Ce document décrit les API REST de Cloud Exchange que vous pouvez utiliser pour configurer les plugins, les règles métier et le partage pour chaque module de Cloud Exchange : Log Shipper, Threat Exchange, Ticket Orchestrator, Risk Exchange, Exact données Match et Custom File Classification.
Conditions préalables
Pour utiliser ces API, vous devez disposer de :
- The URL of your Cloud Exchange instance (<CE_URL>).
- Identifiants d'utilisateur Cloud Exchange avec les autorisations requises pour le module que vous souhaitez configurer.
- Jeton d’accès généré à l’aide de l’ API d’authentification. Transmettez ce jeton dans l’en-tête
Authorizationde chaque autre requête.
Note: Remplacez toutes les valeurs entre crochets, telles que <CE_URL>, <tenant_name> et <client_secret>, par les valeurs de votre environnement. Les versions des plugins et les champs des exemples de réponses peuvent différer en fonction de vos versions de Cloud Exchange et de plugin.
Détails de l'API
Voici une liste des API utilisées.
Authentification
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/auth | PUBLIER | Générer un jeton d'accès utilisé pour authentifier tous les autres appels d'API Cloud Exchange. |
Chargeur de bois (CLS)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/cls/configurations | PUBLIER | Créer une configuration de plugin Netskope Log Shipper (CLS). |
| /api/cls/configurations | PUBLIER | Create a QRadar (CLS) plugin configuration. |
| /api/cls/business_rules | PUBLIER | Créer une règle métier CLS avec des filtres de type alerte et événement. |
| /api/cls/business_règle | PATCH | Mettre à jour une règle de gestion CLS pour mapper une configuration source à une configuration de destination. |
Échange de menaces (CTE)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/cte/plugins/configurations/netskope.plugins.Default.netskope.main | PUBLIER | Créer une configuration de plugin Netskope Threat Exchange (CTE). |
| /api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main | PUBLIER | Créer une configuration de plugin CrowdStrike (CTE). |
| /api/cte/business_rules | PUBLIER | Créer une règle métier CTE qui filtre les indicateurs de la source CTE de Netskope. |
| /api/cte/business_rules | PUBLIER | Créer une règle métier CTE qui filtre les indicateurs d’URL de la source CTE CrowdStrike. |
| /api/cte/business_rules | PUBLIER | Créer une règle métier CTE qui filtre les indicateurs MD5 et SHA256 de la source CTE de CrowdStrike. |
| /api/cte/business_règle | PATCH | Mettre à jour une règle de gestion CTE pour partager les indicateurs Netskope avec CrowdStrike. |
| /api/cte/business_règle | PATCH | Mettre à jour une règle de gestion CTE pour partager les indicateurs d'URL CrowdStrike avec une liste d'URL Netskope. |
| /api/cte/business_règle | PATCH | Mettez à jour une règle métier CTE pour partager les hashs de fichiers CrowdStrike vers une liste de hashs de fichiers Netskope. |
Orchestrateur de billets (CTO)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/itsm/configuration | PUBLIER | Créer une configuration de plugin Netskope Ticket Orchestrator (CTO). |
| /api/itsm/configuration | PUBLIER | Create a Jira (CTO) plugin configuration. |
| /api/itsm/business_rules | PUBLIER | Créer une règle métier CTO. |
| /api/itsm/business_règle | PATCH | Mettez à jour une règle métier CTO pour ajouter une file d'attente avec des mappages de champs. |
Bourse des risques (CRE)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/cre/configurations | PUBLIER | Créer une configuration de plugin Netskope Risk Exchange (CRE) avec des mappages d’entités. |
| /api/cre/configurations | PUBLIER | Créez une configuration de plugin CrowdStrike (CRE) avec des mappages d'entités. |
| /api/cre/business_rules | PUBLIER | Créer une règle métier CRE pour l'entité Utilisateurs. |
| /api/cre/business_rules | PUBLIER | Créez une règle métier CRE pour l’entité Périphériques. |
| /api/cre/business_rules | PUBLIER | Créez une règle métier CRE pour l'entité Applications. |
| /api/cre/business_rules | PATCH | Mettre à jour une règle métier CRE pour ajouter une action. |
Correspondance exacte de données (EDM)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main | PUBLIER | Créez une configuration de plugin Netskope Exact données Match (EDM). |
| /api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main | PUBLIER | Créez une configuration de plugin de partage de fichiers Linux (EDM). |
| /api/edm/business_rules | PUBLIER | Partager les hachages EDM de la configuration EDM du partage de fichiers Linux vers la configuration EDM Netskope. |
Custom File Classification (CFC)
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main | PUBLIER | Créer une configuration de plugin Custom File Classification (CFC) de Netskope. |
| /api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main | PUBLIER | Créer une configuration de plugin Linux File Share (CFC). |
| /api/cfc/business_règle | PUBLIER | Créer une règle métier CFC. |
| /api/cfc/sharing | PUBLIER | Partagez les hashs CFC de la configuration CFC de partage de fichiers Linux vers la configuration CFC de Netskope. |
Authentification
Générer un jeton d'authentification
