Netskope Help

Transaction Event Fields

The following tables list the transaction event type, field, description, and example.

Date / Time Transaction Events

Field

Description

Example

date

Date of generation, YY-MM-DD format.

08/07/19

time

Time of generation in HH:MM-SEC format in GMT.

01:02-39

time-taken

Delta (integer value in ms) when the request processing started and the full response was received.

589

Client Connector Device Information Transaction Events

Field

Description

Example

x-c-os

Operating system of the client.

Windows 10

x-c-browser

Client's browser.

Firefox

x-c-browser-version

Client's browser version.

50

x-c-device

Client's device type.

Windows device

x-cs-site

Destination site.

Google Maps

x-cs-timestamp

Date of the request as epoch time.

1480330369

x-cs-page-id

Identifier associated with the page event object.

1170730000000000000

x-cs-userip

The client IP address.

199.188.180.55

Client Transaction Events

Field

Description

Example

cs-bytes

Bytes received from the client.

1093

bytes

Sum of client bytes plus server bytes.

18177

Cloud Application Transaction Events

Field

Description

Example

x-cs-app

Cloud application name.

Dropbox

x-category

Primary category name applicable for the url in this transaction.

"Cloud Storage"

x-other-category

Secondary categories applicable for the url in this transaction.

"News & Media; Entertainment"

x-cs-traffic-type

Type of traffic could be "Web" or "CloudApp".

Web

Geolocation Transaction Events

Field

Description

Example

x-s-country

Destination country

United States

x-s-latitude

Destination latitude

37.4192009

x-s-longitude

Destination longitude

-122.0574036

x-s-location

Destination location (e.g. city)

Mountain View

x-s-region

Destination region (e.g. state)

California

x-s-zipcode

Destination zip code

94043

x-c-country

Country of the client (user)

United States

x-c-latitude

Latitude of the client

37.3394

x-c-longitude

Longitude of the client

-121.895

x-c-location

Location of the client

Menlo Park

x-c-region

Region of the client

California

x-c-zipcode

Zip code of the client

94025

HTTP Transaction Events

Field

Description

Example

cs-method

The HTTP method (e.g. GET, POST).

POST

cs-uri-scheme

The protocol used.

https

cs-uri-query

The query string portion of the HTTP request.

q=a&b=c

cs-user-agent

The user-agent header in the HTTP request.

Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0

cs-content-type

The content-type header in the HTTP request.

application/json

sc-status

The HTTP status code received from the server.

200

sc-content-type

The content-type header from the response.

text/html

cs-dns

The destination domain requested.

google.co.in

cs-host

The value in the host header from the request.

google.co.in

cs-uri

Path information plus query string.

/home.html?key=123

cs-uri-port

Port specified in the request header.

443

cs-referer

The value of the referrer header.

https://www.google.com

x-cs-session-id

A session for the current user which consists of: user, device, OS, app, browser.

50530900000000000

x-request-id

Request ID needed to correlate DLP and TSS incidents with transaction events.

2234064361201696768

x-transaction-id

Transaction ID needed to correlate application events with transaction events.

1821255295454864980

x-cs-domain-fronted-sni

The SNI of the SSL connection where Netskope detected domain fronting. In other words, the SNI and Host header were mismatched. SSL inspection must be enabled to see this field.

google.co.in

x-cs-sni

The hostname that the client is attempting to connect to using the SNI extension in the TLS handshake.

google.co.in

Network Transaction Events

Field

Description

Example

c-ip

Client IP as seen by the Netskope proxy. This will be the machine IP if available, IPv4 address.

70.42.129.126

s-ip

The server IPv4 address.

216.58.193.67

x-cs-tunnel-id

VPN tunnel ID

998a4499-a5a6-4a55-b243-b67ce89dd870

Server Transaction Events

Field

Description

Example

sc-bytes

Bytes received from the server.

17084

x-type

The type of log message, which can be "http_transaction" or "WebSocket".

http_transaction

x-server-ssl-err

Description of SSL error between proxy and content servers.

Handshake error (error:141A318A:SSL routines: tls_process_ske_dhe:dh key too small) Blocked by SSL_HANDSHAKE_ERROR

x-client-ssl-err

Description of SSL error between client (browser) and proxy.

Handshake error (error:1417A0C1:SSL routines: tls_post_process_client_hello:no shared cipher)

Note

When parsing an HTTP Upgrade response, Netskope uses the Upgrade header to determine if the traffic is WebSocket.

Steering Transaction Event

Field

Description

Example

x-access-method

Steering method used to access the Netskope cloud.

Client

User Information Transaction Event

Field

Description

Example

cs-username

The client's username.

Bill@companyname.com