This document explains how to configure the Netskope Ticket Orchestrator v2.5.0 plugin with the Ticket Orchestrator module of the Netskope Cloud Exchange platform. This plugin is used to pull Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, and Content) and Events (Incident and Endpoint) from the Netskope Tenant. It also supports updating and resolving incidents on the Netskope Tenant.
Conditions préalables
Pour compléter cette configuration, vous avez besoin de :
- Un locataire Netskope (ou plusieurs, par exemple des instances de production et de développement/test).
- A Cloud Exchange Tenant with the Netskope Tenant plugin and a 3rd-party plugin, like CTO Jira Plugin, already configured.
Note
| Fonctionnalité de Ticket Orchestrator | Version de Cloud Exchange | Version de Ticket Orchestrator | Tenant Plugin Version |
|---|---|---|---|
| Resolve Incident | 6.1.0 & above | 2.5.0 & above | 1.6.0 & above |
| Custom Mappings | 6.0.0 & ci-dessus | 2.4.0 & ci-dessus | 1.5.0 & ci-dessus |
| Apprentissage automatique sur le terrain | 5.1.1 & ci-dessus | 2.3.0 & ci-dessus | 1.3.0 & ci-dessus |
| DLP (Prévention des pertes de données) Incident Forensics | 5.1.2 & ci-dessus | 2.3.0 & ci-dessus | 1.5.0 & ci-dessus |
Support du plugin Ticket Orchestrator
Fetches Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, Content) and Events (Incident, Endpoint) from the Netskope tenant. Supports updating incidents back to the Netskope Tenant.
| Type de données | Description |
|---|---|
| Types d'alerte | Oui (DLP (Prévention des pertes de données), Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, CTEP, UBA, périphérique, Content) |
| Types d'événements | Yes (Incident, Endpoint) |
Mises en correspondance
Default Status Mappings
| Champs de Cloud Exchange | Netskope Tenant Fields |
|---|---|
| Nouveau | new |
| En cours | in_progress |
| En attente | – |
| Closed | closed |
| Deleted | closed |
| Autres | – |
Default Severity Mappings
| Champs de Cloud Exchange | Netskope Tenant Fields |
|---|---|
| Critique | Critique |
| Haut | Haut |
| Moyen | Moyen |
| Faible | Faible |
| Information | Faible |
| Autres | Faible |
Notes
- Si le champ Assignee contient un email ou une chaîne invalide, le ticket sur Netskope Tenant ne sera pas assigné.
- Le champ Statut peut être désélectionné dans l'interface utilisateur du locataire Netskope. Si le statut utilisé dans Netskope Cloud Exchange n'existe pas sur le poste Netskope ou ne correspond pas exactement aux statuts présents sur le poste Netskope.
Permissions
- Need V2 token created using the Netskope Cloud Exchange role.
- For Device and Content alerts, you will require the following permissions:
- /api/v2/events/dataexport/alerts/device(Read)
- /api/v2/events/dataexport/alerts/content(Read)
- Pour obtenir des données médico-légales sur des incidents, vous devez disposer de l'autorisation ci-dessous :
Détails de l'API
Liste des API utilisées
Alertes
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/v2/events/dataexport/alerts/compromisedcredential | OBTENIR | Retirez les alertes de compromission d'informations d'identification du locataire Netskope. |
| /api/v2/events/dataexport/alerts/dlp | OBTENIR | Pull DLP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malware | OBTENIR | Pull Malware Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/remediation | OBTENIR | Retirez les alertes de remédiation du locataire Netskope. |
| /api/v2/events/dataexport/alerts/securityassessment | OBTENIR | Retirez les alertes d'évaluation de la sécurité du locataire Netskope. |
| /api/v2/events/dataexport/alerts/ctep | OBTENIR | Pull CTEP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malsite | OBTENIR | Pull Malsite Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/policy | OBTENIR | Retirez les alertes de politique du locataire Netskope. |
| /api/v2/events/dataexport/alerts/quarantine | OBTENIR | Tirer les alertes de quarantaine du locataire Netskope. |
| /api/v2/events/dataexport/alerts/uba | OBTENIR | Pull UBA Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/watchlist | OBTENIR | Retirez les alertes de la liste de surveillance du locataire Netskope. |
| /api/v2/events/dataexport/alerts/device | OBTENIR | Tirez les alertes périphériques du locataire Netskope. |
| /api/v2/events/dataexport/alerts/content | OBTENIR | Tirer des alertes de contenu du locataire Netskope. |
Événements
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/v2/events/dataexport/events/incident | OBTENIR | Extraire les événements d'incidents du locataire Netskope. |
| /api/v2/incidents/dlpincidents/{id}/forensics | OBTENIR | Tirer l'historique de l'incident par dlp_incident_id |
| /api/v2/events/dataexport/events/endpoint | OBTENIR | Extraire les événements de point de terminaison du locataire Netskope. |
| /api/v2/incidents/update | PATCH | Pour mettre à jour les incidents dans Netskope. |
Alertes relatives aux informations compromises
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/compromisedcredential
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "20575270a59c8ef1d85d535c",
"acked": "false",
"alert": "yes",
"alert_name": "Secret share",
"alert_type": "Compromised Credential",
"app": "Friend2Friend",
"category": "Cloud Storage",
"cci": 29,
"ccl": "poor",
"count": 1,
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"timestamp": 1727659690,
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0495t@test.netskope.com",
"user": "dte1953ce410-0495t@test.netskope.com",
"userkey": "dte1953ce410-0495t@test.netskope.com",
"division": "",
"external_email": 0,
"mail": "",
"sAMAccountName": "",
"password_type": "",
"userPrincipalName": "",
"breach_date": 0,
"sAMAccountType": "",
"breach_id": "",
"breach_score": "",
"department": "",
"employeeType": "",
"matched_username": "",
"breach_media_references": "",
"email_source": "",
"breach_description": "",
"breach_target_references": "",
"distinguishedName": ""
}
Alertes DLP (Prévention des pertes de données)
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/DLP (Prévention des pertes de données)
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "31365da11ecc94a0d7edfb6f",
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"alert": "yes",
"alert_name": "GDrive Customer metadata shared externally",
"alert_type": "DLP",
"app": "Google Drive",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "high",
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 1,
"dst_latitude": 37.40599060058594,
"dst_location": "Mountain View",
"dst_longitude": -122.0785140991211,
"dst_region": "California",
"dstip": "172.217.14.78",
"exposure": "organisation_wide_link",
"ext_labels": [
{
"data_classification_label": "pym/uducbb2126/encryption_level_11",
"id": "6e05576c-782b-42b4-b8f7-71dfb9ffb5a0",
"instance": "uducbb2126",
"name": "encryption_level_11",
"vendor": "pym"
},
{
"data_classification_label": "ydu/ldmwyo2852/encryption_level_11",
"id": "20c2b17d-7612-4349-b1e1-62d0d6b48ccb",
"instance": "ldmwyo2852",
"name": "encryption_level_11",
"vendor": "ydu"
},
{
"data_classification_label": "uwa/eqpoco8593/encryption_level_9",
"id": "6f77b892-3888-4148-8168-d954856d2fea",
"instance": "eqpoco8593",
"name": "encryption_level_9",
"vendor": "uwa"
