Data Lineage builds its graph from activity that other Netskope services already capture. This page lists what each source contributes, so you can tell what a graph is built from and what enabling an additional source would add.
Data Lineage draws on two sources:
-
Real-time Inline Protection
-
CASB API Data Protection
-
Endpoint DLP
Each sees a different part of a file’s journey, and they overlap deliberately. A file downloaded from a managed cloud application, edited or rename locally and copied to a USB drive is only fully traceable when inline and endpoint are both in place.
Real-time Inline Protection Activity
Real-time Inline Protection coverage comes from traffic steered to Netskope, whether through the Netskope Client, IPSec, GRE, an explicit or local proxy, a mobile profile, or reverse proxy. It’s the broadest source; it sees activity in any application a user reaches through the browser, including applications you have not sanctioned and do not manage.
Activities captured inline include:
-
Create
-
Edit
-
Upload
-
Download
-
Copy
-
Move
-
Rename
-
Share
-
Send (webmail attachments in Gmail and Outlook)
Inline is the only source that sees unsanctioned and personal-instance destinations, which makes it the primary source for exfiltration paths.
CASB API Data Protection Activity
API Data Protection coverage comes from Netskope connecting directly to a sanctioned cloud application and reading activity from it. It sees things that never cross the network: a file shared from inside the application, an edit made in the web editor, a file moved between folders by another user. Both Next Generation API Data Protection and classic API-enabled Protection connectors feed Data Lineage.
Activities captured through API Date Protection include:
-
Create
-
Edit
-
Upload
-
Download
-
Copy
-
Move
-
Rename
-
Share
-
Invite (shown as Share)
API Date Protection also contributes scan results for files that existed before the connector was enabled, so those files have a starting point in the graph. It’s also the only source for applications that use certificate pinning in their desktop clients, where inline inspection is not possible.
Endpoint DLP Activity
Endpoint DLP coverage comes from the Netskope Client on managed Windows devices and closes the gap between a file arriving on a laptop and leaving it again. Without it, a file that is downloaded, renamed, and uploaded looks like two unrelated files.
Endpoint activity requires Endpoint DLP enabled for your tenant and user devices. Local file-system activity additionally requires enabling Generate Endpoint DLP events for Data Lineage in the client configuration.
Activity that leaves the device (reported with Endpoint DLP):
| Activity | User Action |
|---|---|
| Copy | Copied a file to a USB drive or network share |
| Upload | Uploaded a file through a web browser |
| Printed a document | |
| Bluetooth Fire Transfer | Sent a file over Bluetooth |
| Download | Downloaded a file through a web browser |
Local file-system activity (requires the Data Lineage client setting):
| Activity | User Action |
|---|---|
| Create | Created a new local file |
| Edit | Edited and saved a local file |
| Rename | Renamed a file within the same folder |
| Move | Moved a file to a different local folder |
| Copy | Copied a file within the device |
| Delete | Deleted a file, including to the Recycle Bin |
Local file system Endpoint activity appears only in Data Lineage. It is not shown in Endpoint DLP event logs. How endpoint activity appears in a graph depends on whether it produced a new copy of the file. Create, Copy, Upload, and Download produce a new node, because a new instance of the file now exists somewhere. Edit, Rename, Move, and Delete act on the file in place, so they appear in the timeline for the existing node rather than adding a new one.
Print is linked by filename only. Printed output has no content hash that corresponds to the source file, so Data Lineage connects a Print to its source by name and does not use hash matching for it.
What Data Lineage Treats as a File
Data Lineage tracks file objects: documents, spreadsheets, presentations, PDFs, images, media, archives, and mail attachments. Chat messages, calendar entries, database records, and other non-file objects are outside scope.
Activity Coverage Varies by Application
Not every application reports every activity, and some report an activity under the wrong name. A few patterns are worth knowing. Some applications report a Copy as an Edit or a Create, and a Move as a Rename. Data Lineage corrects this for applications where the behavior is known and consistent, including OneDrive, SharePoint, Google Drive, Box, Dropbox, Gmail, and Outlook.
Some applications report a Share without enough file information to attach it to the right file, so the share appears without a connection to its file.
Desktop clients that use certificate pinning, including the Google Drive and Dropbox desktop applications, cannot be inspected inline. Activity through those clients is visible only through API Data Protection or Endpoint DLP.
Applications that serve files from the browser cache, such as Figma, may report a download without a usable filename. Attachments sent through the SMTP proxy or a desktop Outlook client are not currently traceable.