Notes de mise à jour
2.5.1 (Requires minimum Cloud Exchange version 7.0.0 and minimum Netskope Provider version 1.7.0)
Corrigé
- Correction de la normalisation des données de champ afin que les valeurs liste/dict (comme
forensics_dlp_match_info) soient stockées sous forme de chaîne JSON valide plutôt que de chaîne littérale Python, permettant aux consommateurs en aval de les analyser via JSON.
2.5.0
Ajouté
- Ajout de la prise en charge de la résolution des incidents sur le locataire Netskope.
2.4.1
Corrigé
- Correction de la gestion des filtres « Is empty » (Est vide) dans les requêtes d'alerte/événement.
2.4.0
Ajouté
- Ajout de la prise en charge du mappage des champs personnalisés d'état et de gravité.
2.3.0
Ajouté
- Ajout du support pour extraire les champs médico-légaux pour les incidents DLP (Prévention des pertes de données). Pour extraire et ingérer ces champs, mettez à jour votre version Netskope locataire vers la 1.5.0 et la version CE vers la 5.1.2.
- Champs ajoutés pour télécharger le fichier original et le sous-fichier dans les événements d’incident.
2.2.0
Ajouté
- Plugin Netskope ITSM mis à jour pour préserver les types de données lors du stockage des alertes/événements.
2.1.0
Ajouté
- Ajout du support pour périphérique et des alertes de contenu.
2.0.0
Changed
- Le plugin ITSM de Netskope a été restructuré et est désormais disponible dans le dépôt par défaut.
1.0.0
Ajouté
- Initial release.
Ce document explique comment configurer le plugin Netskope Ticket Orchestrator v2.5.1 avec le module Ticket Orchestrator de la plate-forme Netskope Cloud Exchange. Ce plugin est utilisé pour extraire les alertes (DLP (Prévention des pertes de données), logiciels malveillants, politique, informations d'identification compromises, site malveillant, mise en quarantaine, remédiation, évaluation de la sécurité, liste de surveillance, UBA, CTEP, périphérique et contenu) et les événements (incident et point de terminaison) du locataire Netskope. Il prend également en charge la mise à jour et la résolution des incidents sur le locataire Netskope.
Conditions préalables
Pour compléter cette configuration, vous avez besoin de :
- Un locataire Netskope (ou plusieurs, par exemple des instances de production et de développement/test).
- A Cloud Exchange Tenant with the Netskope Tenant plugin and a 3rd-party plugin, like CTO Jira Plugin, already configured.
- Pour utiliser un gestionnaire de secrets, reportez-vous à Secrets Manager. Pour configurer Azure Key Vault, consultez les Prérequis pour Azure Key Vault Secrets Manager.
Note
| Fonctionnalité de Ticket Orchestrator | Version de Cloud Exchange | Version de Ticket Orchestrator | Tenant Plugin Version |
|---|---|---|---|
| Resolve Incident | 6.1.0 & above | 2.5.0 & above | 1.6.0 & above |
| Custom Mappings | 6.0.0 & ci-dessus | 2.4.0 & ci-dessus | 1.5.0 & ci-dessus |
| Apprentissage automatique sur le terrain | 5.1.1 & ci-dessus | 2.3.0 & ci-dessus | 1.3.0 & ci-dessus |
| DLP (Prévention des pertes de données) Incident Forensics | 5.1.2 & ci-dessus | 2.3.0 & ci-dessus | 1.5.0 & ci-dessus |
Support du plugin Ticket Orchestrator
Fetches Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, Content) and Events (Incident, Endpoint) from the Netskope tenant. Supports updating incidents back to the Netskope Tenant.
| Type de données | Description |
|---|---|
| Types d'alerte | Oui (DLP (Prévention des pertes de données), Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, CTEP, UBA, périphérique, Content) |
| Types d'événements | Yes (Incident, Endpoint) |
Mises en correspondance
Default Status Mappings
| Champs de Cloud Exchange | Netskope Tenant Fields |
|---|---|
| Nouveau | new |
| En cours | in_progress |
| En attente | – |
| Closed | closed |
| Deleted | closed |
| Autres | – |
Default Severity Mappings
| Champs de Cloud Exchange | Netskope Tenant Fields |
|---|---|
| Critique | Critique |
| Haut | Haut |
| Moyen | Moyen |
| Faible | Faible |
| Information | Faible |
| Autres | Faible |
Notes
- Si le champ Assignee contient un email ou une chaîne invalide, le ticket sur Netskope Tenant ne sera pas assigné.
- Le champ Statut peut être désélectionné dans l'interface utilisateur du locataire Netskope. Si le statut utilisé dans Netskope Cloud Exchange n'existe pas sur le poste Netskope ou ne correspond pas exactement aux statuts présents sur le poste Netskope.
Permissions
- Need V2 token created using the Netskope Cloud Exchange role.
- For Device and Content alerts, you will require the following permissions:
- /api/v2/events/dataexport/alerts/device(Read)
- /api/v2/events/dataexport/alerts/content(Read)
- Pour obtenir des données médico-légales sur des incidents, vous devez disposer de l'autorisation ci-dessous :
- /api/v2/incidents/dlpincidents(Read)
Détails de l'API
Liste des API utilisées
Alertes
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/v2/events/dataexport/alerts/compromisedcredential | OBTENIR | Retirez les alertes de compromission d'informations d'identification du locataire Netskope. |
| /api/v2/events/dataexport/alerts/dlp | OBTENIR | Pull DLP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malware | OBTENIR | Pull Malware Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/remediation | OBTENIR | Retirez les alertes de remédiation du locataire Netskope. |
| /api/v2/events/dataexport/alerts/securityassessment | OBTENIR | Retirez les alertes d'évaluation de la sécurité du locataire Netskope. |
| /api/v2/events/dataexport/alerts/ctep | OBTENIR | Pull CTEP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malsite | OBTENIR | Pull Malsite Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/policy | OBTENIR | Retirez les alertes de politique du locataire Netskope. |
| /api/v2/events/dataexport/alerts/quarantine | OBTENIR | Tirer les alertes de quarantaine du locataire Netskope. |
| /api/v2/events/dataexport/alerts/uba | OBTENIR | Pull UBA Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/watchlist | OBTENIR | Retirez les alertes de la liste de surveillance du locataire Netskope. |
| /api/v2/events/dataexport/alerts/device | OBTENIR | Tirez les alertes périphériques du locataire Netskope. |
| /api/v2/events/dataexport/alerts/content | OBTENIR | Tirer des alertes de contenu du locataire Netskope. |
Événements
| Point final de l'API | Méthode | Cas d'utilisation |
|---|---|---|
| /api/v2/events/dataexport/events/incident | OBTENIR | Extraire les événements d'incidents du locataire Netskope. |
| /api/v2/incidents/dlpincidents/{id}/forensics | OBTENIR | Tirer l'historique de l'incident par dlp_incident_id |
| /api/v2/events/dataexport/events/endpoint | OBTENIR | Extraire les événements de point de terminaison du locataire Netskope. |
| /api/v2/incidents/update | PATCH | Pour mettre à jour les incidents dans Netskope. |
Alertes relatives aux informations compromises
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/compromisedcredential
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "20575270a59c8ef1d85d535c",
"acked": "false",
"alert": "yes",
"alert_name": "Secret share",
"alert_type": "Compromised Credential",
"app": "Friend2Friend",
"category": "Cloud Storage",
"cci": 29,
"ccl": "poor",
"count": 1,
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"timestamp": 1727659690,
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0495t@test.netskope.com",
"user": "dte1953ce410-0495t@test.netskope.com",
"userkey": "dte1953ce410-0495t@test.netskope.com",
"division": "",
"external_email": 0,
"mail": "",
"sAMAccountName": "",
"password_type": "",