}
],
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "edd7df8bb5a774a7531a389287a3bd71cf8e62197d93a205860003ed8339a4de",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "Tenant Migration across MPs",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "unknown",
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Google Drive",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1716551379,
"title": "Tenant Migration across MPs",
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "rowkuxqaxdxnlnlw",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "RoWkuxQAxDxNlNLw",
"userkey": "RoWkuxQAxDxNlNLw",
"record_type": "alert",
"page_site": "",
"act_user": "",
"src_longitude": 0.0,
"dst_timezone": "",
"device_classification": "",
"to_user": "",
"dlp_file": "",
"connection_id": 0,
"external_collaborator_count": 0,
"incident_id": 0,
"dlp_fingerprint_classification": "",
"activity": "",
"from_storage": "",
"user_confidence_index": 0,
"browser_version": "",
"dynamic_classification": "",
"smtp_to": [],
"dlp_rule_severity": "",
"shared_with": "",
"outer_doc_type": 0,
"orignal_file_path": "",
"channel": "",
"data_type": "",
"userip": "",
"sanctioned_instance": "",
"src_region": "",
"true_filetype": "",
"dlp_rule_count": 0,
"shared_domains": "",
"owner_pdl": "",
"dlp_unique_count": 0,
"transaction_id": 0,
"browser_session_id": 0,
"userCountry": "",
"bcc": "",
"displayName": "",
"srcip": "",
"dlp_mail_parent_id": "",
"hostname": "",
"classification_name": "",
"protocol": "",
"sAMAccountName": "",
"violating_user": "",
"manager": "",
"src_time": "",
"src_country": "",
"true_obj_category": "",
"message_size": 0,
"dlp_fingerprint_score": 0,
"src_geoip_src": 0,
"os_version": "",
"true_type_id": 0,
"to_storage": "",
"tss_mode": "",
"managed_app": "",
"file_password_protected": "",
"dlp_incident_id": 0,
"managementID": "",
"dlp_fingerprint_match": "",
"src_timezone": "",
"mail": "",
"total_collaborator_count": 0,
"from_user": "",
"app_activity": "",
"user_id": "",
"custom_attr": {},
"group": "",
"file_cls_encrypted": false,
"universal_connector": "",
"message_id": "",
"file_category": "",
"dlp_parent_id": 0,
"sub_type": "",
"src_latitude": 0.0,
"userPrincipalName": "",
"dlp_is_unique_count": "",
"dlp_rule_score": 0,
"src_zipcode": "",
"dlp_rule": "",
"referer": "",
"app_session_id": 0,
"parent_id": "",
"retro_scan_name": "",
"src_location": "",
"dst_zipcode": "",
"dlp_profile": "",
"true_obj_type": "",
"violating_user_type": "",
"policy_id": "",
"web_universal_connector": "",
"appsuite": "",
"severity": "",
"sha256": "",
"collaborated": "",
"page": ""
}
Alertes aux logiciels malveillants
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malware
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"TSS-scan": "TSS-Scan-V3",
"_id": "389551cd1bdaa1ae4947c334",
"access_method": "Client",
"acked": "false",
"action": "Detection",
"activity": "Browse",
"alert": "yes",
"alert_name": "GT:JS.Adware.Popunder.4.34B7F109",
"alert_type": "Malware",
"app": "hitomi",
"app_name": "hitomi",
"app_session_id": 4113602168491103340,
"appcategory": "Adult Content - Pornography",
"browser_session_id": 2610528494199657827,
"category": "Adult Content - Pornography",
"cci": "",
"ccl": "",
"connection_id": 5767115909713174088,
"count": 1,
"detection_engine": "Netskope AV",
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "UA",
"dst_latitude": 50.45465850830078,
"dst_location": "Kyiv",
"dst_longitude": 30.523799896240234,
"dst_region": "Kyiv",
"dst_timezone": "Europe/Kyiv",
"dst_zipcode": "N/A",
"dstip": "185.255.122.62",
"file_category": "Text",
"file_id": "1dda26cbf77944ccb931f3444b554c74",
"file_size": 2277,
"file_type": "text/html",
"hostname": "ub20-50-5-28",
"incident_id": 7718454634228557343,
"instance": "",
"local_md5": "cda70ab0130f915723a53a5d9270e7a5",
"malware_id": "3d81bec28fff68180bf8baa5727924ba",
"malware_name": "GT:JS.Adware.Popunder.4.34B7F109",
"malware_profile": "1",
"malware_severity": "high",
"malware_type": "Virus",
"managed_app": "no",
"md5": "cda70ab0130f915723a53a5d9270e7a5",
"ml_detection": "None",
"object_type": "File",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 20.04",
"page": "hitomi.la/",
"page_site": "Web Background",
"policy": "Threat-Malware-Policy-Crest-SRE-Test",
"policy_id": "342F7551F4D4469E47D7736209486319 2024-07-01 16:28:12.174470",
"protocol": "HTTPS/1.1",
"request_id": 2907585389470724608,
"scanner_result": "malicious",
"severity": "High",
"severity_id": 3,
"sha256": "d330ea88b7a0c2f9190717d8f39a2e3942474c3fefe8b68112e7b93fde0fa9d4",
"site": "hitomi",
"src_country": "IN",
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_time": "Wed Aug 14 13:48:00 2024",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "382350",
"srcip": "110.226.17.67",
"timestamp": 1723623535,
"traffic_type": "Web",
"transaction_id": 7718454634228557343,
"true_filetype": "HTML",
"tss_mode": "inline",
"type": "nspolicy",
"ur_normalized": "nipun.brahmbhatt@crestdata.ai",
"url": "hitomi.la/",
"user": "nipun.brahmbhatt@crestdata.ai",
"user_id": "nipun.brahmbhatt@crestdata.ai",
"userip": "10.50.5.28",
"record_type": "alert",
"department": "",
"scan_time": 0,
"tss_scan_failed": "",
"usr_udf_supervisorname": "",
"instance_id": "",
"nsdeviceuid": "",
"modified_date": 0,
"dst_geoip_src": 0,
"local_sha256": "",
"sha1": "",
"usr_udf_primarydomain": "",
"fastscan_results": "",
"sanctioned_instance": "",
"company": "",
"user_confidence_index": 0,
"src_geoip_src": 0,
"usr_udf_businesssegmentlevel1": "",
"referer": "",
"parent_id": "",
"created_date": 0,
"usr_udf_businesssegmentlevel2": "",
"filename": "",
"from_user": "",
"file_path": "",
"manager": "",
"browser": "",
"detection_type": "",
"title": "",
"object_id": "",
"mime_type": "",
"usr_display_name": "",
"usr_udf_businesssegmentlevel4": "",
"userPrincipalName": "",
"appsuite": "",
"scan_type": "",
"tss_license": "",
"managementID": "",
"usr_status": "",
"object": "",
"custom_attr": {},
"userCountry": "",
"usr_title": "",
"usr_udf_businesssegmentlevel3": "",
"file_name": "",
"shared_type": "",
"usr_udf_companyname": "",
"shared_with": "",
"tss_fail_reason": "",
"usr_udf_supervisorid": "",
"browser_version": "",
"usr_udf_employeeid": ""
}
Alertes de remédiation
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/remediation
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "448ca50ee6142a954d64c577",
"access_method": "API Connector",
"acked": "true",
"action": "alert",
"activity": "Download",
"alert": "yes",
"alert_name": "Remediation alert",
"alert_type": "Remediation",
"app": "Clanwilliam Health",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 9,
"ccl": "poor",
"count": 1,
"device": "Other",
"dst_country": "NL",
"dst_geoip_src": 2,
"dst_latitude": 52.3759,
"dst_location": "Amsterdam",
"dst_longitude": 4.8975,
"dst_region": "North Holland",
"dst_zipcode": "1012",
"dstip": "31.186.239.8",
"file_size": 118585,
"file_type": "application/vnd.google-apps.document",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"object": "VTRapjqhGbaDXqHR",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 7.0",
"policy": "policy_ga34",
"request_id": "2459149802892628500",
