View Security Assessment Violations - Netskope Technical Documentation

Use this endpoint to get the security assessment violations from the latest scan or as a snapshot of time. This endpoint also replicates the input and output shown at Cloud Infrastructure > Compliance > Raw Findings.

SSPM V1 is deprecated and REST API v1 endpoint is no longer supported for SSPM, instead use the REST API v2 endpoint. Log in to your tenant, go to Settings > Tools > REST API v2, and click API Documentation. Navigate to the SPM section to find endpoint details.

Request Endpoint

https://<tenant-URL>/api/v1/security_assessment

Valid parameters are:

Key	Value	Description
`account_id`	URL-encoded string	The IaaS platform provider account ID.
`account_name`	URL-encoded string	The IaaS platform provider account name.
`cloud_provider`	`azure \| aws \| googlecloud`	The IaaS platform provider.
`policy_name`	URL-encoded string	The Security Assessment policy name.
`profile_name`	URL-encoded string	The Security Assessment profile name.
`rule_name`	URL-encoded string	The Security Assessment rule name.
`resource_category`	URL-encoded string	The asset category set by Netskope per account resource.
`resource_id`	URL-encoded string	The asset identifier created by the IaaS platform provider.
`resource_name`	URL-encoded string	The IaaS instance name.
`resource_type`	URL-encoded string	The resource type set by Netskope per account resource.
`tag_name`	URL-encoded string	The tag name set in the Iaas platform provider account resource. Must also supply tag value.
`tag_value`	URL-encoded string	The tag value set in the Iaas platform provider account resource. Must also supply tag name.
`remediated_by`	`AutoRemediation \| OnDemandRemediation`	How the policy violation was remediated.
`last_remediation_status`	`None \| Started \| Completed \| Errored`	Last remediation status. `None` means not any the other three options.
`as_of`	Integer	Epoch time of results at that time. Default is the time of the request when not supplied, and is GMT time.
`severity`	`Critical \| High \| Medium \| Low`	The Security Assessment rule severity.
`limit`	Positive integer less than 10000	Required. REST API responses can return up to 10000 events in a single response. You can use pagination to retrieve more results.
`skip`	Positive integer	Skip over some of the events (useful for pagination in combination with limit).
`status`	`Passed \| Failed`	The Security Assessment status.
`muted`	`Yes \| No`	Returns either muted or unmuted findings.
`compliance_standard`	URL-encoded string	The name of the compliance standard, like CIS-AWSFND-1.2.0, NIST-CSF, etc.
`region`	For Azure, some possible values are: `all` `global` `eastus` `northcentralus` `westus` `centralindia` `centralus` `australiacentral` For AWS, possible values are: `global` `ap-south-1` `ap-northeast-2` `ap-southeast-1` `ap-southeast-2` `ap-northeast-1` `ca-central-1` `eu-central-1` `eu-west-1` `eu-west-2` `eu-west-3` `eu-north-1` `me-south-1` `us-east-1` `us-east-2` `us-west-1` `us-west-2` For Google Cloud, some possible values are: `asia-east1` `asia-east2` `asia-northeast1` `asia-southeast1` `asia-south1` `europe-north1` `europe-west1` `europe-west2` `europe-west3` `europe-west4` `northamerica-northeast1` `southamerica-east1` `us-central1` `us-east1` `us-east4` `us-west1` `us-west2`	The location reference

Example Request with Response

curl -X GET 'https://<tenant-URL>/api/v1/security_assessment?token=<token>&platform=aws&limit=1&skip=0’

{
    "status": "success",
    "msg": "",
    "data": [
        {
            "status": "Passed",
            "account_name": "Rel66AWS",
            "account_id": "215406114230",
            "rule_name": "BPR-AWS | Ensure no user has AdminAccess policy",
            "remediation_steps": "Not Available",
            "resource_name": "gauthami",
            "resource_id": "gauthami",
            "resource_type": "User",
            "resource_category": "Identity",
            "severity": "High",
            "failing_since": "2020-02-12 02:30:17AM", 
             // Will appear only if status = Failed    
            "mute": "true",
             // Will appear only if muted or has been muted in the past        
            "cloud_provider": "AWS",
            "profiles": [
                "AWS Best Practices v1.0.0"
            ],
            "mute_until": "2020-04-14 07:00:00AM",
            // Will appear only if muted or has been muted in the past
            "mute_time": "2020-04-01 06:30:46AM",
            // Will appear only if muted or has been muted in the past               
            "mute_by": "developer@netskope.com",
// Will appear only if muted or has been muted in the past
            "auto_remediation_status": "errored",
            "remediation_action_name": "Ensure User does not have Admin Access Privilege",
            "remediated_by": "auto_remediation",
            "auto_remediation_time": "2019-08-01 06:54:45AM",
            "is_auto_remediation": "true",
            "policies": [
                "ak-ar-policy"
            ],
            "region_name": "global",
            "error_msg": "",
            "last_scan_time": "2019-08-01 06:54:45AM",
            "tags": [
                {
                    "name": "gautami",
                    "value": "1032"
            }],    
            "compliance_standards": [{ 
                "control": "1",
                "description": "Audit/log records are determined, documented, implemented, and reviewed in accordance with policy",           
                "section": "PR.PT",
                "standard": "NIST-CSF-1.1",
                "reference_url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.
CSWP.04162018.pdf"
                },
                {            
                "control": "9",            
                "description": "Ensure a log metric filter and alarm exist for AWS Config configuration changes",
                "appname": "aws",
                "section": "3",
                "standard": "CIS-AWSFND-1.2.0",            
                "reference_url": "https://www.cisecurity.org/benchmark/amazon_web_
services/"        
                }
           ]
}