"userPrincipalName": "",
"breach_date": 0,
"sAMAccountType": "",
"breach_id": "",
"breach_score": "",
"department": "",
"employeeType": "",
"matched_username": "",
"breach_media_references": "",
"email_source": "",
"breach_description": "",
"breach_target_references": "",
"distinguishedName": ""
}
Alertes DLP (Prévention des pertes de données)
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/DLP (Prévention des pertes de données)
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "31365da11ecc94a0d7edfb6f",
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"alert": "yes",
"alert_name": "GDrive Customer metadata shared externally",
"alert_type": "DLP",
"app": "Google Drive",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "high",
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 1,
"dst_latitude": 37.40599060058594,
"dst_location": "Mountain View",
"dst_longitude": -122.0785140991211,
"dst_region": "California",
"dstip": "172.217.14.78",
"exposure": "organisation_wide_link",
"ext_labels": [
{
"data_classification_label": "pym/uducbb2126/encryption_level_11",
"id": "6e05576c-782b-42b4-b8f7-71dfb9ffb5a0",
"instance": "uducbb2126",
"name": "encryption_level_11",
"vendor": "pym"
},
{
"data_classification_label": "ydu/ldmwyo2852/encryption_level_11",
"id": "20c2b17d-7612-4349-b1e1-62d0d6b48ccb",
"instance": "ldmwyo2852",
"name": "encryption_level_11",
"vendor": "ydu"
},
{
"data_classification_label": "uwa/eqpoco8593/encryption_level_9",
"id": "6f77b892-3888-4148-8168-d954856d2fea",
"instance": "eqpoco8593",
"name": "encryption_level_9",
"vendor": "uwa"
}
],
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "edd7df8bb5a774a7531a389287a3bd71cf8e62197d93a205860003ed8339a4de",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "Tenant Migration across MPs",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "unknown",
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Google Drive",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1716551379,
"title": "Tenant Migration across MPs",
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "rowkuxqaxdxnlnlw",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "RoWkuxQAxDxNlNLw",
"userkey": "RoWkuxQAxDxNlNLw",
"record_type": "alert",
"page_site": "",
"act_user": "",
"src_longitude": 0.0,
"dst_timezone": "",
"device_classification": "",
"to_user": "",
"dlp_file": "",
"connection_id": 0,
"external_collaborator_count": 0,
"incident_id": 0,
"dlp_fingerprint_classification": "",
"activity": "",
"from_storage": "",
"user_confidence_index": 0,
"browser_version": "",
"dynamic_classification": "",
"smtp_to": [],
"dlp_rule_severity": "",
"shared_with": "",
"outer_doc_type": 0,
"orignal_file_path": "",
"channel": "",
"data_type": "",
"userip": "",
"sanctioned_instance": "",
"src_region": "",
"true_filetype": "",
"dlp_rule_count": 0,
"shared_domains": "",
"owner_pdl": "",
"dlp_unique_count": 0,
"transaction_id": 0,
"browser_session_id": 0,
"userCountry": "",
"bcc": "",
"displayName": "",
"srcip": "",
"dlp_mail_parent_id": "",
"hostname": "",
"classification_name": "",
"protocol": "",
"sAMAccountName": "",
"violating_user": "",
"manager": "",
"src_time": "",
"src_country": "",
"true_obj_category": "",
"message_size": 0,
"dlp_fingerprint_score": 0,
"src_geoip_src": 0,
"os_version": "",
"true_type_id": 0,
"to_storage": "",
"tss_mode": "",
"managed_app": "",
"file_password_protected": "",
"dlp_incident_id": 0,
"managementID": "",
"dlp_fingerprint_match": "",
"src_timezone": "",
"mail": "",
"total_collaborator_count": 0,
"from_user": "",
"app_activity": "",
"user_id": "",
"custom_attr": {},
"group": "",
"file_cls_encrypted": false,
"universal_connector": "",
"message_id": "",
"file_category": "",
"dlp_parent_id": 0,
"sub_type": "",
"src_latitude": 0.0,
"userPrincipalName": "",
"dlp_is_unique_count": "",
"dlp_rule_score": 0,
"src_zipcode": "",
"dlp_rule": "",
"referer": "",
"app_session_id": 0,
"parent_id": "",
"retro_scan_name": "",
"src_location": "",
"dst_zipcode": "",
"dlp_profile": "",
"true_obj_type": "",
"violating_user_type": "",
"policy_id": "",
"web_universal_connector": "",
"appsuite": "",
"severity": "",
"sha256": "",
"collaborated": "",
"page": ""
}
Alertes aux logiciels malveillants
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malware
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"TSS-scan": "TSS-Scan-V3",
"_id": "389551cd1bdaa1ae4947c334",
"access_method": "Client",
"acked": "false",
"action": "Detection",
"activity": "Browse",
"alert": "yes",
"alert_name": "GT:JS.Adware.Popunder.4.34B7F109",
"alert_type": "Malware",
"app": "hitomi",
"app_name": "hitomi",
"app_session_id": 4113602168491103340,
"appcategory": "Adult Content - Pornography",
"browser_session_id": 2610528494199657827,
"category": "Adult Content - Pornography",
"cci": "",
"ccl": "",
"connection_id": 5767115909713174088,
"count": 1,
"detection_engine": "Netskope AV",
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "UA",
"dst_latitude": 50.45465850830078,
"dst_location": "Kyiv",
"dst_longitude": 30.523799896240234,
"dst_region": "Kyiv",
"dst_timezone": "Europe/Kyiv",
"dst_zipcode": "N/A",
"dstip": "185.255.122.62",
"file_category": "Text",
"file_id": "1dda26cbf77944ccb931f3444b554c74",
"file_size": 2277,
"file_type": "text/html",
"hostname": "ub20-50-5-28",
"incident_id": 7718454634228557343,
"instance": "",
"local_md5": "cda70ab0130f915723a53a5d9270e7a5",
"malware_id": "3d81bec28fff68180bf8baa5727924ba",
"malware_name": "GT:JS.Adware.Popunder.4.34B7F109",
"malware_profile": "1",
"malware_severity": "high",
"malware_type": "Virus",
"managed_app": "no",
"md5": "cda70ab0130f915723a53a5d9270e7a5",
"ml_detection": "None",
"object_type": "File",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 20.04",
"page": "hitomi.la/",
"page_site": "Web Background",
"policy": "Threat-Malware-Policy-Crest-SRE-Test",
"policy_id": "342F7551F4D4469E47D7736209486319 2024-07-01 16:28:12.174470",
"protocol": "HTTPS/1.1",
"request_id": 2907585389470724608,
"scanner_result": "malicious",
"severity": "High",
"severity_id": 3,
"sha256": "d330ea88b7a0c2f9190717d8f39a2e3942474c3fefe8b68112e7b93fde0fa9d4",
"site": "hitomi",
"src_country": "IN",
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_time": "Wed Aug 14 13:48:00 2024",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "382350",
"srcip": "110.226.17.67",
"timestamp": 1723623535,
"traffic_type": "Web",
"transaction_id": 7718454634228557343,
"true_filetype": "HTML",
"tss_mode": "inline",
"type": "nspolicy",
"ur_normalized": "nipun.brahmbhatt@crestdata.ai",
"url": "hitomi.la/",
"user": "nipun.brahmbhatt@crestdata.ai",
"user_id": "nipun.brahmbhatt@crestdata.ai",
"userip": "10.50.5.28",
"record_type": "alert",
"department": "",
"scan_time": 0,
"tss_scan_failed": "",
"usr_udf_supervisorname": "",
"instance_id": "",
"nsdeviceuid": "",
"modified_date": 0,
"dst_geoip_src": 0,
"local_sha256": "",
"sha1": "",
"usr_udf_primarydomain": "",
"fastscan_results": "",
"sanctioned_instance": "",
"company": "",
"user_confidence_index": 0,
"src_geoip_src": 0,
"usr_udf_businesssegmentlevel1": "",
"referer": "",
"parent_id": "",
"created_date": 0,
"usr_udf_businesssegmentlevel2": "",
"filename": "",
"from_user": "",
"file_path": "",
"manager": "",
"browser": "",
"detection_type": "",
"title": "",
"object_id": "",
"mime_type": "",
"usr_display_name": "",
"usr_udf_businesssegmentlevel4": "",
"userPrincipalName": "",
"appsuite": "",
"scan_type": "",
"tss_license": "",
"managementID": "",
"usr_status": "",
"object": "",
"custom_attr": {},
"userCountry": "",
"usr_title": "",