"site": "Clanwilliam Health",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.8",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0268t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0268t@test.netskope.com",
"managementID": "",
"from_user": "",
"os_version": "",
"app_session_id": 0,
"malware_severity": "",
"actions_taken": "",
"transaction_id": 0,
"notify_template": "",
"page": "",
"browser_session_id": 0,
"src_time": "",
"tss_mode": "",
"managed_app": "",
"severity": "",
"nsdeviceuid": "",
"remediation_profile": "",
"dlp_profile": "",
"malware_name": "",
"endpoints": "",
"connection_id": 0,
"policy_id": "",
"endpoint_count": 0,
"dst_timezone": "",
"profile_hits": [],
"malware_id": "",
"hostname": "",
"edr_app": "",
"device_classification": "",
"userip": "",
"appsuite": "",
"protocol": "",
"incident_id": 0,
"src_timezone": "",
"sanctioned_instance": "",
"page_site": "",
"malware_type": "",
"all_policy_matches": []
}
Alertes d'évaluation de la sécurité
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/securityassessment
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "15bbca35f014e9618efdc629",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"activity": "Introspection Scan",
"alert": "yes",
"alert_name": "security-accessment-alert",
"alert_type": "Security Assessment",
"app": "LinkedIn",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "medium",
"count": 1,
"device": "Other",
"dst_country": "FR",
"dst_geoip_src": 1,
"dst_latitude": 48.883411,
"dst_location": "Puteaux",
"dst_longitude": 2.23894,
"dst_region": "Ile-de-France",
"dstip": "193.248.155.211",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "OlWmGNTVpEVLCgWo",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"sa_profile_id": 1,
"sa_profile_name": "CRzpqYgDBoKRThmb",
"sa_rule_id": "icveiWoIMGqmEfUy",
"sa_rule_name": "RLYnpTzcFeiRcQYr",
"sa_rule_severity": "High",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "LinkedIn",
"src_country": "FR",
"src_geoip_src": 1,
"src_latitude": 48.883411,
"src_location": "Puteaux",
"src_longitude": 2.23894,
"src_region": "Ile-de-France",
"srcip": "193.248.155.211",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Alertes CTEP
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/ctep
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_correlation_id": "d54406dc-5457-4699-8754-c8eece88a804",
"_event_id": "8de38a44-4ae5-44ac-a097-f9e3ce2aac2a",
"_forwarded_by": "na",
"_generator_id": "ad4c77a8-ac83-4493-936c-8d6394038556",
"_id": "d62273697847e13a884e7562",
"_insertion_epoch_timestamp": 1727659690,
"_raw_event_inserted_at": 1676185709059,
"_seq_id": 117219,
"_service_identifier": "na",
"_skip_geoip_lookup": "yes",
"access_method": "API Connector",
"acked": "false",
"action": "block",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "c2",
"alert_type": "c2",
"app": "X3host",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 16,
"ccl": "poor",
"count": 1,
"device": "11-inch iPad Pro",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 45.8234,
"dst_location": "Boardman",
"dst_longitude": -119.7257,
"dst_region": "Oregon",
"dst_zipcode": "97818",
"dstip": "52.218.153.131",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 118783,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"legal_hold_profile_name": "oejTJocnOabNirPx",
"lh_custodian_email": "ELGkdoczLAkrQMuq",
"lh_custodian_name": "iRwQlRYvjwsFlVpg",
"lh_dest_app": "dOkImPvoHqwfXFaU",
"lh_dest_instance": "LKMHXgSCmGTmVbZL",
"lh_fileid": "taAjyAQRSWraghfP",
"lh_filename": "rsjjtAjqpCcYjaOU",
"lh_filepath": "IhYDbjTXhzqtUZeD",
"lh_original_filename": "vWijvCFegHYDULbn",
"lh_shared": "WCLXYCUEBjqOlWHt",
"lh_shared_with": "SwUYQdzFHslSQoxr",
"lh_version": 1,
"local_sha256": "fd856057ed7703e9b53458c7dbb6a3dc4ce9b957f3b307d81f06bf09c9bd8de3",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "OLizsiNCpTCziLEC",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "iOS 9.6",
"other_categories": [],
"owner": "dte1953ce410-0778t@test.netskope.com",
"policy": "policy_ga13",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "X3host technologies",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.204",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0494t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0494t@test.netskope.com",
"userkey": "dte1953ce410-0494t@test.netskope.com"
}
Alertes Malsite
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malsite
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "01f6ca78bec577883076a738",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "bget.ru",
"alert_type": "malsite",
"app": "",
"app_session_id": 4910069257574835437,
"appcategory": "Security Risk - Compromised/malicious sites",
"browser_session_id": 1141245448937753175,
"category": "Security Risk - Compromised/malicious sites",
"cci": 0,
"ccl": "unknown",
"connection_id": 0,
"count": 1,
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "RU",
"dst_latitude": 59.9417,
"dst_location": "St Petersburg",
"dst_longitude": 30.3096,
"dst_region": "St.-Petersburg",
"dst_timezone": "Europe/Moscow",
"dst_zipcode": "195213",
"dstip": "5.101.158.143",
"dstport": 443,
"hostname": "ip-172-31-37-148",
"incident_id": 7989528656047608655,
"ja3": "07ff1e545ef8ab3fcf8a4dc9272221c2",
"ja3s": "NotAvailable",
"malicious": "yes",
"malsite_category": [
"Malicious Site"
],
"malsite_country": "RU",
"malsite_id": "ae7c3ade12353ae7165e9b2f",
"malsite_ip_host": "5.101.158.143",
"malsite_latitude": 59.9417,
"malsite_longitude": 30.3096,
"malsite_region": "St.-Petersburg",
"managed_app": "no",
"notify_template": "block_page.html",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 22.04",
"other_categories": [
"Security Risk",
"Security Risk - Compromised/malicious sites"
],
"page": "bget.ru/",
"page_site": "bget",
"policy": "TestMalsite2",
"policy_id": "F1AE7109B6FC54098C582D3B0F149521 2024-05-28 13:48:56.784091",
"protocol": "HTTPS/1.1",
"request_id": 2851228580036571136,
"severity_level": "med",
"severity_level_id": 1,
"site": "bget",
"src_country": "US",
"src_latitude": 39.0469,
"src_location": "Ashburn",
"src_longitude": -77.4903,
"src_region": "Virginia",
"src_time": "Tue May 28 10:07:00 2024",
"src_timezone": "America/New_York",
"src_zipcode": "20149",
"srcip": "18.209.94.135",
"telemetry_app": "",
"threat_match_field": "domain",
"threat_match_value": "bget.ru",
"threat_source_id": 1,
"timestamp": 1716905279,
"traffic_type": "Web",
"transaction_id": 7989528656047608655,
"type": "malsite",
"ur_normalized": "keshavhazard@gmail.com",
"url": "bget.ru/",
"user": "keshavhazard@gmail.com",
"useragent": "python-requests/2.25.1",
"userip": "172.31.37.148",
"record_type": "alert",
"malsite_reputation": "",
"object": "",
"org": "",
"fromlogs": "",
"log_file_name": "",
"req_cnt": 0,
"browser_version": "",
"numbytes": 0,
"department": "",
"division": "",
"retro_scan_name": "",
"sfwder": "",
"browser": "",
"custom_attr": {},
"malsite_confidence": 0,
"server_bytes": 0,
"client_bytes": 0,
"malsite_first_seen": 0,
"co": "",
"sAMAccountName": "",
"src_geoip_src": 0,
"gateway": "",
"referer": "",
"suppression_start_time": 0,
"resp_cnt": 0,
"conn_duration": 0,
"serial": "",
"malsite_hostility": "",
"dsthost": "",
"dst_geoip_src": 0,
"universal_connector": "",
"malsite_active": "",
"from_user": "",
