS

Application

ccl

Cloud Confidence Level. CCL measures the enterprise readiness of the cloud apps taking into consideration those apps security, auditability and business continuity.

Each app is assigned one of five cloud confidence levels: excellent, high, medium, low, or poor. Useful for querying if users are accessing a cloud app with a lower CCL.

String

excellent, high, medium, low, poor, unknown, not_defined

Application

site

For traffic_type = CloudApp, site = app and for traffic_type = Web, it will be the second level domain name + top-level domain name. For example, in “www.cnn.com”, it is “cnn.com”.

String

cnn.com

Application

url

URL of the application that the user visited as provided by the log or data plane traffic

String

www.evernote.com/shard/s2 31/notestore

Application

page

The URL of the originating page

String

www.google.co.in/search?q=

railway

Application

domain

Domain value. This will hold the host header value or SNI or extracted from absolute URI.

String

google.co.in

Application

sessionid

Populated by Risk Insights

Integer

34014529

Application

app_session_id

Unique App/Site Session ID for traffic_type = CloudApp and Web.

An app session starts when a user starts using a cloud app/site on and ends once they have been inactive for a certain period of time(15 mins). Use app_session_id to check all the user activities in a single app session. app_session_id is unique for a user, device, browser and domain.

String

1.42333E+14

Application

referer

Referer URL of the application(with http) that the user visited as provided by the log or data plane traffic

String

https://portal.office.com/Admi nPortal/Home

Application

managed_app

Whether or not the app in question is managed

Boolean

yes, no

Application

telemetry_app

Typically SaaS app web sites use web analytics code within the pages to gather analytic data.

When a SaaS app action or page is shown, there is subsequent traffic generated to tracking apps such as doubleclick.net, Optimizely, etc. These tracking apps are listed if applicable in the

Telemetry App field.

String

doubleclick, Amazon S3, google, Microsoft Office 365 Suite, Adswizz, fbcdn

Application

instance_id

Unique ID associated with an organization application instance

String

nammazone.com

Application

instance

Instance associated with an organization application instance

String

nammazone.com

Application

instance_name

Instance name associated with an organization application instance

String

netskope.com

Application

instance_type

Instance type

String

VirtualPrivateCloud, Server, Image, Document, Managed

Instance, LoadBalancer

Application

object

Name of the object which is being acted on. It could be a filename, folder name, report name, document name, etc.

String

Resume.doc

Application

object_id

Unique ID associated with an object

String

3214

Application

object_type

Type of the object which is being acted on. Object type could be a file, folder, report, document, message, etc.

String

File, User, Note

Application

from_object

Initial name of an object that has been renamed, copied or moved

String

test1

Application

to_object

Changed name of an object that has been renamed, copied, or moved

String

test2

Application

object_count

Displayed when the activity is Delete. Shows the number of objects being deleted

Integer

Application Specific

enterprise_id

EnterpriseID in case of Slack for Enterprise

String

E8D23NJ1H

Application Specific

enterprise

Enterprise name in case of Slack for Enterprise

String

Netskope enterprise

Application Specific

workspace_id

Workspace ID in case of Slack for Enterprise

String

TDFHG3CLF

Application Specific

workspace

Workspace name in case of Slack for Enterprise

String

Netskope workspace

Application Specific

team

Slack team name

String

Netskope team

Application Specific

channel

Channel of the user for slack and slack enterprise apps

String

channel1

Application Specific

sub_type

Workplace by Facebook post sub category (files, comments, status etc)

String

file, comment, post

Application Specific

violating_user

User who caused a vioaltion. Populated for Workplace by Facebook

String

example@netskope.com

Application Specific

violating_user_type

Category of the user who caused a violation. Populated for Workplace by Facebook.