API Endpoint: https://<CE_URL>/api/auth
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Content-Type | application/x-www-form-urlencoded |
Request Body
| Clé | Value |
|---|---|
| grant_type | password |
| nom d'utilisateur | <ce_username> |
| password | <ce_password> |
Sample API Response
{
"access_token": "<generated_access_token_value>",
"token_type": "bearer",
"scopes": [
"admin",
"api",
"me",
"cte_read",
"cto_read",
"cls_read",
"cre_read",
"settings_read",
"logs",
"cte_write",
"cto_write",
"cre_write",
"cls_write",
"settings_write",
"edm_read",
"cfc_read",
"edm_write",
"cfc_write",
"ai_read",
"ai_write"
],
"firstLogin": false,
"passwordPolicyViolation": false,
"passwordPolicy": null
}
Chargeur de bois (CLS)
Utilisez ces API pour configurer les plugins Log Shipper, créer une règle de gestion et mapper la règle de gestion à une destination SIEM pour la livraison des journaux.
Configuration du plugin
Configurez le plugin Netskope Log Shipper
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CLS",
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"tenant": "<tenant_name>",
"active": true,
"attributeMappingRepo": null,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
}
}
Sample API Response
{
"name": "Netskope CLS",
"types": [
"alerts",
"events"
],
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"pluginName": "Netskope Log Shipper",
"pluginVersion": "2.3.0",
"pushSupported": true,
"pullSupported": false,
"tenant": "<tenant_name>",
"active": true,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"attributeMapping": null,
"attributeMappingRepo": null,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
Configurer le plugin QRadar
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"active": true,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"useProxy": false
}
Sample API Response
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"pluginName": "QRadar",
"pluginVersion": "3.1.0",
"pushSupported": true,
"pullSupported": false,
"tenant": null,
"active": true,
"pollIntervalUnit": "minutes",
"pollInterval": 60,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
Business Rule Configuration
Créer une règle de gestion des expéditeurs de journaux
API Endpoint: https://<CE_URL>/api/cls/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {}
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {},
"isDefault": false
}
Configuration de la livraison des journaux
Configurer la remise des journaux (correspondance SIEM)
API Endpoint: https://<CE_URL>/api/cls/business_rule
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
Échange de menaces (CTE)
Utilisez ces API pour configurer les plugins Threat Exchange, créer des règles métier et configurer le partage entre les plugins.
Configuration du plugin
Configurer le plugin Netskope Threat Exchange
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.netskope.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CTE",
"active": true,
"tenant": "<tenant_name>",
"tagsAggregateStrategy": "append",
"sslValidation": true,
"pollIntervalUnit": "minutes",
"reputation": 5,
"pollInterval": 10,
"ageAfterDays": 90,
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"useProxy": false
}
Sample API Response
{
"name": "Netskope CTE",
"plugin": "netskope.plugins.Default.netskope.main",
"pluginName": "Netskope Threat Exchange",
"pluginVersion": "2.5.0",
"pushSupported": true,
"tenant": "<tenant_name>",
"active": true,
"sslValidation": true,
"pollInterval": 10,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
Configurer le plugin CrowdStrike
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CrowdStrike CTE",
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"reputation": 5,
"ageAfterDays": 90,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"useProxy": false
}
Sample API Response
{
"name": "CrowdStrike CTE",
"plugin": "netskope.plugins.Default.crowdstrike.main",
"pluginName": "CrowdStrike",
"pluginVersion": "2.3.0",
"pushSupported": true,
"tenant": null,
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
Business Rule Configuration
Créer une règle métier pour les indicateurs Netskope
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source Netskope",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Créez une règle métier pour les indicateurs d’URL CrowdStrike
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Créer une règle métier pour les indicateurs de hachage de fichier CrowdStrike
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
Configuration du partage
Partager des indicateurs de Netskope vers CrowdStrike
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source Netskope",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
},
"creShare": {}
}
Partager des indicateurs d'URL de CrowdStrike vers une liste d'URL Netskope
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
},
"creShare": {}
}
Partager des indicateurs de hachage de fichier de CrowdStrike vers une liste de hachage de fichier Netskope
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
},
"creShare": {}
}
Orchestrateur de billets (CTO)
Utilisez ces API pour configurer les plugins de Ticket Orchestrator, créer une règle métier et configurer les files d'attente.