"object_type": "",
"suppression_end_time": 0,
"malsite_last_seen": 0,
"severity": "",
"aggregated_user": "",
"malsite_consecutive": "",
"appsuite": ""
}
Alertes politiques
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/policy
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3ceffe626afca6f5d46befb6",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "testprivateapp with2nd opt",
"alert_type": "policy",
"app": "[ExtraHop-Demo]",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"client_bytes": 0,
"client_packets": 0,
"count": 1,
"device": "Windows",
"dsthost": "netskope.atlassian.net",
"dstip": "",
"dstport": 443,
"end_time": "2025-02-28T08:22:47+00:00",
"hostname": "WIN11-50-12-151",
"ip_protocol": "TCP",
"network_session_id": "9452921695540616650",
"num_sessions": 1,
"numbytes": 0,
"organization_unit": "",
"os": "Windows",
"os_version": "11.0.22621",
"other_categories": [],
"policy": "testprivateapp with2nd opt",
"protocol": "Http",
"protocol_port": "TCP:443",
"publisher_cn": "",
"publisher_name": "",
"server_bytes": 0,
"server_packets": 0,
"session_duration": 0,
"site": "netskope.atlassian.net",
"srcip": "",
"srcport": 30700,
"start_time": "2025-02-28T08:22:32+00:00",
"timestamp": 1740731072,
"total_packets": 0,
"traffic_type": "PrivateApp",
"tunnel_id": "53125",
"tunnel_type": "NPA",
"tunnel_up_time": 0,
"type": "network",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userip": "",
"record_type": "alert",
"suppression_key": "",
"app_activity": "",
"file_type": "",
"url": "",
"policy_id": "",
"custom_connector": "",
"quarantine_profile": "",
"q_original_shared": "",
"file_path": "",
"profile_emails": [],
"referer": "",
"md5": "",
"redirect_url": "",
"page_site": "",
"malware_name": "",
"suppression_end_time": 0,
"user_id": "",
"distinguishedName": "",
"severity": "",
"src_timezone": "",
"tss_mode": "",
"managed_app": "",
"tss_fail_reason": "",
"src_geoip_src": 0,
"owner": "",
"aggregated_user": "",
"group": "",
"total_collaborator_count": 0,
"userCountry": "",
"browser": "",
"to_user": "",
"from_object": "",
"ext_labels": [],
"shared_with": "",
"useragent": "",
"sessionid": "",
"network": "",
"malicious": "",
"quarantine_file_id": "",
"appsuite": "",
"remediation_profile": "",
"universal_connector": "",
"mime_type": "",
"browser_version": "",
"src_zipcode": "",
"access_key_id": "",
"src_latitude": 0.0,
"malware_type": "",
"dynamic_classification": "",
"src_region": "",
"q_original_version": "",
"instance_id": "",
"message_id": "",
"sfwder": "",
"q_admin": "",
"q_app": "",
"object_type": "",
"log_file_name": "",
"malware_severity": "",
"retro_scan_name": "",
"displayName": "",
"justification_reason": "",
"q_instance": "",
"src_location": "",
"gateway": "",
"forward_to_proxy_xau": "",
"justification_type": "",
"smtp_to": [],
"app_session_id": 0,
"request_id": 0,
"app_scopes": "",
"parent_id": "",
"file_category": "",
"file_id": "",
"dlp_profile": "",
"nsdeviceuid": "",
"risk_level": "",
"encrypt_failure": "",
"quarantine_file_name": "",
"src_longitude": 0.0,
"file_size": 0,
"org": "",
"user_tmp": "",
"activity_status": "",
"threat_match_value": "",
"malsite_category": [],
"dst_timezone": "",
"all_policy_matches": [],
"incident_id": 0,
"orignal_file_path": "",
"object_id": "",
"act_user": "",
"http_status": "",
"dst_country": "",
"from_user": "",
"req_cnt": 0,
"transaction_id": 0,
"browser_session_id": 0,
"sanctioned_instance": "",
"from_storage": "",
"tss-mode": "",
"cc": "",
"activity": "",
"sAMAccountName": "",
"scan_type": "",
"serial": "",
"src_time": "",
"managementID": "",
"object": "",
"q_original_filepath": "",
"custom_attr": {},
"shared_domains": "",
"q_original_filename": "",
"notify_template": "",
"connection_id": 0,
"telemetry_app": "",
"threat_source_id": 0,
"user_confidence_index": 0,
"TSS-scan": "",
"internal_collaborator_count": 0,
"last_name": "",
"mail": "",
"sAMAccountType": "",
"memberOf": "",
"smtp_status": "",
"Title": "",
"dst_location": "",
"bcc": "",
"dst_geoip_src": 0,
"exposure": "",
"activity_type": "",
"dlp_fail_reason": "",
"dst_zipcode": "",
"message_size": 0,
"suppression_start_time": 0,
"trust_computer_checked": "",
"device_classification": "",
"instance": "",
"to_storage": "",
"dst_latitude": 0.0,
"division": "",
"object_count": 0,
"to_object": "",
"modified": 0,
"sender": "",
"dst_region": "",
"page": "",
"conn_duration": 0,
"two_factor_auth": "",
"dst_longitude": 0.0,
"data_type": "",
"quarantine_profile_id": "",
"malware_id": "",
"manager": "",
"src_country": "",
"event_type": "",
"external_collaborator_count": 0,
"resp_cnt": 0,
"threat_match_field": "",
"tss_scan_failed": "",
"dlp_scan_failed": "",
"sha256": ""
}
Alertes de quarantaine
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/quarantine
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "63d6a681f0d64a6f41cc084c",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "quarantine-sahil",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "quarantine-alert",
"alert_type": "quarantine",
"app": "Dropbox",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 81,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 33.1432,
"dst_location": "San Marcos",
"dst_longitude": -117.1666,
"dst_region": "California",
"dst_zipcode": "92069",
"dstip": "98.176.143.16",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "weclTNVzKoULFCYX",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"q_admin": "KgBNclCNvMfSfwAe",
"q_app": "Box",
"q_instance": "IXlwfxAfRQMyUbso",
"q_original_filename": "huSgEkeGhFjPDLhS",
"q_original_filepath": "oJmMLhuvhIyXlarC",
"q_original_shared": "private",
"q_original_version": "1",
"q_shared_with": "PqtCjqtPLVOOFkWk",
"quarantine_action_reason": "TuJbfomareEgmNNT",
"quarantine_app": "Amazon S3",
"quarantine_failure": "mDsCCrKldEQdhrEF",
"quarantine_file_id": "jeCCFYBKuaBggvol",
"quarantine_file_name": "GEXNzZEGpZFQAuUv",
"quarantine_profile": "fQECcfyXhgGUOJSO",
"quarantine_profile_id": "xfFlQTBQWxjnIsXZ",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "Dropbox",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Alertes UBA
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/uba
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "b7dce8f570123bdd868a8315",
"access_method": "UCI Impact API",
"acked": "false",
"action": "anomaly_detection",
"activity": "ActivityForUciImpactAPI",
"alert": "yes",
"alert_id": "505464b05529c82e34d31970",
"alert_name": "External alert from Netskope due to Risky User",
"alert_type": "uba",
"anomaly_type": "Fact",
"app": "",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"count": 1,
"createdTime": "2025-02-24 08:15:55.461000",
"device": "Other",
"event_type": "uba_analytics",
"instance_id": "",
"organization_unit": "",
"policy": "External alert received via REST API",
"score": 1,
"severity": "informational",
"src_country": "IN",
"src_geoip_src": 2,
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_zipcode": "380009",
"srcip": "122.170.162.148",
"timestamp": 1740384954,
"type": "nspolicy",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userkey": "tanushree.kurup@crestdata.ai",
"windowId": 1740355200000,
"record_type": "alert",
"last_device": "",
"surhn": "",
"policy_id": "",
"uba_ap1": "",
"evt_src_chnl": "",