"usr_udf_businesssegmentlevel3": "",
"file_name": "",
"shared_type": "",
"usr_udf_companyname": "",
"shared_with": "",
"tss_fail_reason": "",
"usr_udf_supervisorid": "",
"browser_version": "",
"usr_udf_employeeid": ""
}
Alertes de remédiation
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/remediation
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "448ca50ee6142a954d64c577",
"access_method": "API Connector",
"acked": "true",
"action": "alert",
"activity": "Download",
"alert": "yes",
"alert_name": "Remediation alert",
"alert_type": "Remediation",
"app": "Clanwilliam Health",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 9,
"ccl": "poor",
"count": 1,
"device": "Other",
"dst_country": "NL",
"dst_geoip_src": 2,
"dst_latitude": 52.3759,
"dst_location": "Amsterdam",
"dst_longitude": 4.8975,
"dst_region": "North Holland",
"dst_zipcode": "1012",
"dstip": "31.186.239.8",
"file_size": 118585,
"file_type": "application/vnd.google-apps.document",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"object": "VTRapjqhGbaDXqHR",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 7.0",
"policy": "policy_ga34",
"request_id": "2459149802892628500",
"site": "Clanwilliam Health",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.8",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0268t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0268t@test.netskope.com",
"managementID": "",
"from_user": "",
"os_version": "",
"app_session_id": 0,
"malware_severity": "",
"actions_taken": "",
"transaction_id": 0,
"notify_template": "",
"page": "",
"browser_session_id": 0,
"src_time": "",
"tss_mode": "",
"managed_app": "",
"severity": "",
"nsdeviceuid": "",
"remediation_profile": "",
"dlp_profile": "",
"malware_name": "",
"endpoints": "",
"connection_id": 0,
"policy_id": "",
"endpoint_count": 0,
"dst_timezone": "",
"profile_hits": [],
"malware_id": "",
"hostname": "",
"edr_app": "",
"device_classification": "",
"userip": "",
"appsuite": "",
"protocol": "",
"incident_id": 0,
"src_timezone": "",
"sanctioned_instance": "",
"page_site": "",
"malware_type": "",
"all_policy_matches": []
}
Alertes d'évaluation de la sécurité
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/securityassessment
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "15bbca35f014e9618efdc629",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"activity": "Introspection Scan",
"alert": "yes",
"alert_name": "security-accessment-alert",
"alert_type": "Security Assessment",
"app": "LinkedIn",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "medium",
"count": 1,
"device": "Other",
"dst_country": "FR",
"dst_geoip_src": 1,
"dst_latitude": 48.883411,
"dst_location": "Puteaux",
"dst_longitude": 2.23894,
"dst_region": "Ile-de-France",
"dstip": "193.248.155.211",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "OlWmGNTVpEVLCgWo",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"sa_profile_id": 1,
"sa_profile_name": "CRzpqYgDBoKRThmb",
"sa_rule_id": "icveiWoIMGqmEfUy",
"sa_rule_name": "RLYnpTzcFeiRcQYr",
"sa_rule_severity": "High",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "LinkedIn",
"src_country": "FR",
"src_geoip_src": 1,
"src_latitude": 48.883411,
"src_location": "Puteaux",
"src_longitude": 2.23894,
"src_region": "Ile-de-France",
"srcip": "193.248.155.211",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Alertes CTEP
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/ctep
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_correlation_id": "d54406dc-5457-4699-8754-c8eece88a804",
"_event_id": "8de38a44-4ae5-44ac-a097-f9e3ce2aac2a",
"_forwarded_by": "na",
"_generator_id": "ad4c77a8-ac83-4493-936c-8d6394038556",
"_id": "d62273697847e13a884e7562",
"_insertion_epoch_timestamp": 1727659690,
"_raw_event_inserted_at": 1676185709059,
"_seq_id": 117219,
"_service_identifier": "na",
"_skip_geoip_lookup": "yes",
"access_method": "API Connector",
"acked": "false",
"action": "block",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "c2",
"alert_type": "c2",
"app": "X3host",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 16,
"ccl": "poor",
"count": 1,
"device": "11-inch iPad Pro",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 45.8234,
"dst_location": "Boardman",
"dst_longitude": -119.7257,
"dst_region": "Oregon",
"dst_zipcode": "97818",
"dstip": "52.218.153.131",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 118783,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"legal_hold_profile_name": "oejTJocnOabNirPx",
"lh_custodian_email": "ELGkdoczLAkrQMuq",
"lh_custodian_name": "iRwQlRYvjwsFlVpg",
"lh_dest_app": "dOkImPvoHqwfXFaU",
"lh_dest_instance": "LKMHXgSCmGTmVbZL",
"lh_fileid": "taAjyAQRSWraghfP",
"lh_filename": "rsjjtAjqpCcYjaOU",
"lh_filepath": "IhYDbjTXhzqtUZeD",
"lh_original_filename": "vWijvCFegHYDULbn",
"lh_shared": "WCLXYCUEBjqOlWHt",
"lh_shared_with": "SwUYQdzFHslSQoxr",
"lh_version": 1,
"local_sha256": "fd856057ed7703e9b53458c7dbb6a3dc4ce9b957f3b307d81f06bf09c9bd8de3",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "OLizsiNCpTCziLEC",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "iOS 9.6",
"other_categories": [],
"owner": "dte1953ce410-0778t@test.netskope.com",
"policy": "policy_ga13",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "X3host technologies",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.204",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0494t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0494t@test.netskope.com",
"userkey": "dte1953ce410-0494t@test.netskope.com"
}
Alertes Malsite
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malsite
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "01f6ca78bec577883076a738",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "bget.ru",
"alert_type": "malsite",
"app": "",
"app_session_id": 4910069257574835437,
"appcategory": "Security Risk - Compromised/malicious sites",
"browser_session_id": 1141245448937753175,
"category": "Security Risk - Compromised/malicious sites",
"cci": 0,
"ccl": "unknown",
"connection_id": 0,
"count": 1,
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "RU",
"dst_latitude": 59.9417,
"dst_location": "St Petersburg",
"dst_longitude": 30.3096,
"dst_region": "St.-Petersburg",
"dst_timezone": "Europe/Moscow",
"dst_zipcode": "195213",
"dstip": "5.101.158.143",
"dstport": 443,
"hostname": "ip-172-31-37-148",
"incident_id": 7989528656047608655,
"ja3": "07ff1e545ef8ab3fcf8a4dc9272221c2",
"ja3s": "NotAvailable",
"malicious": "yes",
"malsite_category": [
"Malicious Site"
],
"malsite_country": "RU",
"malsite_id": "ae7c3ade12353ae7165e9b2f",
"malsite_ip_host": "5.101.158.143",
"malsite_latitude": 59.9417,
"malsite_longitude": 30.3096,
"malsite_region": "St.-Petersburg",
"managed_app": "no",
"notify_template": "block_page.html",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 22.04",
"other_categories": [
"Security Risk",
"Security Risk - Compromised/malicious sites"
],
"page": "bget.ru/",
"page_site": "bget",
"policy": "TestMalsite2",
"policy_id": "F1AE7109B6FC54098C582D3B0F149521 2024-05-28 13:48:56.784091",
"protocol": "HTTPS/1.1",
"request_id": 2851228580036571136,
"severity_level": "med",
"severity_level_id": 1,
"site": "bget",
"src_country": "US",
"src_latitude": 39.0469,
"src_location": "Ashburn",
"src_longitude": -77.4903,
"src_region": "Virginia",
"src_time": "Tue May 28 10:07:00 2024",
"src_timezone": "America/New_York",
"src_zipcode": "20149",
"srcip": "18.209.94.135",
"telemetry_app": "",
"threat_match_field": "domain",
"threat_match_value": "bget.ru",
"threat_source_id": 1,