String

Internal, External

Application Specific

logintype

Salesforce login type

String

Remote Access 2.0, Other Apex API, Remote Access Client

Application Specific

loginurl

Salesforce login URL

String

my.salesforce.com

Application Specific

new_value

New value for a given file for salesforce.com

String

2019-01-18 3:33:58

Application Specific

old_value

Old value for a given file for salesforce.com

String

2019-01-17 3:33:58

Application Specific

scopes

List of permissions for google apps

String

[“https://www.googleapis.com

/auth/cloud-platform”, “https://www.googleapis.com/ auth/userinfo.email”]

Application Specific

session_id

Session ID for Dropbox application

Integer

1.77573E+14

Application Specific

user_role

Roles such as admin, owner etc for Box

String

Admin, coadmin, user

Application Specific

role

Roles for Box

String

Editor, Previewer, Previewer Uploader, Uploader, Viewer, Viewer Uploader, Owner, Co- owner

Activity

activity

Description of the user performed activity

String

Download, Invite, Issue, Join, Login Attempt, Login Failed, Login Successful, Logout, Mark, Markup, Move, Upload, View, View All

Activity

activity_type

Displayed when only admins can perform the activity in question

String

Admin

Activity

act_user

User doing an activity

String

user@netskope.com

Activity

activity_status

Displayed when the user is denied access while performing some activity

String

Access Denied

Activity

Url2Activity

Populated if the activity from the URL matches certain activities. This field applies to Risk Insights only.

String

Yes

Activity

ns_activity

Maps app activity to Netskope standard activity.

String

Download, Upload, view, unlock

Activity

audit_category

The subcategories in an application such as IAM, EC in AWS, login, token, file, etc., in case of Google.

String

IAM, Lambda, S3, access, Compute Engine, Elasticloadbalancing, EC2, event_change, acl_change

Activity

audit_type

The sub category in audit according to SaaS / IaaS apps

String

download, edit, create, view, HeadBucket

User

userkey

User ID or email

String

user@netskope.com

User

user_id

User email

String

user@netskope.com

User

user

User email

String

user@netskope.com

User

user_name

Name of user

String

TestUser

User

ur_normalized

All lower case user email

String

user@netskope.com

User

user_normalized

All lower case user email

String

user@netskope.com

User

userip

IP address of User

String

xxx.xxx.xxx.xx

User

useragent

Browser HTTP user agent header

String

Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0)

Gecko/20100101

Firefox/50.0

User

user_category

Type of user in an enterprise – external / internal

String

Internal

User

organization_unit

Org Units for which the event correlates to. This ties to user information extracted from Active Directory using the Directory Importer/AD Connector application.

String

Maximum of 5 levels: “OU1/OU2/OU3/OU4/OU5”

User

org

Search for events from a specific organization. Organization name is derived from the user ID.

String

sampleorganization.org

User

os

Operating system of the host who generated the event.

String

Yosemite

User

os_version

OS version of the host

String

Windows 7

User

browser

Shows the actual browser from where the cloud app was accessed.

String

BlackBerry, Chrome, Firefox, iCab, Mobile, MSIE, Native, Opera, RockMelt, Safari, Skyfire, Tencent, Thunderbird

User

browser_version

Browser version

String

User

browser_session_id

Browser session ID. If there is an idle timeout of 15 minutes, it will timeout the session.

LongInt

75256867583232

User

device

Device type from where the user accessed the cloud app. It could be Macintosh Windows device, iPad etc.

String

Android Device, iOS Device. iPad, iPhone, Linux Device, Mac Device, Windows Device, Other Device

User

device_classification

Designation of device as determined by the Netskope Client as to whether the device is managed or not.