"all_policy_matches": [],
"threshold": 0,
"web_universal_connector": "",
"user_category": "",
"managementID": "",
"division": "",
"download_app": "",
"user_id": "",
"dst_longitude": 0.0,
"audit_type": "",
"object_count": 0,
"policy_name": "",
"activity_status": "",
"group": "",
"act_user": "",
"referer": "",
"connection_id": 0,
"app_category": "",
"bin_timestamp": 0,
"hostname": "",
"app_activity": "",
"md5": "",
"risk_level_id": 0,
"suppression_end_time": 0,
"protocol": "",
"request_type": "",
"request_id": 0,
"app_session_id": 0,
"User_SPACE_Id": "",
"user_name": "",
"last_timestamp": 0,
"netskope_activity": "",
"dst_geoip_src": 0,
"tss_scan_failed": "",
"loginurl": "",
"threshold_time": 0,
"risk_level": "",
"managed_app": "",
"browser_version": "",
"file_category": "",
"from_user_category": "",
"page": "",
"last_location": "",
"url": "",
"uba_ap2": "",
"sanctioned_instance": "",
"object_id": "",
"dst_timezone": "",
"custom_attr": {},
"to_object": "",
"dst_country": "",
"traffic_type": "",
"telemetry_app": "",
"page_site": "",
"file_size": 0,
"scopes": [],
"anomalyData": {},
"os": "",
"audit_category": "",
"tss_fail_reason": "",
"userip": "",
"last_app": "",
"incident_id": 0,
"suppression_start_time": 0,
"dst_zipcode": "",
"dstip": "",
"policy_actions": [],
"browser": "",
"src_time": "",
"sAMAccountName": "",
"two_factor_auth": "",
"uba_inst2": "",
"site": "",
"displayName": "",
"sha256": "",
"object": "",
"last_country": "",
"to_user": "",
"object_type": "",
"manager": "",
"last_region": "",
"dst_region": "",
"dst_latitude": 0.0,
"shared_credential_user": "",
"file_type": "",
"tss_mode": "",
"appsuite": "",
"device_classification": "",
"logintype": "",
"AccountType": "",
"os_version": "",
"parent_id": "",
"TSS-scan": "",
"user_role": "",
"dst_location": "",
"to_user_category": "",
"user_confidence_index": 0,
"mail": "",
"browser_session_id": 0,
"src_timezone": "",
"useragent": "",
"employeeType": "",
"from_user": "",
"uba_inst1": "",
"User_SPACE_Name": "",
"userPrincipalName": "",
"transaction_id": 0,
"distinguishedName": "",
"profile_id": ""
}
Alertes de la liste de surveillance
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/watchlist
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "ad921f96aaf7dc5b6fe5d628",
"access_method": "API Connector",
"acked": "true",
"activity": "Upload",
"alert": "yes",
"alert_name": "watchlist fired",
"alert_type": "watchlist",
"app": "Amazon App Suite",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 89,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "IN",
"dst_geoip_src": 2,
"dst_latitude": 19.0748,
"dst_location": "Mumbai",
"dst_longitude": 72.8856,
"dst_region": "Maharashtra",
"dst_zipcode": "400072",
"dstip": "182.75.130.70",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 119268,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "aa477dd147d603cd0bd65b6dfb09021654e212aa3200ceb03e3a1e1d0fb37fdb",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "uVwtiXcnOjCdpJHt",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 8.0",
"owner": "dte1953ce410-0545t@test.netskope.com",
"policy": "policy_ga26",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Amazon App Suite",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0191t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0191t@test.netskope.com",
"userkey": "dte1953ce410-0191t@test.netskope.com",
"dst_timezone": "",
"two_factor_auth": "",
"dlp_fail_reason": "",
"title": "",
"conn_duration": 0,
"shared_domains": "",
"user_id": "",
"notify_template": "",
"severity_id": 0,
"TSS-scan": "",
"universal_connector": "",
"to_user_category": "",
"web_url": "",
"severity": "",
"netskope_activity": "",
"malware_severity": "",
"dlp_is_unique_count": "",
"sAMAccountName": "",
"hostname": "",
"sanctioned_instance": "",
"object_count": 0,
"dlp_rule": "",
"protocol": "",
"file_id": "",
"audit_type": "",
"internal_collaborator_count": 0,
"dlp_scan_failed": "",
"appsuite": "",
"dlp_rule_severity": "",
"telemetry_app": "",
"to_user": "",
"true_obj_category": "",
"useragent": "",
"shared_with": "",
"justification_reason": "",
"dlp_parent_id": 0,
"referer": "",
"src_timezone": "",
"connection_id": 0,
"app_session_id": 0,
"from_user_category": "",
"client_bytes": 0,
"malware_name": "",
"total_collaborator_count": 0,
"policy_id": "",
"workspace": "",
"data_type": "",
"dlp_profile": "",
"act_user": "",
"malware_profile": "",
"file_name": "",
"fromlogs": "",
"ml_detection": "",
"app_activity": "",
"malware_id": "",
"dstport": 0,
"transaction_id": 0,
"detection_engine": "",
"to_storage": "",
"parent_id": "",
"managed_app": "",
"external_collaborator_count": 0,
"nsdeviceuid": "",
"tss_fail_reason": "",
"managementID": "",
"workspace_id": "",
"true_obj_type": "",
"justification_type": "",
"aggregated_user": "",
"network": "",
"org": "",
"page_site": "",
"userPrincipalName": "",
"tss_mode": "",
"suppression_end_time": 0,
"true_type_id": 0,
"server_bytes": 0,
"manager": "",
"suppression_start_time": 0,
"file_category": "",
"app_name": "",
"audit_category": "",
"incident_id": 0,
"serial": "",
"resp_cnt": 0,
"browser_version": "",
"all_policy_matches": [],
"enterprise": "",
"numbytes": 0,
"device_classification": "",
"from_object": "",
"dlp_rule_count": 0,
"dsthost": "",
"src_time": "",
"user_category": "",
"browser_session_id": 0,
"sfwder": "",
"scanner_result": "",
"dlp_file": "",
"os_version": "",
"to_object": "",
"malware_type": "",
"log_file_name": "",
"web_universal_connector": "",
"enterprise_id": "",
"dlp_incident_id": 0,
"from_user": "",
"userip": "",
"page": "",
"req_cnt": 0,
"from_storage": "",
"tss_scan_failed": "",
"local_md5": ""
}
périphérique Alertes
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/périphérique
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "983681ec8804b23e77c2c292",
"access_method": "Endpoint",
"action": "block",
"activity": "Insert",
"alert": "yes",
"alert_name": "TestBlock",
"alert_type": "Device",
"computer_name": "N49J4M9T3C",
"count": 1,
"device_classification": "not configured",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"policy": "TestBlock",
"policy_action": "block",
"policy_name_enforced": "TestBlock",
"timestamp": 1720005433,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_id": "USB\\VID_03f0&PID_1985&REV_0110",
"usb_device_name": "USB Flash Drive",
"usb_device_sn": "070D2C206FCFA597",
"usb_device_type": "usb mass storage",
"usb_product_id": "6533",
"usb_vendor_id": "HP",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"connection_type": "",
"driver": "",
"os_user_name": "",
"usb_is_encrypted": false,
"location": "",
"custom_attr": {}
}
Alertes sur le contenu
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/content
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3f14cdb17c8385f9a6acfab4",
"access_method": "Endpoint",
"action": "block",
"activity": "Create",
"alert": "yes",
"alert_name": "mmm1",
"alert_type": "Content",
"app": "DesktopServicesHelper",
"computer_name": "N49J4M9T3C",
"count": 1,
"destination_file_directory": "/Volumes/KALI LINUX",
"destination_file_name": "urls.txt",
"destination_file_path": "/Volumes/KALI LINUX/urls.txt",
"device_classification": "not configured",
"dlp_incident_id": 8329186087212438192,