"timestamp": 1716905279,
"traffic_type": "Web",
"transaction_id": 7989528656047608655,
"type": "malsite",
"ur_normalized": "keshavhazard@gmail.com",
"url": "bget.ru/",
"user": "keshavhazard@gmail.com",
"useragent": "python-requests/2.25.1",
"userip": "172.31.37.148",
"record_type": "alert",
"malsite_reputation": "",
"object": "",
"org": "",
"fromlogs": "",
"log_file_name": "",
"req_cnt": 0,
"browser_version": "",
"numbytes": 0,
"department": "",
"division": "",
"retro_scan_name": "",
"sfwder": "",
"browser": "",
"custom_attr": {},
"malsite_confidence": 0,
"server_bytes": 0,
"client_bytes": 0,
"malsite_first_seen": 0,
"co": "",
"sAMAccountName": "",
"src_geoip_src": 0,
"gateway": "",
"referer": "",
"suppression_start_time": 0,
"resp_cnt": 0,
"conn_duration": 0,
"serial": "",
"malsite_hostility": "",
"dsthost": "",
"dst_geoip_src": 0,
"universal_connector": "",
"malsite_active": "",
"from_user": "",
"object_type": "",
"suppression_end_time": 0,
"malsite_last_seen": 0,
"severity": "",
"aggregated_user": "",
"malsite_consecutive": "",
"appsuite": ""
}
Alertes politiques
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/policy
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "3ceffe626afca6f5d46befb6",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "testprivateapp with2nd opt",
"alert_type": "policy",
"app": "[ExtraHop-Demo]",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"client_bytes": 0,
"client_packets": 0,
"count": 1,
"device": "Windows",
"dsthost": "netskope.atlassian.net",
"dstip": "",
"dstport": 443,
"end_time": "2025-02-28T08:22:47+00:00",
"hostname": "WIN11-50-12-151",
"ip_protocol": "TCP",
"network_session_id": "9452921695540616650",
"num_sessions": 1,
"numbytes": 0,
"organization_unit": "",
"os": "Windows",
"os_version": "11.0.22621",
"other_categories": [],
"policy": "testprivateapp with2nd opt",
"protocol": "Http",
"protocol_port": "TCP:443",
"publisher_cn": "",
"publisher_name": "",
"server_bytes": 0,
"server_packets": 0,
"session_duration": 0,
"site": "netskope.atlassian.net",
"srcip": "",
"srcport": 30700,
"start_time": "2025-02-28T08:22:32+00:00",
"timestamp": 1740731072,
"total_packets": 0,
"traffic_type": "PrivateApp",
"tunnel_id": "53125",
"tunnel_type": "NPA",
"tunnel_up_time": 0,
"type": "network",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userip": "",
"record_type": "alert",
"suppression_key": "",
"app_activity": "",
"file_type": "",
"url": "",
"policy_id": "",
"custom_connector": "",
"quarantine_profile": "",
"q_original_shared": "",
"file_path": "",
"profile_emails": [],
"referer": "",
"md5": "",
"redirect_url": "",
"page_site": "",
"malware_name": "",
"suppression_end_time": 0,
"user_id": "",
"distinguishedName": "",
"severity": "",
"src_timezone": "",
"tss_mode": "",
"managed_app": "",
"tss_fail_reason": "",
"src_geoip_src": 0,
"owner": "",
"aggregated_user": "",
"group": "",
"total_collaborator_count": 0,
"userCountry": "",
"browser": "",
"to_user": "",
"from_object": "",
"ext_labels": [],
"shared_with": "",
"useragent": "",
"sessionid": "",
"network": "",
"malicious": "",
"quarantine_file_id": "",
"appsuite": "",
"remediation_profile": "",
"universal_connector": "",
"mime_type": "",
"browser_version": "",
"src_zipcode": "",
"access_key_id": "",
"src_latitude": 0.0,
"malware_type": "",
"dynamic_classification": "",
"src_region": "",
"q_original_version": "",
"instance_id": "",
"message_id": "",
"sfwder": "",
"q_admin": "",
"q_app": "",
"object_type": "",
"log_file_name": "",
"malware_severity": "",
"retro_scan_name": "",
"displayName": "",
"justification_reason": "",
"q_instance": "",
"src_location": "",
"gateway": "",
"forward_to_proxy_xau": "",
"justification_type": "",
"smtp_to": [],
"app_session_id": 0,
"request_id": 0,
"app_scopes": "",
"parent_id": "",
"file_category": "",
"file_id": "",
"dlp_profile": "",
"nsdeviceuid": "",
"risk_level": "",
"encrypt_failure": "",
"quarantine_file_name": "",
"src_longitude": 0.0,
"file_size": 0,
"org": "",
"user_tmp": "",
"activity_status": "",
"threat_match_value": "",
"malsite_category": [],
"dst_timezone": "",
"all_policy_matches": [],
"incident_id": 0,
"orignal_file_path": "",
"object_id": "",
"act_user": "",
"http_status": "",
"dst_country": "",
"from_user": "",
"req_cnt": 0,
"transaction_id": 0,
"browser_session_id": 0,
"sanctioned_instance": "",
"from_storage": "",
"tss-mode": "",
"cc": "",
"activity": "",
"sAMAccountName": "",
"scan_type": "",
"serial": "",
"src_time": "",
"managementID": "",
"object": "",
"q_original_filepath": "",
"custom_attr": {},
"shared_domains": "",
"q_original_filename": "",
"notify_template": "",
"connection_id": 0,
"telemetry_app": "",
"threat_source_id": 0,
"user_confidence_index": 0,
"TSS-scan": "",
"internal_collaborator_count": 0,
"last_name": "",
"mail": "",
"sAMAccountType": "",
"memberOf": "",
"smtp_status": "",
"Title": "",
"dst_location": "",
"bcc": "",
"dst_geoip_src": 0,
"exposure": "",
"activity_type": "",
"dlp_fail_reason": "",
"dst_zipcode": "",
"message_size": 0,
"suppression_start_time": 0,
"trust_computer_checked": "",
"device_classification": "",
"instance": "",
"to_storage": "",
"dst_latitude": 0.0,
"division": "",
"object_count": 0,
"to_object": "",
"modified": 0,
"sender": "",
"dst_region": "",
"page": "",
"conn_duration": 0,
"two_factor_auth": "",
"dst_longitude": 0.0,
"data_type": "",
"quarantine_profile_id": "",
"malware_id": "",
"manager": "",
"src_country": "",
"event_type": "",
"external_collaborator_count": 0,
"resp_cnt": 0,
"threat_match_field": "",
"tss_scan_failed": "",
"dlp_scan_failed": "",
"sha256": ""
}
Alertes de quarantaine
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/quarantine
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "63d6a681f0d64a6f41cc084c",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "quarantine-sahil",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "quarantine-alert",
"alert_type": "quarantine",
"app": "Dropbox",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 81,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 33.1432,
"dst_location": "San Marcos",
"dst_longitude": -117.1666,
"dst_region": "California",
"dst_zipcode": "92069",
"dstip": "98.176.143.16",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "weclTNVzKoULFCYX",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"q_admin": "KgBNclCNvMfSfwAe",
"q_app": "Box",
"q_instance": "IXlwfxAfRQMyUbso",
"q_original_filename": "huSgEkeGhFjPDLhS",
"q_original_filepath": "oJmMLhuvhIyXlarC",
"q_original_shared": "private",
"q_original_version": "1",
"q_shared_with": "PqtCjqtPLVOOFkWk",
"quarantine_action_reason": "TuJbfomareEgmNNT",
"quarantine_app": "Amazon S3",
"quarantine_failure": "mDsCCrKldEQdhrEF",
"quarantine_file_id": "jeCCFYBKuaBggvol",
"quarantine_file_name": "GEXNzZEGpZFQAuUv",
"quarantine_profile": "fQECcfyXhgGUOJSO",
"quarantine_profile_id": "xfFlQTBQWxjnIsXZ",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "Dropbox",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
Alertes UBA
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/uba
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "b7dce8f570123bdd868a8315",
"access_method": "UCI Impact API",
"acked": "false",
"action": "anomaly_detection",
"activity": "ActivityForUciImpactAPI",
"alert": "yes",
"alert_id": "505464b05529c82e34d31970",
"alert_name": "External alert from Netskope due to Risky User",
"alert_type": "uba",
"anomaly_type": "Fact",
"app": "",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"count": 1,
"createdTime": "2025-02-24 08:15:55.461000",
"device": "Other",
