Netskope LogoNetskope Logo
  • Services de sécurité
  • Services d’IA
  • Services de miseenréseau
  • Services d'analyse
  • Intégrations
  • getting-started.svgPour commencer
    • Support
    • Communauté
    • Netskope.com
    © 2026 Tous droits réservés. Netskope Inc.
    Accueil
    Événements de transaction
    Déploiement du client de streaming d'événements

    Déploiement du client de streaming d'événements

    Before deployment, please:

    • examiner les architectures des clients de streaming d'événements et définir l'architecture cible.
    • review Event Streaming Client Requirements

    Le déploiement d'Event Streaming Client nécessite les étapes suivantes :

    1. Configuration de l'accès à l'API
    2. Client installation for each Event Streaming Client to deploy.
    3. Une configuration de format pour définir les données qui seront transmises au SIEM
    4. Une configuration de destination pour définir les cibles SIEM pour chaque client et le format actif
    5. La configuration du flux de journaux permet alors d'activer la destination du client de flux d'événements.

    Accès à l'API

    La création d'un rôle et d'un jeton est abordée dans la section Accès à l'API du client de streaming d'événements.

    Installation du client

    L'installation du client se fait en 2 étapes :

    1. Déclaration d'un client New via l'API et génération d'un jeton
    2. Déploiement du client sur l'hôte périphérique

    Configuration du client

    Après une authentification réussie à l'API Swagger de Netskope, la configuration de l'Event Streaming Client est disponible avec les points d'extrémité /api/v2/streamingclient/clients :

    • Créez un client New avec la méthode POST en utilisant le bouton "Try it out" :
    • Il est possible de vérifier les clients créés avec la méthode GET

    Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.

    Téléchargez le programme d'installation

    De Swagger

    De Linux

    Commandement :

    curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ

    Exemple :

    root@lab-esc1:~# curl -X 'GET' 'https://<tenant>.goskope.com/api/v2/streamingclient/installer' -H 'accept: application/gzip' -H 'Authorization: Bearer XXXX' -OJ
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10796  100 10796    0     0  57922      0 --:--:-- --:--:-- --:--:-- 58994
root@lab-esc1:~# tar -zxvf NS_StreamingClient_Installer.tar.gz
netskope_event_streamingclient_installer.py
README.md

    Déploiement de l'instance

    1. Se connecter au serveur Linux
    2. Assurez-vous que Python3 et Docker sont installés.
    3. Récupérez le programme d'installation de l'étape précédente
    4. Vérifiez la configuration dédiée à votre système
      Pour utiliser Docker avec un proxy HTTP, reportez-vous à Configuration du proxy pour Docker.
      Pour utiliser RHEL avec Podman, reportez-vous à Red Hat et la configuration de Podman.
      1. Exécutez le script d'installation
      python3 netskope_event_streamingclient_installer.py

      6. Select install option et répondez à toutes les questions posées :

      • emplacement des fichiers, par défaut /root/ns
      • Enter the client key est le jeton généré avec l’API /api/v2/streamingclient/clients/{id}/token
      • Jour et heure de la semaine pour la mise à jour automatique
      • Définissez éventuellement le proxy HTTP

      Exemple

      root@lab-esc2:~# python3 netskope_event_streamingclient_installer.py
NETSKOPE LOG STREAM CLIENT INSTALLER I.2025.11.1

Please specify an option:
1. install   - Set up and configure the container
2. reinstall - Remove and recreate the container
3. uninstall - Remove the container and cleanup

Enter option (install/reinstall/uninstall): 1
INSTALLATION

>>> Checking if operating system is supported...
SUCCESS: Check for operating system passed.

>>> Checking if hardware architecture is supported...
SUCCESS: Check for Architecture passed.

>>> Checking if Docker is installed and running...
SUCCESS: Docker is installed.
SUCCESS: Docker daemon is running.

SUCCESS: All the systems checks passed.

Configuring container ...

Enter the directory path to store the installation files and logs [default: /root/ns]:
Enter the client key : eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhb
Client key: eyJDT05ORUNUSU9OX0tFWSI6InN0cmVhbWluZ2NsaWVudC1h

Please set up a weekly schedule for automatic Docker image updates.

Do you want to use the default schedule (Thursday at 23:00)? [y/n]: y

>>> Configuring proxy settings...