"dlp_profile": "DLPTest",
"file_size": 52483,
"file_type": "Plain Text file",
"incident_id": 8329186087212438192,
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"os_user_name": "kmaheshwari",
"pid": "0",
"policy": "mmm1",
"policy_action": "block",
"policy_name_enforced": "mmm1",
"process_name": "DesktopServicesHelper",
"process_path": "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources",
"sha256": "23a129d56da1579a68862808a22b7b3e1d64682cc7d4c725fdc8a8c7980310b6",
"site": "DesktopServicesHelper",
"timestamp": 1719993896,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_type": "usb mass storage",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"custom_attr": {},
"process_cert_subject": "",
"device": ""
}
Incidents
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/incident
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "6d462e0db470c7247e75322fd380031271d1be18db9d707ef6f3affc792f11b1",
"access_method": "Endpoint Protection",
"acting_user": "kmaheshwari@netskope.com",
"activity": "Create",
"app": "DesktopServicesHelper",
"assignee": "None",
"dlp_incident_id": 7268524954762607217,
"dlp_match_info": [
{
"dlp_action": "block",
"dlp_forensic_id": 1711868037568704387,
"dlp_policy": "mmm1",
"dlp_profile_name": "DLPTest",
"dlp_rules": []
}
],
"file_path": "/Volumes/KALI LINUX/urls.txt",
"file_size": 52483,
"file_type": "Plain Text file",
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"object": "urls.txt",
"object_id": "hash_kmaheshwari@netskope.com_da3faaff0b406f6aa4685aee47ece41c_7b4a2e1f194ccb4e8eca958a472bfe3c3741d7a6",
"severity": "Low",
"status": "new",
"timestamp": 1719993903,
"title": "urls.txt",
"user": "kmaheshwari@netskope.com",
"record_type": "incident",
"instance": "",
"src_location": "",
"app_session_id": 0,
"zip_file_id": "",
"connection_id": 0,
"destination_site": "",
"to_user": "",
"latest_incident_id": 0,
"from_user": "",
"site": "",
"dst_location": "",
"inline_dlp_match_info": [],
"destination_instance_id": "",
"instance_id": "",
"channel": "",
"original_file_snapshot_id": "",
"bcc": "",
"referer": "",
"dlp_file": "",
"destination_app": "",
"true_obj_type": "",
"file_lang": "",
"url": "",
"true_obj_category": "",
"cc": "",
"owner_pdl": "",
"classification": "",
"object_type": "",
"ext_labels": [],
"exposure": "",
"dlp_parent_id": 0,
"owner": "",
"user_id": ""
}
La criminalistique des incidents
API Endpoint: https://<tenant-url>/api/v2/incidents/dlpincidents/{id}/forensics
Method: OBTENIR
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Request Parameters
| Clé | Value |
|---|---|
| dlp_incident_id in path param | dlp_incident_id |
Sample API Response4
{
"status": "success",
"data": {
"meta": "{\"metadata_content\":\"filename: sensitive_data_onedrive_share.txt file_md5: 0bcafac7ce40ad3ebad1664307a046f1 file_type: text/plain file_lang: ENGLISH object_id: {\\\"drive_id\\\": \\\"b!PM0toX-2uEqSwuqUx0SzyDAe0n7GMw1Eok5wsoIE5ALI55tDhn-rSJB-vB4UWs5e\\\", \\\"driveitem_id\\\": \\\"014GLSS7Z2KV57XD3LXNFLWFO3HXHVREJB\\\", \\\"site_collection_id\\\": \\\"a12dcd3c-b67f-4ab8-92c2-ea94c744b3c8\\\"} ns_text_classifier: others \",\"dlp_match_info\":[{\"dlp_profile_name\":\"DLP-PCI\",\"dlp_rules\":[{\"dlp_rule_name\":\"Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":3,\"dlp_data_identifiers\":[[{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"Number\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":78,\"score\":1,\"end_offset\":93,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"378282XXXXX0005\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":96,\"score\":1,\"end_offset\":110,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"371449XXXXX8431\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"371449XXXXX8431\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"},{\"dlp_profile_name\":\"US Financial Data\",\"dlp_rules\":[{\"dlp_rule_name\":\"US-Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":2,\"dlp_data_identifiers\":[[{\"start_offset\":19,\"score\":1,\"end_offset\":29,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"Type\\n\\n\",\"match\":\"Credit Card\",\"suffix\":\" Number\"},{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"3714XXXXXXXX31\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"},{\"start_offset\":203,\"score\":1,\"end_offset\":213,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"...5610591081018250\\n\\n\\n\\n\",\"match\":\"Diners Club\",\"suffix\":\"\\n\\n30569309025904\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"}]}",
"content": " Credit Card Type\n\nCredit Card Number\n\n\n\nAmerican Express\n\n37XXXXXXXXX0005\n\n\n\nAmerican Express\n\n37XXXXXXXXX8431\n\n\n\nAmerican Express Corporate\n\n37XXXXXXXXX1000\n\n\n\nAustralian BankCard\n\n5610XXXXXXXX50\n\n\n\nDiners Club\n\n30569XXXXXXXX5904\n\n\n\nDiners Club\n\n3852XXXXXXXX37\n\n\n\nDiscover\n\n60111XXXXXXXX117\n\n\n\nDiscover\n\n6011XXXXXXXX424\n\n\n\nJCB\n\n35301XXXXXXXX00\n\n\n\nJCB\n\n356XXXXXXXX05\n\n\n\nMasterCard\n\n555XXXXXXXX444\n\n\n\nMasterCard\n\n5105XXXXXXXX00\n\n\n\nVisa\n\n41XXXXXXXX111\n\n\n\nVisa\n\n401XXXXXXXX1881\n\n\n\nVisa\n\n422XXXXXXXX222"
}
}
Événements de points de terminaison
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/endpoint
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "dffd23ac520f696e1c4bd020",
"access_method": "Endpoint",
"activity_type": "Process Start",
"alert": "no",
"alert_generated": false,
"computer_name": "win11-50-1-92",
"device_type": "Bluetooth File Transfer",
"os": "Windows",
"os_details": "Microsoft Windows 11 Pro 10.0.22621 64-bit",
"policy_action": "allow",
"process_name": "python.exe",
"process_path": "\\??\\C:\\Program Files\\Python312\\python.exe",
"sub_type": "SUBTYPE_DEVICE_CONTROL",
"timestamp": 1725847324,
"type": "endpoint",
"user": "shubham.singhal@crestdata.ai",
"record_type": "epdlp",
"executable_hash": "",
"location": "",
"device_sn": "",
"app": "",
"destination_file_name": "",
"printer_identifier": "",
"file_type": "",
"dlp_profile_name": "",
"dlp_profile": "",
"event_recovered": false,
"destination_file_path": "",
"dlp_incident_id": 0,
"device_name": "",
"source_file_directory": "",
"alert_type": "",
"process_cert_subject": "",
"policy_name": "",
"source_file_name": "",
"incident_id": 0,
"action": "",
"policy_name_enforced": "",
"policy_version": "",
"executable_signed": false,
"file_size": 0,
"justification": "",
"product_id": "",
"vendor_id": "",
"device_id": "",
"destination_file_directory": "",
"dlp_rule": "",
"device": "",
"alert_name": "",
"pid": "",
"port": "",
"connection_type": "",
"sha256": "",
"policy_action_enforced": "",
"activity": "",
"driver": "",
"unc_path": "",
"file_origin": "",
"os_user_name": "",
"md5": ""
}
Mise à jour des événements de l'incident
API Endpoint: https://<tenant-url>/api/v2/incidents/update
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Request Payload
{
"payload": [
{
"field": "status",
"new_value": "in_progress",
"object_id": "incident_object_id",
"old_value": "new",
"user": "user@domain.com"
}
]
}
Sample API Response
{
"result": [
{
"ok": 1,
"result": "string"
}
]
}
Matrice de performance
Ces relevés sont collectés sur une pile d'échange de nuages (Large Cloud Exchange Stack) répondant à ces spécifications.