"event_type": "uba_analytics",
"instance_id": "",
"organization_unit": "",
"policy": "External alert received via REST API",
"score": 1,
"severity": "informational",
"src_country": "IN",
"src_geoip_src": 2,
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_zipcode": "380009",
"srcip": "122.170.162.148",
"timestamp": 1740384954,
"type": "nspolicy",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userkey": "tanushree.kurup@crestdata.ai",
"windowId": 1740355200000,
"record_type": "alert",
"last_device": "",
"surhn": "",
"policy_id": "",
"uba_ap1": "",
"evt_src_chnl": "",
"all_policy_matches": [],
"threshold": 0,
"web_universal_connector": "",
"user_category": "",
"managementID": "",
"division": "",
"download_app": "",
"user_id": "",
"dst_longitude": 0.0,
"audit_type": "",
"object_count": 0,
"policy_name": "",
"activity_status": "",
"group": "",
"act_user": "",
"referer": "",
"connection_id": 0,
"app_category": "",
"bin_timestamp": 0,
"hostname": "",
"app_activity": "",
"md5": "",
"risk_level_id": 0,
"suppression_end_time": 0,
"protocol": "",
"request_type": "",
"request_id": 0,
"app_session_id": 0,
"User_SPACE_Id": "",
"user_name": "",
"last_timestamp": 0,
"netskope_activity": "",
"dst_geoip_src": 0,
"tss_scan_failed": "",
"loginurl": "",
"threshold_time": 0,
"risk_level": "",
"managed_app": "",
"browser_version": "",
"file_category": "",
"from_user_category": "",
"page": "",
"last_location": "",
"url": "",
"uba_ap2": "",
"sanctioned_instance": "",
"object_id": "",
"dst_timezone": "",
"custom_attr": {},
"to_object": "",
"dst_country": "",
"traffic_type": "",
"telemetry_app": "",
"page_site": "",
"file_size": 0,
"scopes": [],
"anomalyData": {},
"os": "",
"audit_category": "",
"tss_fail_reason": "",
"userip": "",
"last_app": "",
"incident_id": 0,
"suppression_start_time": 0,
"dst_zipcode": "",
"dstip": "",
"policy_actions": [],
"browser": "",
"src_time": "",
"sAMAccountName": "",
"two_factor_auth": "",
"uba_inst2": "",
"site": "",
"displayName": "",
"sha256": "",
"object": "",
"last_country": "",
"to_user": "",
"object_type": "",
"manager": "",
"last_region": "",
"dst_region": "",
"dst_latitude": 0.0,
"shared_credential_user": "",
"file_type": "",
"tss_mode": "",
"appsuite": "",
"device_classification": "",
"logintype": "",
"AccountType": "",
"os_version": "",
"parent_id": "",
"TSS-scan": "",
"user_role": "",
"dst_location": "",
"to_user_category": "",
"user_confidence_index": 0,
"mail": "",
"browser_session_id": 0,
"src_timezone": "",
"useragent": "",
"employeeType": "",
"from_user": "",
"uba_inst1": "",
"User_SPACE_Name": "",
"userPrincipalName": "",
"transaction_id": 0,
"distinguishedName": "",
"profile_id": ""
}
Alertes de la liste de surveillance
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/watchlist
Method: ALLEZ
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "ad921f96aaf7dc5b6fe5d628",
"access_method": "API Connector",
"acked": "true",
"activity": "Upload",
"alert": "yes",
"alert_name": "watchlist fired",
"alert_type": "watchlist",
"app": "Amazon App Suite",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 89,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "IN",
"dst_geoip_src": 2,
"dst_latitude": 19.0748,
"dst_location": "Mumbai",
"dst_longitude": 72.8856,
"dst_region": "Maharashtra",
"dst_zipcode": "400072",
"dstip": "182.75.130.70",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 119268,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "aa477dd147d603cd0bd65b6dfb09021654e212aa3200ceb03e3a1e1d0fb37fdb",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "uVwtiXcnOjCdpJHt",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 8.0",
"owner": "dte1953ce410-0545t@test.netskope.com",
"policy": "policy_ga26",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Amazon App Suite",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0191t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0191t@test.netskope.com",
"userkey": "dte1953ce410-0191t@test.netskope.com",
"dst_timezone": "",
"two_factor_auth": "",
"dlp_fail_reason": "",
"title": "",
"conn_duration": 0,
"shared_domains": "",
"user_id": "",
"notify_template": "",
"severity_id": 0,
"TSS-scan": "",
"universal_connector": "",
"to_user_category": "",
"web_url": "",
"severity": "",
"netskope_activity": "",
"malware_severity": "",
"dlp_is_unique_count": "",
"sAMAccountName": "",
"hostname": "",
"sanctioned_instance": "",
"object_count": 0,
"dlp_rule": "",
"protocol": "",
"file_id": "",
"audit_type": "",
"internal_collaborator_count": 0,
"dlp_scan_failed": "",
"appsuite": "",
"dlp_rule_severity": "",
"telemetry_app": "",
"to_user": "",
"true_obj_category": "",
"useragent": "",
"shared_with": "",
"justification_reason": "",
"dlp_parent_id": 0,
"referer": "",
"src_timezone": "",
"connection_id": 0,
"app_session_id": 0,
"from_user_category": "",
"client_bytes": 0,
"malware_name": "",
"total_collaborator_count": 0,
"policy_id": "",
"workspace": "",
"data_type": "",
"dlp_profile": "",
"act_user": "",
"malware_profile": "",
"file_name": "",
"fromlogs": "",
"ml_detection": "",
"app_activity": "",
"malware_id": "",
"dstport": 0,
"transaction_id": 0,
"detection_engine": "",
"to_storage": "",
"parent_id": "",
"managed_app": "",
"external_collaborator_count": 0,
"nsdeviceuid": "",
"tss_fail_reason": "",
"managementID": "",
"workspace_id": "",
"true_obj_type": "",
"justification_type": "",
"aggregated_user": "",
"network": "",
"org": "",
"page_site": "",
"userPrincipalName": "",
"tss_mode": "",
"suppression_end_time": 0,
"true_type_id": 0,
"server_bytes": 0,
"manager": "",
"suppression_start_time": 0,
"file_category": "",
"app_name": "",
"audit_category": "",
"incident_id": 0,
"serial": "",
"resp_cnt": 0,
"browser_version": "",
"all_policy_matches": [],
"enterprise": "",
"numbytes": 0,
"device_classification": "",
"from_object": "",
"dlp_rule_count": 0,
"dsthost": "",
"src_time": "",
"user_category": "",
"browser_session_id": 0,
"sfwder": "",
"scanner_result": "",
"dlp_file": "",
"os_version": "",
"to_object": "",
"malware_type": "",
"log_file_name": "",
"web_universal_connector": "",
"enterprise_id": "",
"dlp_incident_id": 0,
"from_user": "",
"userip": "",
"page": "",
"req_cnt": 0,
"from_storage": "",
"tss_scan_failed": "",
"local_md5": ""
}
périphérique Alertes
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/périphérique
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "983681ec8804b23e77c2c292",
"access_method": "Endpoint",
"action": "block",
"activity": "Insert",
"alert": "yes",
"alert_name": "TestBlock",
"alert_type": "Device",
"computer_name": "N49J4M9T3C",
"count": 1,
"device_classification": "not configured",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"policy": "TestBlock",
"policy_action": "block",
"policy_name_enforced": "TestBlock",
"timestamp": 1720005433,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_id": "USB\\VID_03f0&PID_1985&REV_0110",
"usb_device_name": "USB Flash Drive",
"usb_device_sn": "070D2C206FCFA597",
"usb_device_type": "usb mass storage",
"usb_product_id": "6533",
"usb_vendor_id": "HP",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"connection_type": "",
"driver": "",
"os_user_name": "",
"usb_is_encrypted": false,
"location": "",
"custom_attr": {}
}
Alertes sur le contenu
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/content
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "3f14cdb17c8385f9a6acfab4",
"access_method": "Endpoint",
"action": "block",
"activity": "Create",
"alert": "yes",
"alert_name": "mmm1",
"alert_type": "Content",
"app": "DesktopServicesHelper",
"computer_name": "N49J4M9T3C",