Key

Value

Description

account_id

URL-encoded string

The IaaS platform provider account ID.

account_name

URL-encoded string

The IaaS platform provider account name.

cloud_provider

azure | aws | googlecloud

The IaaS platform provider.

policy_name

URL-encoded string

The Security Assessment policy name.

profile_name

URL-encoded string

The Security Assessment profile name.

rule_name

URL-encoded string

The Security Assessment rule name.

resource_category

URL-encoded string

The asset category set by Netskope per account resource.

resource_id

URL-encoded string

The asset identifier created by the IaaS platform provider.

resource_name

URL-encoded string

The IaaS instance name.

resource_type

URL-encoded string

The resource type set by Netskope per account resource.

tag_name

URL-encoded string

The tag name set in the Iaas platform provider account resource. Must also supply tag value.

tag_value

URL-encoded string

The tag value set in the Iaas platform provider account resource. Must also supply tag name.

remediated_by

AutoRemediation | OnDemandRemediation

How the policy violation was remediated.

last_remediation_status

None | Started | Completed | Errored

Last remediation status. None means not any the other three options.

as_of

Integer

Epoch time of results at that time. Default is the time of the request when not supplied, and is GMT time.

severity

Critical | High | Medium | Low

The Security Assessment rule severity.

limit

Positive integer less than 10000

Required.

REST API responses can return up to 10000 events in a single response. You can use pagination to retrieve more results.

skip

Positive integer

Skip over some of the events (useful for pagination in combination with limit).

status

Passed | Failed

The Security Assessment status.

muted

Yes | No

Returns either muted or unmuted findings.

compliance_standard

URL-encoded string

The name of the compliance standard, like CIS-AWSFND-1.2.0, NIST-CSF, etc.

region

For Azure, some possible values are:

all
global
eastus
northcentralus
westus
centralindia
centralus
australiacentral

For AWS, possible values are:

global
ap-south-1
ap-northeast-2
ap-southeast-1
ap-southeast-2
ap-northeast-1
ca-central-1
eu-central-1
eu-west-1
eu-west-2
eu-west-3
eu-north-1
me-south-1
us-east-1
us-east-2
us-west-1
us-west-2

For Google Cloud, some possible values are:

asia-east1
asia-east2
asia-northeast1
asia-southeast1
asia-south1
europe-north1
europe-west1
europe-west2
europe-west3
europe-west4
northamerica-northeast1
southamerica-east1
us-central1
us-east1
us-east4
us-west1
us-west2

The location reference

curl -X GET 'https://<tenant-URL>/api/v1/security_assessment?token=<token>&platform=aws&limit=1&skip=0’ { "status": "success", "msg": "", "data": [ { "status": "Passed", "account_name": "Rel66AWS", "account_id": "215406114230", "rule_name": "BPR-AWS | Ensure no user has AdminAccess policy", "remediation_steps": "Not Available", "resource_name": "gauthami", "resource_id": "gauthami", "resource_type": "User", "resource_category": "Identity", "severity": "High", "failing_since": "2020-02-12 02:30:17AM", // Will appear only if status = Failed "mute": "true", // Will appear only if muted or has been muted in the past "cloud_provider": "AWS", "profiles": [ "AWS Best Practices v1.0.0" ], "mute_until": "2020-04-14 07:00:00AM", // Will appear only if muted or has been muted in the past "mute_time": "2020-04-01 06:30:46AM", // Will appear only if muted or has been muted in the past "mute_by": "developer@netskope.com", // Will appear only if muted or has been muted in the past "auto_remediation_status": "errored", "remediation_action_name": "Ensure User does not have Admin Access Privilege", "remediated_by": "auto_remediation", "auto_remediation_time": "2019-08-01 06:54:45AM", "is_auto_remediation": "true", "policies": [ "ak-ar-policy" ], "region_name": "global", "error_msg": "", "last_scan_time": "2019-08-01 06:54:45AM", "tags": [ { "name": "gautami", "value": "1032" }], "compliance_standards": [{ "control": "1", "description": "Audit/log records are determined, documented, implemented, and reviewed in accordance with policy", "section": "PR.PT", "standard": "NIST-CSF-1.1", "reference_url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST. CSWP.04162018.pdf" }, { "control": "9", "description": "Ensure a log metric filter and alarm exist for AWS Config configuration changes", "appname": "aws", "section": "3", "standard": "CIS-AWSFND-1.2.0", "reference_url": "https://www.cisecurity.org/benchmark/amazon_web_ services/" } ] }