String

managed, not configured, unknown, unmanaged

User

hostname

Host name

String

example’s Macbook Pro

User

nsdeviceuid

Device identifiers on macOS and Windows

String

zndbgI=

User

managementID

Management ID

String

FFD2E8A

Source

srcip

IP address of source/user

String

xxx.xxx.xxx.xx

Source

src_location

User’s city as determined by the Maxmind or IP2Location Geodatabase

String

San Jose

Source

src_region

Source state or region as determined by the Maxmind or IP2Location Geodatabase

String

California

Source

src_latitude

Latitude of the user as determined by the Maxmind or IP2Location Geodatabase

Integer

[xx.xxxx]

Source

src_longitude

Longitude of the user as determined by the Maxmind or IP2Location Geodatabase

Integer

[-xxx.xxx]

Source

src_country

User’s country’s two-letter Country Code as determined by the Maxmind or IP2Location Geodatabase

String

Source

src_zipcode

Source zip code as determined by the Maxmind or IP2Location Geodatabase

String

95134

Destination

dstip

IP address where the destination app is hosted

String

xxx.xxx.xxx.xx

Destination

dst_location

Application’s city as determined by the Maxmind or IP2Location Geodatabase

String

Mountain View

Destination

dst_region

Application’s state or region as determined by the Maxmind or IP2Location Geodatabase

String

California

Destination

dst_latitude

Latitude of the Application as determined by the Maxmind or IP2Location Geodatabase

Integer

[xx.xxxx]

Destination

dst_longitude

Longitude of the Application as determined by the Maxmind or IP2Location Geodatabase

Integer

[-xxx.xxx]

Destination

dst_country

Application’s two-letter country code as determined by the Maxmind or IP2Location Geodatabase

String

Destination

dst_zipcode

Application’s zip code as determined by the Maxmind or IP2Location Geodatabase

String

94043

Destination

dstport

Destination port

Integer

443, 80 (1-65535)

Destination

dsthost

Destination host

String

mail.yahoo.com

Introspection

retro_scan_name

Retro scan name

String

Retro_Scan_box_netskope.com_20181213_1616

Introspection

scan_type

Generated during retroactive scan or new ongoing activity

String

Ongoing, ongoing, retroactive, Retroactive

File

file_id

Unique identifier of the file

String

0B3jELp0mSNw2dTZDNUhpUGpjUGgxQUY5OUZI

File

filename

Name of the file

String

PandasDFTests.py

File

title

Title of the file

String

PandasDFTests.py

File

mime_type

MIME type of the file

String

application/pdf

File

data_type

Content type of upload/download

String

application/xml

File

md5

md5 of the file

String

295a6f156624f73c31a9a670

d9a41914

File

file_size

Size of the file in bytes

Integer

22854

File

file_type

File type

String

text/plain, application/pdf, etc.

File

file_lang

Language of the file

String

SWEDISH

File

path_id

Path ID of the file in the application

Integer

3.94218E+11

File

file_path

Path of the file in the application

String

/sample/file.pdf

File

owner

Owner of the file

String

example@netskope.com

File

original_file_path

If the file is moved, then keep original path of the file in this field

String

29208ee0-021e-4cb2-87b4-c9303880

File

from_user

Email address used to login to the SAAS app

String

example@netskope.com

File

from_user_category

Type of from_user

String

Internal, External

File

to_user

Used when a file is moved from user A to user B. Shows the email address of user B

String

example@netskope.com

File

to_user_category

Type of user to which move is done

String

Internal, External

File

shared_with

Array of emails with whom a document is shared with

String

[aaaa@netskope.com,nnnn@netskope.com,dddd@netskope.com]

File

shared

If the file is shared or not

Boolean

true, false

File

shared_type

Shared Type

String

internal, external, private, enterprise

File

shared_domains

List of domains of users the document is shared with

String

[netskope.com, yahoo.com]

File

exposure

Exposure of a document

String

private, public, public_on_web, enterprise, external, internal, anyone_with_link

File

attachment

File name

String

image001.png

File

encrypt_failure

Reason of failure while encrypting

String

Failed getting encryption Key

File

log_file_name

Log file name for Risk Insights

String

20190205T0917_0.csv.gz

File

file_passwd_protected

Tells if the file is password protected

Boolean

TRUE

File

web_url

File preview URL

String

https://drive.google.com/open?id=1234

File

external_collaborator_count

Count of external collaborators on a file/folder. Supported for some apps.