Exécution de performances pour l'extraction et le stockage de 200 000 alertes/événements dans Cloud Exchange.
| Description | Spécifications |
|---|---|
| Détails de la pile | Taille : Grande RAM : 32 GB CPU : 16 cœurs |
| Enregistrement d'alertes/événements par minute | ~ 120k |
Notes
- Pour atteindre les performances ci-dessus, nous augmentons le nombre de travailleurs dans le noyau, sinon la performance moyenne serait d'environ 60 000 événements/alertes par minute.
- Ce chiffre représente la performance moyenne pour tous les types d'alertes et d'événements ; toutefois, le taux de récupération des incidents peut être inférieur à la moyenne, avec un taux estimé d'environ 1 500 incidents par minute.
Agent utilisateur
netskope-ce-6.1.0
Workflow
- Configurez le plugin Ticket Orchestrator.
- Configurez une règle de gestion.
- Configurez une file d'attente avec un plugin tiers (comme Jira).
- Validez le plugin.
Regardez une vidéo
Cliquer sur « play » pour regarder une vidéo.
Configurer le plugin Ticket Orchestrator
-
In Cloud Exchange, go to Settings > General and enable the Ticket Orchestrator module.
-
In Settings, go to the Plugin Store. Search for and select the Netskope Ticket Orchestrator v2.5.0 (CTO) plugin.
-
Saisissez un nom de configuration et sélectionnez un locataire Netskope configuré dans le menu déroulant.
Note
Update incident back to Netskope Tenant toggle needs to be enabled to use the resolve incident queue configuration.
-
Cliquez sur Next et saisissez les valeurs des paramètres de configuration.
- Alert Types: Selected types of alerts will be fetched.
- Initial Range for Alerts (in days): Nombre de jours pour extraire les données pour l'exécution initiale.
- Event Types: Selected types of event will be fetched.
- Initial Range for Events (in hours): Number of hours to pull the events data for the initial run.
- Alert/Event Query: Only the alerts/events matching this filter query will be stored and considered for ticket creation. If kept blank all the Alerts and Events will be considered for ticket creation.
- Pull DLP Incident Forensics: Forensics fields for DLP Incidents will be fetched.
Note
- By default Forensics Originalfile Url (forensics_originalfile_url) and Forensics Subfile Url (forensics_subfile_url) fields will be included irrespective of whether Pull DLP Incident Forensics is YES or NO.
- Si le plugin Netskope Ticket Orchestrator ou le plugin Netskope Log Shipper a le champ "Pull DLP (Prévention des pertes de données) Incident Forensics" défini sur Oui, les deux plugins récupéreront automatiquement les champs forensiques pour les événements d'incident.
- Keeping the Pull DLP Incident Forensics field as Yes might impact the performance of the Netskope log shipper plugin as it will make additional API calls that will impact the performance of the plugin.
- Any change in the value of the “Pull DLP Incident Forensics” field will not be respected once the plugin is configured, unless you restart the core or delete the Tenant plugin and CTO Netskope Ticket Orchestrator plugin and re-configure both the plugins.
-
Click Next and configure mapping details for updating Incidents.
Note
For the Netskope Tenant Fields, you will have to provide the exact values that are used on the Netskope Tenant and expected by the Netskope Tenant’s API.
-
Pour créer un champ New Netskope CE pour un statut ou une gravité personnalisés, cliquez sur Add New sous n'importe quel champ Netskope CE.
-
Saisissez le nom du champ et cliquez sur Add Field.
-
Click Add to add a new row under Mapping. Select the newly added field and map it with Netskope Tenant fields per your need.
Note
De même, vous pouvez créer un champ New dans la section Gravité et l'associer à la gravité requise.
-
Cliquez sur Save.
Créer une règle de gestion pour Ticket Orchestrator
-
Allez à Business Rules et cliquez sur Create New Rule.
-
Enter the Rule name and create a filter query.
-
Cliquez sur Save.
Ajouter une file d'attente pour Ticket Orchestrator
-
Allez à Ticket Orchestrator > Queues et cliquez sur Add Queue Configuration.
-
Select the Business Rule, a Configuration (your Netskope Ticket Orchestratorplugin), and Resolve Incident for Queue.
Note
- Keep the Require Approval toggle enabled if you want to manually approve the execution of each resolve incident action on the Tickets page.
- Resolve incident action will be performed based on Update Incidents back to the Netskope Tenant toggle and the Sharing Sync Interval set in the plugin configuration.
- The Resolved Incident action will be supported with the Ticket Orchestrator plugin v2.5.0 and CE v6.1.0.
-
Cliquez sur Save.
Validez le plugin Ticket Orchestrator
Validez la présence d'alertes dans votre locataire Netskope
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Alerts > Filters et sélectionnez les x derniers jours en fonction de vos besoins.
Validez la présence d'événements d'incidents dans votre locataire
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Incidents > DLP et sélectionnez les x derniers jours en fonction de vos besoins.
Validez les événements de point de terminaison présents dans votre locataire
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Skope IT > Endpoint Events et sélectionnez les x derniers jours en fonction de vos besoins.
Valider le retrait
Pour valider l'extraction des alertes et des événements du locataire Netskope, vous devez d'abord vérifier les journaux d'alertes et d'événements extraits.
Allez sur Logging et ajoutez un filtre en utilisant le nom du plugin. Vous pouvez également utiliser cet exemple de filtre : message Like "pulled" && message Like "CTO Netskope Ticket Orchestrator".
Pour valider le stockage des alertes dans le Cloud Exchange, rendez-vous à Ticket Orchestrator > Alerts.
Pour valider le stockage des événements dans Cloud Exchange, rendez-vous sur Ticket Orchestrator > Events.
Allez sur le site Ticket Orchestrator > Tickets et vérifiez les billets créés.
Validez la mise à jour de l'incident sur Netskope à partir de Cloud Exchange.
La mise à jour des incidents ne fonctionne que si l'utilisateur a activé l'option Update Incidents back to the Netskope Tenant pour ce plugin et se produit à l'intervalle de synchronisation configuré. Lorsque le ticket est mis à jour sur une plateforme tierce (comme Jira), Cloud Exchange synchronisera le statut mis à jour (à l'intervalle de synchronisation du plugin tierce partie), et après cela, il initiera la mise à jour de l'incident sur les locataires Netskope.
