Getting Errors while Configuring Account/Input
Sometimes due to issue with the token there can be error while configuring the Account/Input.
Getting a 401 Error:
API returns status code 401 when the provided token is invalid or does not exists. Please verify the provided token and try again.
Getting a 403 Error:
API returns status code 403 when the provided token does not have the permission for the specific endpoint. Please verify the endpoint permissions given from the Netskope Tenant UI and try again.
CURL commands:
To verify the token and its permissions from the backend, you can use one of these CURL commands:
- For Application Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/application?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Audit Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/audit?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Endpoint Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/endpoint?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Infrastructure Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/infrastructure?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Incident Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/incident?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Network Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/network?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Connection/Page Events:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/page?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For All Alerts:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/events/alert?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For other Alerts type:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/dataexport/alerts/<ALERT_TYPE>?index=testing10982746&operation=<TIMESTAMP>' --header 'Netskope-Api-Token: <V2_TOKEN>'
- For Webtransaction:
curl --request GET 'https://<TENANT_NAME>/api/v2/events/token/transaction_events?index=testing10982746&' --header 'Netskope-Api-Token: <V2_TOKEN>'
Facing Delays in Connection/Page Events
- Delay in Connection/Page Events can be due the conn_duration (connection duration) of that connection event.
- To confirm this is not the case for delay, execute the following SPL Query:
index=<INDEX_NAME> sourcetype="netskope:connection"
| eval lag = _indextime - _time - conn_duration
| where lag > 3600
| eval indextime = _indextime
| eval timestamp = strftime(timestamp, "%Y-%m-%d %H:%M:%S %Z")
| eval indextime = strftime(indextime, "%Y-%m-%d %H:%M:%S %Z")
| eval conn_endtime = strftime(conn_endtime, "%Y-%m-%d %H:%M:%S %Z")
| table internal_id, timestamp, conn_duration, conn_endtime, indextime, lag - If there is result of this query, then there is delay of more than 1 hour for those events. Please send the output of this query to Netskope Support for further analysis.