本書では、Log Shipper、Threat Exchange、Ticket Orchestrator、Risk Exchange、Exact Data Match、Custom File Classificationの各Cloud Exchangeモジュールのプラグイン、ビジネスルール、共有を設定するために使用できるCloud Exchange REST APIについて説明します。
前提条件
これらのAPIを使うには、次のものが必要です。
- The URL of your Cloud Exchange instance (<CE_URL>).
- 構成するプラグインに必要な権限を持つCloud Exchangeのユーザー クレデンシャル。
- 認証APIを使用して生成されたアクセストークン。このトークンは、他のすべてのリクエストの
Authorizationヘッダーで渡します。
Note: <CE_URL>、<tenant_name>、<client_secret>などの山括弧内のすべての値を、環境の値に置き換えます。プラグインのバージョンとサンプルレスポンスのフィールドは、Cloud Exchangeとプラグインのバージョンによって異なる場合があります。
APIの詳細
以下は使うAPIのリストです。
認証
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/auth | 役職 | 他のすべてのCloud Exchange API呼び出しの認証に使うアクセストークンを生成します。 |
ログシッパー（CLS）
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/cls/configurations | 役職 | Netskope Log Shipper（CLS）プラグイン構成を作成します。 |
| /api/cls/configurations | 役職 | Create a QRadar (CLS) plugin configuration. |
| /api/cls/business_rules | 役職 | アラートおよびイベントタイプのフィルタを備えたCLSビジネスルールを作成します。 |
| /api/cls/business_rule | パッチ | ソース設定を宛先設定にマッピングするためにCLSビジネスルールを更新します。 |
脅威交換（CTE）
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/cte/plugins/configurations/netskope.plugins.Default.netskope.main | 役職 | Netskope Threat Exchange（CTE）プラグイン設定を作成します。 |
| /api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main | 役職 | CrowdStrike (CTE) プラグイン構成を作成します。 |
| /api/cte/business_rules | 役職 | Netskope CTEソースからインジケータをフィルタリングするCTEビジネスルールを作成します。 |
| /api/cte/business_rules | 役職 | CrowdStrike CTEソースからURLインジケーターをフィルタリングするCTEビジネスルールを作成します。 |
| /api/cte/business_rules | 役職 | CrowdStrike CTEソースからMD5およびSHA256インジケータをフィルタリングするCTEビジネスルールを作成します。 |
| /api/cte/business_rule | パッチ | NetskopeインジケータをCrowdStrikeと共有するためにCTEビジネスルールを更新します。 |
| /api/cte/business_rule | パッチ | CrowdStrike URLインジケーターをNetskope URLリストに共有するためのCTEビジネスルールを更新します。 |
| /api/cte/business_rule | パッチ | CrowdStrikeファイルハッシュをNetskopeファイルハッシュリストに共有するようにCTEビジネスルールを更新します。 |
チケットオーケストレーター（CTO）
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/itsm/configuration | 役職 | Netskope Ticket Orchestrator（CTO）プラグインの構成を作成します。 |
| /api/itsm/configuration | 役職 | Create a Jira (CTO) plugin configuration. |
| /api/itsm/business_rules | 役職 | CTOビジネスルールを作成します。 |
| /api/itsm/business_rule | パッチ | フィールドマッピングでキューを追加するCTOビジネスルールを更新します。 |
リスクエクスチェンジ（CRE）
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/cre/configurations | 役職 | エンティティマッピングを含むNetskope Risk Exchange（CRE）プラグイン構成を作成します。 |
| /api/cre/configurations | 役職 | エンティティ マッピングを持つCrowdStrike（CRE）プラグイン構成を作成します。 |
| /api/cre/business_rules | 役職 | UsersエンティティのCREビジネスルールを作成します。 |
| /api/cre/business_rules | 役職 | デバイスエンティティのCREビジネスルールを作成します。 |
| /api/cre/business_rules | 役職 | ApplicationsエンティティのCREビジネスルールを作成します。 |
| /api/cre/business_rules | パッチ | アクションを追加するためにCREビジネスルールを更新します。 |
Exact データ Match (EDM)
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main | 役職 | Netskope Exact データ Match (EDM) プラグイン設定を作成します。 |
| /api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main | 役職 | Linux File Share（EDM）プラグイン構成を作成します。 |
| /api/edm/business_rules | 役職 | Linuxファイル共有EDM設定からNetskope EDM設定にEDMハッシュを共有します。 |
カスタムファイル分類（CFC）
| APIエンドポイント | 方法 | 使うケース |
|---|---|---|
| /api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main | 役職 | Netskope Custom File Classification（CFC）プラグイン構成を作成します。 |
| /api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main | 役職 | Linuxファイル共有（CFC）プラグイン設定を作成します。 |
| /api/cfc/business_rule | 役職 | CFCビジネスルールを作成します。 |
| /api/cfc/sharing | 役職 | Linuxファイル共有CFC構成のCFCハッシュをNetskope CFC構成に共有します。 |
認証
認証トークンの生成
API Endpoint: https://<CE_URL>/api/auth
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Content-Type | application/x-www-form-urlencoded |
Request Body