Integer

File

internal_collaborator_count

Count of internal collaborators on a file/folder. Supported for some apps.

Integer

File

total_collaborator_count

Count of collaborators on a file/folder. Supported for some apps.

Integer

DLP

dlp_incident_id

Incident ID associated with sub-file. In the case of main file, this is same as the parent incident ID.

LongInt

146831431522000

DLP

dlp_parent_id

Incident ID associated with main container (or non-container) file that was scanned

LongInt

146831431522000

DLP

dlp_file

File/Object name extracted from the file/object

String

Credit Report.pdf

DLP

dlp_profile

DLP profile name

String

DLP-PCI

DLP

dlp_rule

DLP rule that triggered

String

Name-Credit Card (CC)

DLP

dlp_rule_count

Count of rule hits

Integer

DLP

dlp_rule_severity

Severity of rule

String

Low, Medium, High, Critical

DLP

dlp_fingerprint_classification

Fingerprint classification

String

Senstive Customer Information, PII

DLP

dlp_fingerprint_match

Fingerprint classification match file name

String

Top_100_Existing_Accounts_11_1_18.xlsx

DLP

dlp_fingerprint_score

Fingerprint classification score

Integer

0-100

DLP

dlp_rule_score

DLP rule score for weighted dictionaries

Integer

DLP

dlp_is_unique_count

True or false depending upon if rule is unique counted per rule data

Boolean

true, false

DLP

dlp_unique_count

Integer value of number of unique matches seen per rule data. Only present if rule is uniquely counted.

Integer

Quarantine

quarantine_file_id

File ID of the quarantined file

String

435bd35a-e021-4a2c-bc41-ba281f91

Quarantine

quarantine_profile_id

Quarantine profile ID

Integer

Quarantine

quarantine_profile

Quarantine profile name of policy for quarantine action

String

Quarantine Data – OneDrive

Quarantine

quarantine_failure

Reason of failure

String

Quarantine failed; file transfer failure

Quarantine

quarantine_action_reason

Reason for the action taken for quarantine

String

Previously quarantined file still blocked because admin decision is pending

Quarantine

q_admin

Quarantine profile custodian email/name

String

example@netskope.com

Quarantine

q_app

Quarantine app name

String

Box

Quarantine

q_instance

Quarantine instance name

String

Box Production

Quarantine

q_original_filename

Original file name which got quarantined

String

Sensitive File

Quarantine

q_original_filepath

Original file path which got quarantined

String

All/Folder1/Folder2

Quarantine

q_original_shared

Original file shared user details

String

Private

Quarantine

q_original_version

Original version of file which got quarantined

String

Quarantine

quarantine_file_name

File name of the quarantine file

String

sensitivefile.txt

Legal Hold

legal_hold_profile_name

Legal hold profile name

String

Legal hold Test Profile

Legal Hold

lh_custodian_email

Custodian email of legal hold profile

String

example@netskope.com

Legal Hold

lh_custodian_name

Custodian name of legal hold profile

String

Kelly Oar

Legal Hold

lh_dest_app

Destination appname of legalhold action

String

Box

Legal Hold

lh_dest_instance

Destination instance of legal hold action

String

Box Production

Legal Hold

lh_fileid

File ID of legal hold file

String

3.97035E+11

Legal Hold

lh_filename

File name of legal hold file

String

Sensitive file_v1_2016-04-2707-00-15(UTC)

Legal Hold

lh_filepath

File path of legal hold file

String

All/Folder1/Folder2

Legal Hold

lh_original_filename

Original filename of legal hold file

String

Sensitive File

Legal Hold

lh_shared

Shared type of legal hold file

String

Internal

Legal Hold

lh_shared_with

User shared with the legal hold file

String

[“example1@netskope.com”, “example2@netskope.com”]

Legal Hold

lh_version

File version of original file

String

Anomaly

orig_ty

Event Type of original event

String

nspolicy, connection

Anomaly

last_timestamp

Last timestamp (timestamp in the first/older event). Applies to only proximity anomaly alert.