- Allez sur le site Ticket Orchestrator > Tickets et vérifiez les billets créés.
- Développez le type d'incident et vérifiez l'état de synchronisation de l'incident.
- Allez sur Incidents > DLP et sélectionnez l'incident qui a été mis à jour depuis Cloud Exchange.
- Cliquez sur Check Object History.
- Vérifiez l'incident mis à jour dans l'historique.
Note
Si le plugin tiers ne prend pas en charge la synchronisation de la gravité, le Ticket Orchestrator ne mettra pas à jour la gravité sur le poste Netskope, et vous pourrez observer des erreurs dans Cloud Exchange pour avoir ignoré une mise à jour de la gravité sur le poste Netskope.
Example for resolved incident on Netskope Tenant.
Dépannage du plugin Ticket Orchestrator
Réception d'une erreur lors de la configuration de Ticket Orchestrator
J'obtiens l'erreur suivante : Le jeton Netskope tenant API V2 n'a pas les autorisations nécessaires configurées. Consultez la liste des points de terminaison pour lesquels le jeton n'a pas de permission. **
Cause: Le jeton V2 fourni n'a pas les autorisations minimales requises pour configurer le locataire dans Cloud Exchange.
What to do:
- Allez sur Logging et recherchez un journal d'avertissement similaire au modèle suivant :
TENANT Netskope Tenant (requis) [Netskope Tenant] : Pour Netskope Tenant, a reçu une erreur 403 pour le(s) point(s) d'extrémité suivant(s). - Développez le journal et obtenez la liste des points de terminaison pour lesquels les autorisations sont manquantes.
- Mettez à jour les autorisations du jeton v2 et ajoutez l'autorisation pour la liste de points de terminaison ci-dessus à partir du tableau de bord Netskope.
Getting the error: Invalid status mapping provided.
Cause: Le plugin configuré n'est pas la dernière version.
What to do:
Allez sur la page du dépôt de plugins et récupérez le dernier plugin pour le configurer.
Réception d'une erreur dans les règles de gestion configurées
Si vous obtenez des erreurs dans les règles de gestion configurées, comme la détection d'un type de champ non valide, reconfigurez la règle de gestion à l'aide du bouton Modifier.
Cause: La règle de gestion configurée comporte un champ dont le type de données a été modifié/mise à jour.
What to do:
Cliquez sur Modifier pour éditer la règle de gestion, puis sélectionnez le même champ avec l'opérateur approprié pour filtrer les alertes/événements.
Réception d'une erreur lors de la mise à jour du statut des incidents
J'obtiens l'erreur suivante : Une erreur s'est produite lors de la mise à jour du statut des incidents vers Netskope Tenant pour le lot n° x.
Cause: Le jeton V2 fourni ne dispose pas des autorisations minimales requises pour mettre à jour l'état des incidents dans le locataire Netskope.
What to do:
- Allez sur Logging et cherchez le message d'erreur concernant le plugin Ticket Orchestrator.
- Développez le journal et obtenez les informations concernant l'erreur
- Fournissez les autorisations de lecture et d'écriture /api/v2/incidents/update au jeton V2.
Resolve incident workflow is not working
It may be due to the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
What to do:
Enable the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
Comportements connus
Erreur lors de la suppression du plugin Netskope Ticket Orchestrator
Les utilisateurs rencontreront un message d'erreur lors de la suppression du plugin Ticket Orchestrator v2.3.0, la configuration sera supprimée mais la valeur de Pull DLP (Prévention des pertes de données) Incident Forensics ne sera pas supprimée de la configuration du locataire. Pour cette raison, si l'utilisateur supprime Ticket Orchestrator v2.3.0, et si vous voulez le reconfigurer, vous devez également supprimer le locataire configuré et configurer un nouveau locataire, ou vous devez configurer le plugin Ticket Orchestrator avec le même nom que vous avez utilisé précédemment (le nom de l'ancienne configuration du plugin peut être trouvé dans les logs sur la page Logging). Avant de configurer le plugin avec le même nom, veuillez vous référer au comportement connu ci-dessous.
| 08/06/2025 10:13:27 AM | CE_1049 | error | Une erreur s'est produite lors du traitement de la requête pour api/itsm/configurations. |
Netskope Le plugin Ticket Orchestrator tire les champs forensiques même si le champ Tirer DLP (Prévention des pertes de données) Incident Forensics est réglé sur Non ou vice-versa.
Cela peut être dû à l'une des raisons suivantes :
- Si le plugin Ticket Orchestrator ou le plugin Netskope Log Shipper a le champ Pull DLP (Prévention des pertes de données) Incident Forensics réglé sur Oui, les deux plugins récupèreront automatiquement les champs forensiques pour les événements d'incident.
- Toute modification de la valeur du champ Pull DLP (Prévention des pertes de données) Incident Forensics ne sera pas respectée une fois le plugin configuré, à moins que vous ne supprimiez le plugin Netskope Ticket Orchestrator ainsi que le plugin du locataire et que vous reconfiguriez les deux plugins.
- Si vous avez configuré Ticket Orchestrator avec le champ Pull DLP (Prévention des pertes de données ) Incident For ensics réglé sur Oui, et que vous supprimez la configuration de ce plugin, et que vous reconfigurez ensuite le Netskope Ticket Orchestrator avec le même nom ou un nom différent, mais avec le champ Pull DLP (Prévention des pertes de données) Incident Forensics réglé sur Non, alors le plugin continuera à tirer les champs forensics. Pour résoudre ce problème, vous devez supprimer le plugin Ticket Orchestrator ainsi que le locataire Netskope et reconfigurer les deux plugins.
Comportements liés à la bascule Mettre à jour les incidents vers le locataire Netskope
- Même si le plugin tiers ne prend pas en charge le stockage des champs Gravité ou Cessionnaire, le plugin CTO Netskope effectuera un appel API pour mettre à jour la Gravité ou le Cessionnaire de la valeur actuelle à une autre valeur.
- Si le champ Assignee contient un email ou une chaîne invalide, le ticket sur Netskope Tenant ne sera pas assigné.
- Le champ Statut peut être désélectionné dans l'interface utilisateur du locataire Netskope si le statut utilisé dans Netskope Cloud Exchange n'existe pas sur le locataire Netskope ou ne correspond pas exactement aux statuts présents sur le locataire Netskope.
- Nous avons observé plusieurs cas d'erreur 500 Internal Server Error lorsque nous essayons de mettre à jour la gravité des incidents au sein de notre locataire Netskope.
Le bouton Update Incidents back to the Netskope Tenant est désactivé après la mise à jour du plugin.
Si vous avez un plugin Netskope Ticket Orchestrator déjà configuré avec le bouton Update Incidents back to the Netskope Tenant activé, et que vous mettez à jour le plugin, ce bouton sera désactivé. Vous devez l'activer manuellement en modifiant la configuration du plugin après l'avoir mis à jour.
Behaviors related to resolve incident workflow
- To verify the incident action was successfully triggered, we need to check Incident Sync Status for the particular ticket.
- Users may observe logs for updating incidents on Netskope tenant at every sync interval.
- If the resolve incident action is triggered with ‘Update Incidents back to the Netskope Tenant’ toggle disabled then edit the plugin to enable Update Incidents back to the Netskope Tenant toggle, in this case the the incident ticket may not get resolved on the Netskope Tenant.
- If the incident on which resolve incident action is performed, is already in resolved state on Netskope tenant then Incident Sync Status will never get updated in Cloud Exchange.