| 鍵 | Value |
|---|---|
| grant_type | password |
| ユーザー名 | <ce_username> |
| password | <ce_password> |
Sample API Response
{
"access_token": "<generated_access_token_value>",
"token_type": "bearer",
"scopes": [
"admin",
"api",
"me",
"cte_read",
"cto_read",
"cls_read",
"cre_read",
"settings_read",
"logs",
"cte_write",
"cto_write",
"cre_write",
"cls_write",
"settings_write",
"edm_read",
"cfc_read",
"edm_write",
"cfc_write",
"ai_read",
"ai_write"
],
"firstLogin": false,
"passwordPolicyViolation": false,
"passwordPolicy": null
}
ログシッパー（CLS）
これらのAPIを使用して、Log Shipperプラグインの設定、ビジネスルールの作成、およびログ配信のためにビジネスルールをSIEM宛先にマッピングします。
プラグイン設定
Netskopeログ発送者プラグインの設定
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope CLS",
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"tenant": "<tenant_name>",
"active": true,
"attributeMappingRepo": null,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
}
}
Sample API Response
{
"name": "Netskope CLS",
"types": [
"alerts",
"events"
],
"netskope": true,
"plugin": "netskope.plugins.Default.netskope_cls.main",
"pluginName": "Netskope Log Shipper",
"pluginVersion": "2.3.0",
"pushSupported": true,
"pullSupported": false,
"tenant": "<tenant_name>",
"active": true,
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"attributeMapping": null,
"attributeMappingRepo": null,
"parameters": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_type": [
"page",
"application",
"audit",
"infrastructure",
"network",
"incident",
"endpoint"
],
"hours": 1,
"incident_forensics": "no",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
QRadarプラグインの設定
API Endpoint: https://<CE_URL>/api/cls/configurations
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"active": true,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"useProxy": false
}
Sample API Response
{
"name": "QRadar CLS",
"types": [
"alerts",
"events",
"webtx",
"logs"
],
"netskope": false,
"plugin": "netskope.plugins.Default.qradar.main",
"pluginName": "QRadar",
"pluginVersion": "3.1.0",
"pushSupported": true,
"pullSupported": false,
"tenant": null,
"active": true,
"pollIntervalUnit": "minutes",
"pollInterval": 60,
"attributeMapping": "QRadar Default Mappings",
"attributeMappingRepo": "Default",
"parameters": {
"qradar_server": "<qradar_server>",
"qradar_format": "CEF",
"qradar_protocol": "UDP",
"qradar_port": 8888,
"qradar_certificate": "",
"log_source_identifier": "netskopeceCLS",
"transformData": "cef"
},
"logsIngested": 0,
"bytesIngested": 0,
"lastRunAt": null,
"lastRunSuccess": null
}
ビジネスルール構成
ログシッパービジネスルールを作成する
API Endpoint: https://<CE_URL>/api/cls/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {}
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {},
"isDefault": false
}
ログ配信設定
ログ配信（SIEMマッピング）を構成する
API Endpoint: https://<CE_URL>/api/cls/business_rule
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
Sample API Response
{
"name": "CLS Business Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "alert_type IN (\"Device\", \"Content\", \"anomaly\", \"policy\", \"Compromised Credential\", \"malsite\", \"Malware\", \"watchlist\", \"Legal Hold\", \"quarantine\", \"Remediation\", \"c2\", \"DLP\", \"Security Assessment\", \"uba\", \"ips\", \"ctep\") || event_type IN (\"NLS Malsite\", \"bwan_client\", \"NLS Policy\", \"bwan_authentication\", \"network\", \"bwan_system\", \"NLS Malware\", \"NLS Compromised Credential\", \"NLS Security Assessment\", \"NLS CTEP\", \"NLS WebTx\", \"NLS Content\", \"infrastructure\", \"NLS Audit\", \"audit\", \"NLS Page\", \"NLS EPDLP\", \"NLS UBA\", \"NLS Incident\", \"incident\", \"NLS Application\", \"NLS Quarantine\", \"NLS DLP\", \"bwan_gateway\", \"page\", \"bwan_audit\", \"application\", \"NLS Infrastructure\", \"NLS Network\", \"endpoint\", \"NLS Clientstatus\", \"clientstatus\", \"NLS Device\", \"NLS Remediation\", \"NLS Watchlist\")",