LongInt

1549296669

Anomaly

last_app

Last application (app in the first/older event). Applies to only proximity anomaly alert.

String

Facebook

Anomaly

last_device

Last device name (Device Name in the first/older event). Applies to only proximity anomaly alert.

String

Windows Device

Anomaly

last_country

Last location (Country). Applies to only proximity anomaly alert.

String

Anomaly

last_location

Last location (City). Applies to only proximity anomaly alert.

String

Chicago

Anomaly

last_region

Applies to only proximity anomaly alert.

String

Pennsylvania

Anomaly

download_app

Applicable to only data exfiltration. Download App (App in the download event).

String

Google Gmail

Anomaly

shared_credential_user

Applicable to only shared credentials.

User with whom the credentials are shared with.

String

Michael Sam

Anomaly

threshold_time

Applicable to: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type. Threshold Time

LongInt

Default time (86400 Seconds)

Anomaly

bin_timestamp

Applicable to only: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/Download/Delete) and Failed Login Anomaly type.

Bin TimeStamp (is a window used that is used for certain types of anomalies – for breaking into several windows per day/hour).

LongInt

1549411200

Anomaly

threshold

Threshold (Count at which the anomaly should trigger). Applicable to Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type

Integer

205

Anomaly, MLAD

event_type

Anomaly type

String

App Events: Info, error Alerts: proximity, rare_event, risky_country, user_shared_credentials, data_exfiltration, bulk_upload, bulk_download, mlad

Anomaly, MLAD

profile_id

Anomaly profile ID

String

NS_101 which means proximity alert

NS_103, NS_102, NS_307, NS_306, NS_304, NS_303, NS_305, NS_301, NS_403, NS_401

Anomoly, MLAD

risk_level_id

This field is set by both role-based access (RBA) and MLAD

Integer

1,2,0

Anomoly, MLAD

risk_level

Corresponding field to risk_level_id. Name

String

low, med, high

Malsite

malicious

Only exists if some HTTP transaction belonging to the page event resulted in a malsite alert.

Boolean

TRUE

Malsite

malsite_active

Since how many days malsite is Active

Integer

Malsite

malsite_as_number

Malsite ASN Number

String

AS35838 CCANet Limited

Malsite

malsite_confidence

Malsite confidence score

Integer

100

Malsite

malsite_consecutive

How many times that malsite is seen

Integer

Malsite

malsite_category

Category of malsite [ Phishing / Botnet / Malicous URL, etc. ]

String

[“Malcious Site”]

Malsite

malsite_country

Malsite country

String

Malsite

malsite_region

Region of the malsite URL/IP/Domain

String

Texas

Malsite

malsite_city

Malsite city

String

Los Angeles

Malsite

malsite_dns_server

DNS server of the malsite URL/Domain/IP

String

xxx.xxx.com

Malsite

malsite_first_seen

Malsite first seen timestamp

Integer

1485302400

Malsite

malsite_hostility

Malsite hostility score

Integer

Malsite

malsite_ip_host

Malsite IP

String

xxx.xxx.x.xxx

Malsite

malsite_isp

Malsite ISP info

String

CCANET Limited

Malsite

malsite_longitude

Longitude plot of the Malsite URL/IP/Domain

Float

x.xxxx

Malsite

malsite_latitude

Latitude plot of the Malsite URL/IP/Domain

Float

xx.xxx

Malsite

malsite_last_seen

Malsite last seen timestamp

Integer

1486339200

Malsite

malsite_reputation

Reputation score of Malsite IP/Domain/URL

Float

7.4

Malsite

malsite_id

Malicious Site ID – Hash of threat match value

String

9228edb31a922c392ba3746

Malsite

severity_level_id

If the Severity Level ID is 1, it means that URL / IP /Domain is detected from Internal threat feed and if Severity Level ID is 2, then it means the detection happened based on the OEM DB Malsite Category.