Do you need proxy setup for Streaming Client? [y/n] (default: n): y
INFO: Configuring proxy for containers

--- Streaming Client Container Proxy Configuration ---
This proxy will be used by the running containers for their operations.
HTTPS Proxy URL (e.g., http://proxy.company.com:8080 or https://proxy.company.com:8080): http://163.xxx.xxx.80:80
INFO: Container HTTPS proxy configured: http://163.xxx.xxx.80:80

>>> Setting up and starting the container...
INFO: Using existing installation directory: /root/ns

>>> Pulling Docker image: netskope/nsstreamingclient:stable
The process might take a moment...
stable: Pulling from netskope/nsstreamingclient
645635fbf4d2: Pull complete
c9debdf8207a: Pull complete
94e09fa58eb4: Pull complete
c5b5b574d9eb: Pull complete
9a47257481ca: Pull complete
2f5e1dfb2cd4: Pull complete
f9514487b3cf: Pull complete
78e884c4c39d: Pull complete
2aac2ff272d9: Pull complete
da51ee03c947: Pull complete
a84060cbac16: Pull complete
477d64974173: Pull complete
9a1325d79269: Pull complete
a71a358f9aef: Pull complete
44d06538ce68: Pull complete
14477cceda61: Pull complete
8fb98c22d537: Pull complete
db9fdfbf3f52: Pull complete
4958661942a9: Pull complete
1540d139dc0c: Pull complete
b1f4e241f375: Pull complete
94bfc05d13f2: Pull complete
7f247b6c83f6: Pull complete
a8cda5c427fe: Pull complete
28eedd26b6c7: Pull complete
b9ce487eef38: Pull complete
0f452909bfe0: Pull complete
bcdfc9f5c9e1: Pull complete
082b67164622: Pull complete
336355755be8: Pull complete
9e505fd59acf: Pull complete
c4a41b87cf93: Pull complete
de55d536641a: Pull complete
11aacba49461: Pull complete
Digest: sha256:ea143d8520
Status: Downloaded newer image for netskope/nsstreamingclient:stable
docker.io/netskope/nsstreamingclient:stable
SUCCESS: Docker image pulled successfully!
INFO: Configuring container volumes and environment variables...
INFO: Initialized installer information log file.
INFO: Container configuration file created successfully
INFO: Creating proxy configuration file...
INFO: Creating proxy configuration file...
SUCCESS: Proxy configuration saved to proxy.env
INFO: Starting container...
INFO: Adding HTTPS proxy to container: http://163.xxx.xxx.80:80
e9fe4c230e5cc191
SUCCESS: Container 'nsstreamingclient' started successfully!
Container files and Log files will be stored in: /root/ns

>>> Setting up watcher container to monitor the main container...
INFO: Pulling watcher image...
stable: Pulling from netskope/nswatcher
21b919804656: Pull complete
891cc33da41a: Pull complete
e6eb3a86a632: Pull complete
edeb9247ddd4: Pull complete
f988b2dd9cbf: Pull complete
ef090e4f8d13: Pull complete
b935cef6a087: Pull complete
06e748922bc3: Pull complete
49b990c12c1f: Pull complete
fa2956f00aa5: Pull complete
3df31e584803: Pull complete
4164121f60f1: Pull complete
f99197fd9601: Pull complete
1737cff1e8c9: Pull complete
60957cee4d80: Pull complete
964929934f06: Pull complete
5d335edf6f34: Pull complete
26ddf93d0751: Pull complete
141fda38c9b5: Pull complete
093dc20aa13e: Pull complete
Digest: sha256:8eb9a2
Status: Downloaded newer image for netskope/nswatcher:stable
docker.io/netskope/nswatcher:stable
INFO: Starting watcher container...
INFO: Adding container HTTPS proxy to watcher container: http://163.xxx.xxx.80:80
f519daf55cax
SUCCESS: Watcher container started successfully!
>>> Waiting for configuration to complete (max 60 seconds)...
PROGRESS: Client is not enabled
INFO: Installation successful. Waiting for configuration download...
INFO: Monitoring for 15s ...
Successfully downloaded stream configuration
INSTALLATION COMPLETE
root@lab-esc2:~#

      Validation de l'instance

      Pour vérifier que l'instance fonctionne, nous vous recommandons de vérifier les éléments suivants