"mongo": "{\"$or\":[{\"alert_type\":{\"$in\":[\"Device\",\"Content\",\"anomaly\",\"policy\",\"Compromised Credential\",\"malsite\",\"Malware\",\"watchlist\",\"Legal Hold\",\"quarantine\",\"Remediation\",\"c2\",\"DLP\",\"Security Assessment\",\"uba\",\"ips\",\"ctep\"]}},{\"event_type\":{\"$in\":[\"NLS Malsite\",\"bwan_client\",\"NLS Policy\",\"bwan_authentication\",\"network\",\"bwan_system\",\"NLS Malware\",\"NLS Compromised Credential\",\"NLS Security Assessment\",\"NLS CTEP\",\"NLS WebTx\",\"NLS Content\",\"infrastructure\",\"NLS Audit\",\"audit\",\"NLS Page\",\"NLS EPDLP\",\"NLS UBA\",\"NLS Incident\",\"incident\",\"NLS Application\",\"NLS Quarantine\",\"NLS DLP\",\"bwan_gateway\",\"page\",\"bwan_audit\",\"application\",\"NLS Infrastructure\",\"NLS Network\",\"endpoint\",\"NLS Clientstatus\",\"clientstatus\",\"NLS Device\",\"NLS Remediation\",\"NLS Watchlist\"]}}]}",
"isValid": true
},
"muteRules": [],
"siemMappings": {
"Netskope CLS": [
"QRadar CLS"
]
},
"isDefault": false
}
脅威交換（CTE）
これらのAPIを使用して、Threat Exchangeプラグインの構成、ビジネスルールの作成、およびプラグイン間の共有の構成を行います。
プラグイン設定
Netskope Threat Exchangeプラグインを構成する
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.netskope.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope CTE",
"active": true,
"tenant": "<tenant_name>",
"tagsAggregateStrategy": "append",
"sslValidation": true,
"pollIntervalUnit": "minutes",
"reputation": 5,
"pollInterval": 10,
"ageAfterDays": 90,
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"useProxy": false
}
Sample API Response
{
"name": "Netskope CTE",
"plugin": "netskope.plugins.Default.netskope.main",
"pluginName": "Netskope Threat Exchange",
"pluginVersion": "2.5.0",
"pushSupported": true,
"tenant": "<tenant_name>",
"active": true,
"sslValidation": true,
"pollInterval": 10,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"days": 7,
"is_pull_required": "Yes",
"enable_retrohunt_and_fp": "no",
"enable_tagging": "yes",
"threat_data_type": [
"MD5",
"SHA256",
"URL"
]
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
CrowdStrikeプラグインを設定する
API Endpoint: https://<CE_URL>/api/cte/plugins/configurations/netskope.plugins.Default.crowdstrike.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CrowdStrike CTE",
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"reputation": 5,
"ageAfterDays": 90,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"useProxy": false
}
Sample API Response
{
"name": "CrowdStrike CTE",
"plugin": "netskope.plugins.Default.crowdstrike.main",
"pluginName": "CrowdStrike",
"pluginVersion": "2.3.0",
"pushSupported": true,
"tenant": null,
"active": true,
"sslValidation": true,
"pollInterval": 1,
"pollIntervalUnit": "minutes",
"checkpoint": null,
"reputation": 5,
"lastRunAt": {
"pull": null,
"share": null
},
"ageAfterDays": 90,
"lastRunSuccess": {
"pull": null,
"share": null
},
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"indicator_source_page": [
"endpoint_detections",
"ioc_management"
],
"threat_data_type": [
"sha256",
"md5",
"domain",
"ipv4",
"ipv6"
],
"is_pull_required": "Yes",
"days": 7,
"batch_size": 200,
"source": "Netskope - Cloud Threat Exchange"
},
"filters": [],
"lockedAt": {
"pull": null,
"share": null
},
"manualSync": [],
"tagsAggregateStrategy": "append"
}
ビジネスルール構成
Netskopeインジケータのビジネスルールを作成する
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source Netskope",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
CrowdStrike URLインジケーターのビジネスルールを作成します
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
