Netskope Log Streaming supports sending log files to Elastic. The first step is to set up your log stream. refer to Log Streaming Configuration. Ensure that compression is set to GZIP when configuring the stream as other compression types are not supported.
Collect Data from AWS
Prerequisite is you already have an AWS S3 bucket set up. The next step is to configure your AWS S3 bucket with Netskope to enable log streaming. Refer to follow Stream Logs to Amazon S3
Collect Data from Azure Blob Storage
- If you already have an Azure storage container set up, configure it with Netskope via log streaming.
- Enable Netskope log streaming, refer to Stream Logs to Azure Blob.
- Configure the integration using either Service Account Credentials or Microsoft Entra ID RBAC with OAuth2 options. For OAuth2 (Entra ID RBAC), you will need the Client ID, Client Secret, and Tenant ID. For Service Account Credentials, you will need either the Service Account Key or the URI to access the data.
- How to setup the
auth.oauth2credentials can be found in the Azure documentation here. - For more details about the Azure Blob Storage input settings, refer to the Filebeat documentation.
The service principal must be granted the appropriate permissions to read blobs. Ensure that the necessary role assignments are in place for the service principal to access the storage resources. For more information, refer to the Azure Role-Based Access Control (RBAC) documentation.
We recommend assigning either the Storage Blob Data Reader or Storage Blob Data Owner role. The Storage Blob Data Reader role provides read-only access to blob data and is aligned with the principle of least privilege, making it suitable for most use cases. The Storage Blob Data Owner role grants full administrative access — including read, write, and delete permissions — and should be used only when such elevated access is explicitly required.
We recommend assigning either the Storage Blob Data Reader or Storage Blob Data Owner role. The Storage Blob Data Reader role provides read-only access to blob data and is aligned with the principle of least privilege, making it suitable for most use cases. The Storage Blob Data Owner role grants full administrative access — including read, write, and delete permissions — and should be used only when such elevated access is explicitly required.
Collect Data from a GCS Bucket
- If you already have a GCS bucket setup, configure it with Netskope via log streaming.
- Enable the Netskope log streaming, refer to Stream Logs to GCP Cloud Storage.
- Configure the integration with your GCS project ID, Bucket name, and Service Account Key/Service Account Credentials File.
For more details about the GCS input settings, refer to the Filebeat documentation.
GCS Credentials Key File
Once you have added a key to GCP service account, you will get a JSON key file that can only be downloaded once.
To create a GCS bucket:
- Make sure you have a service account available, if not follow the steps below:
- Navigate to APIs & Services > Credentials
- Click Create credentials > Service account
- Once the service account is created, navigate to the Keys section and attach/generate your service account key.
- Make sure to download the JSON key file once prompted.
- Use this JSON key file either inline (JSON string object), or by specifying the path to the file on the host machine, where the agent is running.
A sample JSON Credentials file looks as follows:
{
"type": "dummy_service_account",
"project_id": "dummy-project",
"private_key_id": "dummy-private-key-id",
"private_key": "-----BEGIN PRIVATE KEY-----\nDummyPrivateKey\n-----END PRIVATE KEY-----\n",
"client_email": "dummy-service-account@example.com",
"client_id": "12345678901234567890",
"auth_uri": "https://example.com",
"token_uri": "https://example.com",
"auth_provider_x509_cert_url": "https://example.com",
"client_x509_cert_url": "https://example.com",
"universe_domain": "example.com"
}