Configuration du plugin
Configurer le plugin Netskope Ticket Orchestrator
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"pluginName": "Netskope Ticket Orchestrator",
"active": true,
"tenant": "<tenant_name>",
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Sample API Response
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"tenant": "<tenant_name>",
"active": true,
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Configurer le plugin Jira
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"active": true,
"tenant": null,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"receivingSupported": true,
"useProxy": false,
"filters": null
}
Sample API Response
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"tenant": null,
"active": true,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": false
}
Business Rule Configuration
Créer une règle de gestion de Ticket Orchestrator
API Endpoint: https://<CE_URL>/api/itsm/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"muted": false,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {}
}
Configuration de la file d'attente
Configurer une file d'attente
API Endpoint: https://<CE_URL>/api/itsm/business_rule
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
Bourse des risques (CRE)
Utilisez ces API pour configurer les plugins Risk Exchange, créer des règles métier pour chaque entité et configurer des actions.
Configuration du plugin
Configurer le plugin Netskope Risk Exchange
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"pluginName": "Netskope Risk Exchange"
}
Sample API Response
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
Configurer le plugin CrowdStrike
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"pluginName": "CrowdStrike"
}
Sample API Response
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
Business Rule Configuration
Créer une règle métier pour l’entité Utilisateurs
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Users Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Users"
}
Sample API Response
{
"name": "CRE Users Rule",
"entity": "Users",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Créer une règle de gestion pour l'entité de périphériques
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Device Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Devices"
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Créer une règle métier pour l'entité Applications
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Applications Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Applications"
}
Sample API Response
{
"name": "CRE Applications Rule",
"entity": "Applications",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Action Configuration
Configurer une action
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CRE Device Rule",
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"requireApproval": true
}
]
}
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"performLater": false,
"requireApproval": true,
"performRevert": false
}
]
},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Correspondance exacte de données (EDM)
Utilisez ces API pour configurer les plugins Exact données Match et configurer le partage.
Configuration du plugin
Configurer le plugin EDM Netskope
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope EDM",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope EDM",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"pluginName": "Netskope Exact Data Match",
"pluginVersion": "1.0.1",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null,
"pluginType": null,
"tenant": "<tenant_name>"
}
Configurer le plugin EDM de partage de fichiers Linux
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"lockedAt": null,
"pluginType": null,
"tenant": null
}
Configuration du partage
Configurer le partage EDM
API Endpoint: https://<CE_URL>/api/edm/business_rules
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
}
}
Sample API Response
{
"name": "80959f82-2c81-4bd4-ab03-91990f95dbaa",
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
},
"status": "scheduled",
"createdAt": "2026-07-18T10:54:00.171621Z",
"updatedAt": "2026-07-18T10:54:00.171624Z",
"sharedAt": null
}
Custom File Classification (CFC)
Utilisez ces API pour configurer des plugins de classification de fichiers personnalisés, créer une règle de gestion et configurer le partage.
Configuration du plugin
Configurer le plugin CFC de Netskope
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Netskope CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {},
"sslValidation": true,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope CFC",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"pluginName": "Netskope Custom File Classification",
"pluginVersion": "1.1.0",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": true,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null
}
Configurer le plugin CFC de partage de fichiers Linux
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "Linux File Share CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share CFC",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"lockedAt": null
}
Business Rule Configuration
Créer une règle de gestion CFC
API Endpoint: https://<CE_URL>/api/cfc/business_rule
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"name": "CFC Rule",
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
}
}
Sample API Response
{
"name": "CFC Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
},
"exceptions": [],
"mapped": false,
"updatedBy": "admin",
"updatedAt": "2026-07-19T09:25:14.813000"
}
Configuration du partage
Configurer le partage CFC
API Endpoint: https://<CE_URL>/api/cfc/sharing
Method: POST
Request Headers
| Clé | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | application/json |
Request Body
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierID": "1510609487600855817",
"classifierName": "performance",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
},
"classifierType": "custom"
}
]
}
Sample API Response
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierName": "performance",
"classifierType": "custom",
"classifierID": "1510609487600855817",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
}
}
],
"status": "scheduled",
"errorState": {
"error": false,
"errorMessage": ""
},
"createdAt": "2026-07-19T09:32:57.270695Z",
"createdBy": "admin",
"updatedAt": "2026-07-19T09:32:57.270702Z",
"updatedBy": "admin",
"sharedAt": null
}