"count": 1,
"destination_file_directory": "/Volumes/KALI LINUX",
"destination_file_name": "urls.txt",
"destination_file_path": "/Volumes/KALI LINUX/urls.txt",
"device_classification": "not configured",
"dlp_incident_id": 8329186087212438192,
"dlp_profile": "DLPTest",
"file_size": 52483,
"file_type": "Plain Text file",
"incident_id": 8329186087212438192,
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"os_user_name": "kmaheshwari",
"pid": "0",
"policy": "mmm1",
"policy_action": "block",
"policy_name_enforced": "mmm1",
"process_name": "DesktopServicesHelper",
"process_path": "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources",
"sha256": "23a129d56da1579a68862808a22b7b3e1d64682cc7d4c725fdc8a8c7980310b6",
"site": "DesktopServicesHelper",
"timestamp": 1719993896,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_type": "usb mass storage",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"custom_attr": {},
"process_cert_subject": "",
"device": ""
}
Incidents
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/incident
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "6d462e0db470c7247e75322fd380031271d1be18db9d707ef6f3affc792f11b1",
"access_method": "Endpoint Protection",
"acting_user": "kmaheshwari@netskope.com",
"activity": "Create",
"app": "DesktopServicesHelper",
"assignee": "None",
"dlp_incident_id": 7268524954762607217,
"dlp_match_info": [
{
"dlp_action": "block",
"dlp_forensic_id": 1711868037568704387,
"dlp_policy": "mmm1",
"dlp_profile_name": "DLPTest",
"dlp_rules": []
}
],
"file_path": "/Volumes/KALI LINUX/urls.txt",
"file_size": 52483,
"file_type": "Plain Text file",
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"object": "urls.txt",
"object_id": "hash_kmaheshwari@netskope.com_da3faaff0b406f6aa4685aee47ece41c_7b4a2e1f194ccb4e8eca958a472bfe3c3741d7a6",
"severity": "Low",
"status": "new",
"timestamp": 1719993903,
"title": "urls.txt",
"user": "kmaheshwari@netskope.com",
"record_type": "incident",
"instance": "",
"src_location": "",
"app_session_id": 0,
"zip_file_id": "",
"connection_id": 0,
"destination_site": "",
"to_user": "",
"latest_incident_id": 0,
"from_user": "",
"site": "",
"dst_location": "",
"inline_dlp_match_info": [],
"destination_instance_id": "",
"instance_id": "",
"channel": "",
"original_file_snapshot_id": "",
"bcc": "",
"referer": "",
"dlp_file": "",
"destination_app": "",
"true_obj_type": "",
"file_lang": "",
"url": "",
"true_obj_category": "",
"cc": "",
"owner_pdl": "",
"classification": "",
"object_type": "",
"ext_labels": [],
"exposure": "",
"dlp_parent_id": 0,
"owner": "",
"user_id": ""
}
La criminalistique des incidents
API Endpoint: https://<tenant-url>/api/v2/incidents/dlpincidents/{id}/forensics
Method: OBTENIR
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Request Parameters
| Clé | Value |
|---|---|
| dlp_incident_id in path param | dlp_incident_id |
Sample API Response
{
"status": "success",
"data": {
"meta": "{\"metadata_content\":\"filename: sensitive_data_onedrive_share.txt file_md5: 0bcafac7ce40ad3ebad1664307a046f1 file_type: text/plain file_lang: ENGLISH object_id: {\\\"drive_id\\\": \\\"b!PM0toX-2uEqSwuqUx0SzyDAe0n7GMw1Eok5wsoIE5ALI55tDhn-rSJB-vB4UWs5e\\\", \\\"driveitem_id\\\": \\\"014GLSS7Z2KV57XD3LXNFLWFO3HXHVREJB\\\", \\\"site_collection_id\\\": \\\"a12dcd3c-b67f-4ab8-92c2-ea94c744b3c8\\\"} ns_text_classifier: others \",\"dlp_match_info\":[{\"dlp_profile_name\":\"DLP-PCI\",\"dlp_rules\":[{\"dlp_rule_name\":\"Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":3,\"dlp_data_identifiers\":[[{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"Number\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":78,\"score\":1,\"end_offset\":93,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"378282XXXXX0005\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":96,\"score\":1,\"end_offset\":110,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"371449XXXXX8431\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"371449XXXXX8431\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"},{\"dlp_profile_name\":\"US Financial Data\",\"dlp_rules\":[{\"dlp_rule_name\":\"US-Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":2,\"dlp_data_identifiers\":[[{\"start_offset\":19,\"score\":1,\"end_offset\":29,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"Type\\n\\n\",\"match\":\"Credit Card\",\"suffix\":\" Number\"},{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"3714XXXXXXXX31\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"},{\"start_offset\":203,\"score\":1,\"end_offset\":213,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"...5610591081018250\\n\\n\\n\\n\",\"match\":\"Diners Club\",\"suffix\":\"\\n\\n30569309025904\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"}]}",
"content": " Credit Card Type\n\nCredit Card Number\n\n\n\nAmerican Express\n\n37XXXXXXXXX0005\n\n\n\nAmerican Express\n\n37XXXXXXXXX8431\n\n\n\nAmerican Express Corporate\n\n37XXXXXXXXX1000\n\n\n\nAustralian BankCard\n\n5610XXXXXXXX50\n\n\n\nDiners Club\n\n30569XXXXXXXX5904\n\n\n\nDiners Club\n\n3852XXXXXXXX37\n\n\n\nDiscover\n\n60111XXXXXXXX117\n\n\n\nDiscover\n\n6011XXXXXXXX424\n\n\n\nJCB\n\n35301XXXXXXXX00\n\n\n\nJCB\n\n356XXXXXXXX05\n\n\n\nMasterCard\n\n555XXXXXXXX444\n\n\n\nMasterCard\n\n5105XXXXXXXX00\n\n\n\nVisa\n\n41XXXXXXXX111\n\n\n\nVisa\n\n401XXXXXXXX1881\n\n\n\nVisa\n\n422XXXXXXXX222"
}
}
Événements de points de terminaison
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/endpoint
Method: GET
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Sample API Response
{
"_id": "dffd23ac520f696e1c4bd020",
"access_method": "Endpoint",
"activity_type": "Process Start",
"alert": "no",
"alert_generated": false,
"computer_name": "win11-50-1-92",
"device_type": "Bluetooth File Transfer",
"os": "Windows",
"os_details": "Microsoft Windows 11 Pro 10.0.22621 64-bit",
"policy_action": "allow",
"process_name": "python.exe",
"process_path": "\\??\\C:\\Program Files\\Python312\\python.exe",
"sub_type": "SUBTYPE_DEVICE_CONTROL",
"timestamp": 1725847324,
"type": "endpoint",
"user": "shubham.singhal@crestdata.ai",
"record_type": "epdlp",
"executable_hash": "",
"location": "",
"device_sn": "",
"app": "",
"destination_file_name": "",
"printer_identifier": "",
"file_type": "",
"dlp_profile_name": "",
"dlp_profile": "",
"event_recovered": false,
"destination_file_path": "",
"dlp_incident_id": 0,
"device_name": "",
"source_file_directory": "",
"alert_type": "",
"process_cert_subject": "",
"policy_name": "",
"source_file_name": "",
"incident_id": 0,
"action": "",
"policy_name_enforced": "",
"policy_version": "",
"executable_signed": false,
"file_size": 0,
"justification": "",
"product_id": "",
"vendor_id": "",
"device_id": "",
"destination_file_directory": "",
"dlp_rule": "",
"device": "",
"alert_name": "",
"pid": "",
"port": "",
"connection_type": "",
"sha256": "",
"policy_action_enforced": "",
"activity": "",
"driver": "",
"unc_path": "",
"file_origin": "",
"os_user_name": "",
"md5": ""
}
Mise à jour des événements de l'incident
API Endpoint: https://<tenant-url>/api/v2/incidents/update
Method: PATCH
Request Headers
| Clé | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-7.0.0 |
Request Payload
{
"payload": [
{
"field": "status",
"new_value": "in_progress",
"object_id": "incident_object_id",
"old_value": "new",
"user": "user@domain.com"
}
]
}
Sample API Response
{
"result": [
{
"ok": 1,
"result": "string"
}
]
}
Matrice de performance
Ces relevés sont collectés sur une pile d'échange de nuages (Large Cloud Exchange Stack) répondant à ces spécifications.