      • L'instance est en cours d'exécution
      root@lab-esc1:~# docker ps
CONTAINER ID   IMAGE                               COMMAND                  CREATED         STATUS         PORTS     NAMES
ac518e00355f   netskope/nsstreamingclient:stable   "./start.sh s h ' ' …"   2 minutes ago   Up 2 minutes             nsstreamingclient
bf534b   netskope/nswatcher:stable           "bash start.sh"          2 days ago      Up 2 days                ns-watcher
root@lab-esc1:~#
      • Journaux Docker
      root@lab-esc1:~# docker logs nsstreamingclient
2025/09/04 13:16:53 Primary config missing (/opt/ns/cfg/container_config). Trying fallback (/app/container_config)...
Install Log: Starting static configuration and token loading process.
Install Log: Configuration variables loaded successfully.
2025/09/04 13:16:53 Start decrypting container and connection keys from the env app.env file
2025/09/04 13:16:53 Starting metrics logging
{"level":"info","timestamp":"2025-09-04T13:16:53.112Z","caller":"log/log.go:86","msg":"Start collecting the system metrics"}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Connected with syslog."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Syslog details verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"PROGRESS: Configuration verified."}
{"level":"info","timestamp":"2025-09-04T13:16:53.201Z","caller":"log/log.go:86","msg":"Successfully downloaded stream configuration"}
{"level":"info","timestamp":"2025-09-04T13:16:53.202Z","caller":"log/log.go:86","msg":"starting stream config watcher"}
{"level":"info","timestamp":"2025-09-04T13:16:53.209Z","caller":"log/log.go:86","msg":"Creating connections for log streamer","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c","conNum":8}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.346Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.396Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.442Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.488Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.535Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.582Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.583Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.629Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.676Z","caller":"log/log.go:86","msg":"GRPC connection established successfully"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Successfully registered with Proxy","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"starting stream...."}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log streamer","containerId":"0198eb4f-b0cd-71b8-8c20-0311959d806c"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b4be021a-669a-49bb-856b-3fd284a00451"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"0a07b1dc-5a07-4496-b934-864a74dfeac3"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"b036e41f-7ab0-4ab4-b10f-2346700b1710"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"eb579304-6a57-4cf3-a6aa-f2150ddef1bd"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"aa1fb4d5-112f-4300-933c-f074e3327e36"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"bf3b6503-0ff9-47a4-ab09-3e4c7591936d"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"15807d37-795a-49a2-a71c-c8036de319f6"}
{"level":"info","timestamp":"2025-09-04T13:16:53.677Z","caller":"log/log.go:86","msg":"Starting the Log reader","groupId":"0199054e-5765-72cf-803a-ebd2dcfc17e2","connID":"73f362f1-30d3-4889-802b-740fcf382ac0"}
      • Les fichiers journaux se trouvent également dans le dossier container_files/logs à l'intérieur de l'emplacement sélectionné lors de l'installation.

      La description des messages du journal est fournie dans la section "Dépannage" au bas du guide.

      Format configuration

      Event Streaming Client prend en charge les formats suivants :

      • CEF
      • ELFF
      • JSON

      Si JSON est le plus universel, c'est aussi le plus lent en raison de sa structure. Le CEF est généralement un bon compromis entre soutien large et performance. ELFF reste la solution la plus performante, mais elle n'est pas prise en charge de manière native par tous les SIEM.

      • Utilisez POST pour créer un premier format
      • PATCH peut être utilisé pour ajouter ou modifier des options après la création.
      • The Format ID is required to configure Destination object
      • Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.

      Example with Default JSON Format:

      {
  "name": "Default JSON",
  "type": "JSON",
  "definition": {
    "remove_empty_fields": true,
    "customize": false
  }
}

      Configuration de la destination

      L'objet Destination est utilisé pour définir l'adresse SIEM de chaque client.

      Pour obtenir une configuration pleinement opérationnelle, les informations suivantes sont nécessaires :

      • L'ID du client trouvé dans l'objet Client (l'objet Client doit être activé).
      • L'ID du format trouvé dans l'objet Format
      • L'IP/le domaine du SIEM, le port et le protocole à utiliser.
      • Créer une destination avec l'API POST
      • PATCH peut être utilisé pour ajouter ou modifier des options après la création.
      • Assurez-vous que la destination a
        • Une cible avec un identifiant de client fonctionnel
        • La cible est activée
        • L'objet Destination est activé
        • L'objet Client est activé
      • Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.

      Example:

      {
    "name": "Sample destination",
    "enabled": true,
    "type": "syslog_tcp",
    "format": "019914ed",
    "targets":
    [
        {
            "client": "0198eb4f",
            "ip": "lab-splunk4.info",
            "port": 5151,
            "enabled": true
        }
    ]
}

      Configuration de la diffusion du journal

      Un seul flux de journaux peut être configuré pour les événements de transaction.
      Il n'y a actuellement aucune validation de l'ID de destination, assurez-vous que l'ID de destination est correct.

      Utilisez l'API POST /api/v2/events/logstreaming/stream pour enregistrer la destination.

      {
  "streamType": "transaction",
  "name": "Transaction Stream",
  "provider": "streamingclient",
  "credential": {
    "streamingclient": {
      "client-destination": "REPLACE WITH YOUR DESTINATION ID"
    }
  },
  "compressionType": "zstd"
}
      • Pour modifier une configuration existante, utilisez l'API PUT /api/v2/events/logstreaming/stream/{streamId} API
      • Pour plus d'informations, consultez la section Configuration du client de streaming d'événements.

      Dans ce thème
      • Déploiement du client de streaming d'événements