Integer

0, 1, 2, 3

Malsite

severity_level

Severity level of the Malsite ( High / Med / Low)

String

low, medium, high

Malsite

threat_match_field

Threat match field, either from domain or URL or IP.

String

domain, url, ip

Malsite

threat_source_id

Threat source id: 1 – NetskopeThreatIntel, 2 – OEM DB

Integer

1,2

Malware

scan_time

Time when the scan is done

LongInt

1474308875

Malware

malware_id

md5 hash of the malware name as provided by the scan engine

String

Any md5 hash string (as hexadecimal string)

Malware

malware_type

What type (virus, etc) of a threat is this?

String

Adware, Dialer, Malicious App, Spam, Phishing, Spyware, Virus, Heuristic, No Detection, Encrypted/Unscannable, Trojan, Error, Misleading Application

Malware

detection_type

Same as malware type. Duplicate.

String

virus, trojan

Malware

malware_severity

How severe is the threat posed by this malware

String

high, medium, low

Malware

malware_name

What is the detection name for this threat

String

Gen.Ransom.Encrypted.File.ns

Malware

detection_engine

Customer exposed detection engine name

String

Netskope AV, Netskope Threat Intel, Netskope Advanced Heursitics, Netskope Advanced Sandbox

Malware

tss_mode

Malware scanning mode, specifies whether it’s Real-time Protection or API Data Protection

String

Introspection, Inline

Malware

malware_profile

tss_profile: profile which user has selected. Data comes from WebUI. Its a json structure.

String

Default Malware Scan

Malware

zip_password

Zip the malacious file and put pwd to it and send it back to caller

String

netskope

Malware

local_md5

md5 hash of file generated by the Malware engine

String

3b30d5c68bfe

Malware

local_sha256

sha256 hash of file generated by the Malware engine

String

3b30d5c68bfe

Malware

local_sha1

sha1 hash of file generated by the Malware engine

String

3b30d5c68bfe

Compromised Credentials

breach_id

Breach ID for compromised credentials

String

95e2e98ac17cf08de4b82f94 356dc51e

Compromised Credentials

breach_date

Breach date for compromised credentials

Integer

1524700800

Compromised Credentials

breach_score

Breach score for compromised credentials

Integer

30, 100

Compromised Credentials

breach_target_references

Breach target references for compromised credentials

String

forbes.com

Compromised Credentials

breach_media_references

Media references of breach

String

http://news.something.com/8301- 1009_3-57618945-83/syrian- electronic-army-hacks-forbes-steals-user-data/

IaaS CSA

sa_profile_name

CSA profile name

String

PCI-DSS v3.2.1 (Azure)

IaaS CSA

sa_profile_id

CSA profile ID

Integer

-2002000

IaaS CSA

sa_rule_id

CSA rule ID

Integer

-2002041

IaaS CSA

sa_rule_name

CSA rule name

String

PCI-AZR | 5.1 Ensure that the endpoint protection for all Virtual Machines is installed

IaaS CSA

sa_rule_severity

Rule severity

String

Critical, High, Medium, Low

IaaS CSA

account_id

Account ID (usually is account number as provided by the cloud provider)

String

a776ab3b-0d9d-401e-a31d-2f478a4c

IaaS CSA

account_name

Account name – in case of AWS this is the instance name set by user. For others, account name is provided by the cloud provider.

String

iaas-azure-dev

IaaS CSA

iaas_asset_tags

List of tags associated with the asset for which alert is raised. Each tag is a key/value pair

Array of dictionary objects (name/value pairs)

[{“name”: “major environment”, “value”: “test”}, {“name”: “owner”, “value”: “abc” }]

IaaS CSA

run_id

Run ID

Integer

IaaS CSA

region_id

Region ID (as provided by the cloud provider)

String

eastus2

IaaS CSA

region_name

Region Name (as provided by the cloud provider)

String

East US 2

IaaS CSA

resource_category

Category of resource as defined in DOM

String

Compute