Exécution de performances pour l'extraction et le stockage de 200 000 alertes/événements dans Cloud Exchange.
| Description | Spécifications |
|---|---|
| Détails de la pile | Taille : Grande RAM : 32 GB CPU : 16 cœurs |
| Enregistrement d'alertes/événements par minute | ~ 120k |
Notes
- Pour atteindre les performances ci-dessus, nous augmentons le nombre de travailleurs dans le noyau, sinon la performance moyenne serait d'environ 60 000 événements/alertes par minute.
- Ce chiffre représente la performance moyenne pour tous les types d'alertes et d'événements ; toutefois, le taux de récupération des incidents peut être inférieur à la moyenne, avec un taux estimé d'environ 1 500 incidents par minute.
Agent utilisateur
netskope-ce-7.0.0
Workflow
- Configurez le plugin Ticket Orchestrator.
- Configurez une règle de gestion.
- Configurez une file d'attente avec un plugin tiers (comme Jira).
- Validez le plugin.
Regardez une vidéo
Cliquer sur « play » pour regarder une vidéo.
Configurer le plugin Ticket Orchestrator
-
Dans Cloud Exchange, aller dans Settings > Plugin Store. Rechercher et sélectionner le plugin Netskope Ticket Orchestrator v2.5.1 (CTO).
-
Saisissez un nom de configuration et sélectionnez un locataire Netskope configuré dans le menu déroulant.
Note
Le bouton Mettre à jour l’incident sur le tenant Netskope doit être activé pour utiliser la configuration de file d’attente Résoudre l’incident.
-
Cliquez sur Next et saisissez les valeurs des paramètres de configuration.
- Alert Types: Selected types of alerts will be fetched.
- Initial Range for Alerts (in days): Nombre de jours pour extraire les données pour l'exécution initiale.
- Event Types: Selected types of event will be fetched.
- Initial Range for Events (in hours): Number of hours to pull the events data for the initial run.
- Alert/Event Query: Only the alerts/events matching this filter query will be stored and considered for ticket creation. If kept blank all the Alerts and Events will be considered for ticket creation.
- Pull DLP Incident Forensics: Forensics fields for DLP Incidents will be fetched.
Note
- By default, the Forensics Originalfile Url (forensics_originalfile_url) and Forensics Subfile Url (forensics_subfile_url) fields will be included regardless of whether Pull DLP Incident Forensics is
YesorNo. - Si le champ Récupérer les forensics des incidents DLP (Prévention des pertes de données) est défini sur
Yesdans le plugin Ticket Orchestrator ou dans le plugin Log Shipper, les deux plugins récupèreront automatiquement les champs de forensics pour les événements d'incident. - Conserver le champ Pull DLP (Prévention des pertes de données) Incident Forensics en tant que
Yespeut avoir un impact sur les performances du plugin Log Shipper car il effectuera des appels d’API supplémentaires qui auront un impact sur les performances du plugin. - Toute modification de la valeur du champ Pull DLP (Prévention des pertes de données) Incident Forensics ne sera pas prise en compte après la configuration du plug-in, sauf si vous redémarrez le noyau ou supprimez le plug-in Locataire et le plug-in Orchestrateur de tickets, et reconfigurez les deux plug-ins.
-
Click Next and configure mapping details for updating Incidents.
Note
Pour les champs Netskope Tenant, vous devrez fournir les valeurs exactes utilisées sur le locataire Netskope et attendues par l’API du locataire Netskope.
-
Pour créer un champ New Netskope CE pour un statut ou une gravité personnalisés, cliquez sur Add New sous n'importe quel champ Netskope CE.
-
Saisissez le nom du champ et cliquez sur Add Field.
-
Cliquez sur Add pour ajouter une New ligne dans Mapping. Select le champ nouvellement ajouté et mappez-le avec les champs du client Netskope selon vos besoins.
Note
De même, vous pouvez créer un champ New dans la section Gravité et l'associer à la gravité requise.
-
Cliquez sur Save.
Créer une règle de gestion pour Ticket Orchestrator
-
Dans Ticket Orchestrator, allez à Business Rules et cliquez sur Create New Rule.
-
Enter the Rule name and create a filter query.
-
Cliquez sur Save.
Ajouter une file d'attente pour Ticket Orchestrator
-
Dans Ticket Orchestrator, allez à Queues et cliquez sur Add Queue Configuration.
-
Select la règle métier, une configuration (votre plugin Netskope Ticket Orchestrator) et Resolve Incident pour la file d’attente.
Note
- Keep the Require Approval toggle enabled if you want to manually approve the execution of each resolve incident action on the Tickets page.
- Resolve incident action will be performed based on Update Incidents back to the Netskope Tenant toggle and the Sharing Sync Interval set in the plugin configuration.
- L'action Résoudre l'incident sera prise en charge par le plug-in Ticket Orchestrator v2.5.0 et CE v6.1.0 et supérieur.
-
Cliquez sur Save.
Validez le plugin Ticket Orchestrator
Validez la présence d'alertes dans votre locataire
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Alerts > Filters et sélectionnez les x derniers jours en fonction de vos besoins.
Validez la présence d'événements d'incidents dans votre locataire
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Incidents > DLP et sélectionnez les x derniers jours en fonction de vos besoins.
Validez les événements de point de terminaison présents dans votre locataire
- Connectez-vous à votre locataire Netskope.
- Cliquez sur Skope IT.
- Cliquez sur Skope IT > Endpoint Events et sélectionnez les x derniers jours en fonction de vos besoins.
Valider le retrait
Pour valider l'extraction des alertes et des événements du locataire Netskope, vous devez d'abord vérifier les journaux d'alertes et d'événements extraits.
Allez sur Logging et ajoutez un filtre en utilisant le nom du plugin. Vous pouvez également utiliser cet exemple de filtre : message Like "pulled" && message Like "CTO Netskope Ticket Orchestrator".
Pour valider le stockage des alertes dans le Cloud Exchange, rendez-vous à Ticket Orchestrator > Alerts.
Pour valider le stockage des événements dans Cloud Exchange, rendez-vous sur Ticket Orchestrator > Events.
Allez sur le site Ticket Orchestrator > Tickets et vérifiez les billets créés.
Note
-
Pour vérifier que l'incident a été résolu sur le locataire Netskope, consultez le statut de synchronisation des incidents pour ce ticket spécifique.
-
L’action de résolution d’incident sera effectuée en fonction de la bascule « Mettre à jour les incidents vers le tenant Netskope » et de « l’intervalle de synchronisation de partage » définis dans la configuration du plugin.
Valider que l’incident est mis à jour sur Netskope à partir de Cloud Exchange
La mise à jour des incidents ne fonctionne que si l'utilisateur a activé l'option Update Incidents back to the Netskope Tenant pour ce plugin et se produit à l'intervalle de synchronisation configuré. Lorsque le ticket est mis à jour sur une plateforme tierce (comme Jira), Cloud Exchange synchronisera le statut mis à jour (à l'intervalle de synchronisation du plugin tierce partie), et après cela, il initiera la mise à jour de l'incident sur les locataires Netskope.
- Allez sur le site Ticket Orchestrator > Tickets et vérifiez les billets créés.
- Développez le type d'incident et vérifiez l'état de synchronisation de l'incident.
- Allez sur Incidents > DLP et sélectionnez l'incident qui a été mis à jour depuis Cloud Exchange.
- Cliquez sur Check Object History.
- Vérifiez l'incident mis à jour dans l'historique.
Note
Si le plugin tiers ne prend pas en charge la synchronisation de la gravité, le Ticket Orchestrator ne mettra pas à jour la gravité sur le poste Netskope, et vous pourrez observer des erreurs dans Cloud Exchange pour avoir ignoré une mise à jour de la gravité sur le poste Netskope.
Example for resolved incident on Netskope Tenant.
Dépannage du plugin Ticket Orchestrator
Réception d'une erreur lors de la configuration de Ticket Orchestrator
J'obtiens l'erreur suivante : Le jeton Netskope tenant API V2 n'a pas les autorisations nécessaires configurées. Consultez la liste des points de terminaison pour lesquels le jeton n'a pas de permission. **
Cause: Le jeton V2 fourni n'a pas les autorisations minimales requises pour configurer le locataire dans Cloud Exchange.
What to do:
- Allez sur Logging et recherchez un journal d'avertissement similaire au modèle suivant :
TENANT Netskope Tenant (requis) [Netskope Tenant] : Pour Netskope Tenant, a reçu une erreur 403 pour le(s) point(s) d'extrémité suivant(s). - Développez le journal et obtenez la liste des points de terminaison pour lesquels les autorisations sont manquantes.
- Mettez à jour les autorisations du jeton v2 et ajoutez l'autorisation pour la liste de points de terminaison ci-dessus à partir du tableau de bord Netskope.
Getting the error: Invalid status mapping provided.
Cause: Le plugin configuré n'est pas la dernière version.
What to do:
Allez sur la page du dépôt de plugins et récupérez le dernier plugin pour le configurer.
Réception d'une erreur dans les règles de gestion configurées
Si vous obtenez des erreurs dans les règles de gestion configurées, comme la détection d'un type de champ non valide, reconfigurez la règle de gestion à l'aide du bouton Modifier.
Cause: La règle de gestion configurée comporte un champ dont le type de données a été modifié/mise à jour.
What to do:
Cliquez sur Modifier pour éditer la règle de gestion, puis sélectionnez le même champ avec l'opérateur approprié pour filtrer les alertes/événements.
Réception d'une erreur lors de la mise à jour du statut des incidents
J'obtiens l'erreur suivante : Une erreur s'est produite lors de la mise à jour du statut des incidents vers Netskope Tenant pour le lot n° x.
Cause: Le jeton V2 fourni ne dispose pas des autorisations minimales requises pour mettre à jour l'état des incidents dans le locataire Netskope.
What to do:
- Allez sur Logging et cherchez le message d'erreur concernant le plugin Ticket Orchestrator.
- Développez le journal et obtenez les informations concernant l'erreur
- Fournissez les autorisations de lecture et d'écriture /api/v2/incidents/update au jeton V2.
Le filtre de règles métier ne fonctionne pas après la mise à niveau du plugin
Après la mise à niveau du plugin vers la version 2.5.1, une règle métier existante peut correspondre à 0 événement. Cela peut se produire lorsque le filtre utilise des guillemets simples, car les versions précédentes du plugin stockaient certains champs, comme les informations de correspondance DLP (Prévention des pertes de données), dans un format différent.
What to do:
- Modifiez la règle métier et mettez à jour le filtre vers le New format.
- Comparez votre filtre à ces exemples.
Les alertes et événements collectés avant la mise à jour conservent l’ancien format. Si votre instance Cloud Exchange contient à la fois d’anciens et de New événements ou alertes, utilisez les deux formats dans le filtre de votre règle métier.
Alertes et événements non stockés après la mise à niveau lorsque la requête d’alerte/d’événement est vide
Ceci s’applique à Netskope Ticket Orchestrator v2.4.1 et versions ultérieures, pour les configurations créées ou enregistrées pour la dernière fois sur Cloud Exchange v6.0.0 ou version antérieure avec une requête d’alerte/événement vide.
Après la mise à niveau, il est possible que le plugin ne stocke aucune alerte ni aucun événement, et qu'aucun ticket ne soit créé. Chaque extraction consigne ce message :
Le stockage de N alerte(s)/événement(s) a échoué car un ou plusieurs types de données de champ sont incompatibles dans la requête d'alerte/événement pour la configuration <name>.
What to do:
- Accédez à Ticket Orchestrator > Plugins et modifiez la configuration du plugin.
- Allez à l’étape 2 et attendez que le champ Requête d’alerte/d’événement soit entièrement chargé.
- Cliquer sur Save. Les alertes et les événements sont à nouveau stockés à partir de la prochaine synchronisation.
Resolve incident workflow is not working
It may be due to the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
What to do:
Enable the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
Comportements connus
Erreur lors de la suppression du plugin Netskope Ticket Orchestrator
Les utilisateurs rencontreront un message d'erreur lors de la suppression du plugin Ticket Orchestrator v2.3.0, la configuration sera supprimée mais la valeur de Pull DLP (Prévention des pertes de données) Incident Forensics ne sera pas supprimée de la configuration du locataire. Pour cette raison, si l'utilisateur supprime Ticket Orchestrator v2.3.0, et si vous voulez le reconfigurer, vous devez également supprimer le locataire configuré et configurer un nouveau locataire, ou vous devez configurer le plugin Ticket Orchestrator avec le même nom que vous avez utilisé précédemment (le nom de l'ancienne configuration du plugin peut être trouvé dans les logs sur la page Logging). Avant de configurer le plugin avec le même nom, veuillez vous référer au comportement connu ci-dessous.
| 08/06/2025 10:13:27 AM | CE_1049 | error | Une erreur s'est produite lors du traitement de la requête pour api/itsm/configurations. |
Netskope Le plugin Ticket Orchestrator tire les champs forensiques même si le champ Tirer DLP (Prévention des pertes de données) Incident Forensics est réglé sur Non ou vice-versa.
Cela peut être dû à l'une des raisons suivantes :
- Si le plugin Ticket Orchestrator ou le plugin Netskope Log Shipper a le champ Pull DLP (Prévention des pertes de données) Incident Forensics réglé sur Oui, les deux plugins récupèreront automatiquement les champs forensiques pour les événements d'incident.
- Toute modification de la valeur du champ Pull DLP (Prévention des pertes de données) Incident Forensics ne sera pas respectée une fois le plugin configuré, à moins que vous ne supprimiez le plugin Netskope Ticket Orchestrator ainsi que le plugin du locataire et que vous reconfiguriez les deux plugins.
- Si vous avez configuré Ticket Orchestrator avec le champ Pull DLP (Prévention des pertes de données ) Incident For ensics réglé sur Oui, et que vous supprimez la configuration de ce plugin, et que vous reconfigurez ensuite le Netskope Ticket Orchestrator avec le même nom ou un nom différent, mais avec le champ Pull DLP (Prévention des pertes de données) Incident Forensics réglé sur Non, alors le plugin continuera à tirer les champs forensics. Pour résoudre ce problème, vous devez supprimer le plugin Ticket Orchestrator ainsi que le locataire Netskope et reconfigurer les deux plugins.
Comportements liés à la bascule Mettre à jour les incidents vers le locataire Netskope
- Même si le plugin tiers ne prend pas en charge le stockage des champs Gravité ou Cessionnaire, le plugin CTO Netskope effectuera un appel API pour mettre à jour la Gravité ou le Cessionnaire de la valeur actuelle à une autre valeur.
- Si le champ Assignee contient un email ou une chaîne invalide, le ticket sur Netskope Tenant ne sera pas assigné.
- Le champ Statut peut être désélectionné dans l'interface utilisateur du locataire Netskope si le statut utilisé dans Netskope Cloud Exchange n'existe pas sur le locataire Netskope ou ne correspond pas exactement aux statuts présents sur le locataire Netskope.
- Nous avons observé plusieurs cas d'erreur 500 Internal Server Error lorsque nous essayons de mettre à jour la gravité des incidents au sein de notre locataire Netskope.
Le bouton Update Incidents back to the Netskope Tenant est désactivé après la mise à jour du plugin.
Si vous avez un plugin Netskope Ticket Orchestrator déjà configuré avec le bouton Update Incidents back to the Netskope Tenant activé, et que vous mettez à jour le plugin, ce bouton sera désactivé. Vous devez l'activer manuellement en modifiant la configuration du plugin après l'avoir mis à jour.
Comportements liés au workflow Mettre à jour les incidents vers le locataire Netskope
Si votre instance Cloud Exchange dispose de deux plugins de gestionnaire de tickets tiers configurés, et que vous créez des tickets sur les deux plateformes pour différents événements d’incident ayant le même ID d’objet, la mise à jour des incidents vers le locataire Netskope pourrait ne pas fonctionner.
Behaviors related to resolve incident workflow
- To verify the incident action was successfully triggered, we need to check Incident Sync Status for the particular ticket.
- Users may observe logs for updating incidents on Netskope tenant at every sync interval.
- If the resolve incident action is triggered with ‘Update Incidents back to the Netskope Tenant’ toggle disabled then edit the plugin to enable Update Incidents back to the Netskope Tenant toggle, in this case the the incident ticket may not get resolved on the Netskope Tenant.
- If the incident on which resolve incident action is performed, is already in resolved state on Netskope tenant then Incident Sync Status will never get updated in Cloud Exchange.