CrowdStrikeファイルハッシュインジケータのビジネスルールを作成する
API Endpoint: https://<CE_URL>/api/cte/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {},
"creShare": {}
}
共有構成
NetskopeからCrowdStrikeにインジケータを共有する
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source Netskope",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
}
}
Sample API Response
{
"name": "Source Netskope",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"Netskope CTE\"",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"Netskope CTE\"}}}}"
},
"exceptions": [],
"sharedWith": {
"Netskope CTE": {
"CrowdStrike CTE": [
{
"label": "Perform Action",
"value": "action",
"parameters": {
"action": "allow",
"platforms": [
"windows",
"mac",
"linux"
]
}
}
]
}
},
"creShare": {}
}
CrowdStrike から Netskope URL リストに URL インジケーターを共有する
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source CrowdStrike-Malsite",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malsite",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"url\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"url\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to URL List",
"value": "url",
"parameters": {
"list": "CE_QA",
"name": "",
"url_list_type": "Exact",
"max_url_list_cap": 7,
"default_url": "cedefaultpush.io"
}
}
]
}
},
"creShare": {}
}
CrowdStrikeからNetskopeファイルハッシュリストにファイルハッシュインジケーターを共有します
API Endpoint: https://<CE_URL>/api/cte/business_rule
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Source CrowdStrike-Malware",
"muted": null,
"filters": null,
"exceptions": null,
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
}
}
Sample API Response
{
"name": "Source CrowdStrike-Malware",
"entity": "Threat Indicators",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "sources.source Like \"CrowdStrike CTE\" && type IN (\"md5\", \"sha256\")",
"mongo": "{\"sources\":{\"$elemMatch\":{\"source\":{\"$regex\":\"CrowdStrike CTE\"}}},\"type\":{\"$in\":[\"md5\",\"sha256\"]}}"
},
"exceptions": [],
"sharedWith": {
"CrowdStrike CTE": {
"Netskope CTE": [
{
"label": "Add to File Hash List",
"value": "file",
"parameters": {
"file_list": "CE_QA",
"max_file_hash_cap": 8
}
}
]
}
},
"creShare": {}
}
チケットオーケストレーター（CTO）
これらのAPIを使うして、Ticket Orchestratorプラグインの構成、ビジネスルールの作成、およびキューの構成を行います。
プラグイン設定
Netskope Ticket Orchestratorプラグインの設定
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"pluginName": "Netskope Ticket Orchestrator",
"active": true,
"tenant": "<tenant_name>",
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Sample API Response
{
"name": "Netskope Ticket Orchestrator CTO",
"plugin": "netskope.plugins.Default.netskope_itsm.main",
"tenant": "<tenant_name>",
"active": true,
"parameters": {
"params": {
"alert_types": [
"Compromised Credential",
"policy",
"malsite",
"Malware",
"DLP",
"Security Assessment",
"watchlist",
"quarantine",
"Remediation",
"uba",
"ctep",
"Device",
"Content"
],
"days": 7,
"event_types": [
"incident",
"endpoint"
],
"hours": 1,
"filters": {
"mongo": {},
"query": ""
},
"incident_forensics": "no"
},
"incident_update_config": {
"user_email": "<user_email>",
"status_mapping": {
"new": "New",
"in_progress": "In Progress",
"deleted": "Resolved",
"closed": "Resolved"
},
"severity_mapping": {
"low": "Low",
"medium": "Medium",
"high": "High",
"critical": "Critical",
"other": "Low",
"informational": "Low"
}
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": true
}
Jiraプラグインを設定する
API Endpoint: https://<CE_URL>/api/itsm/configuration
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"active": true,
"tenant": null,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"receivingSupported": true,
"useProxy": false,
"filters": null
}
Sample API Response
{
"name": "Jira CTO",
"plugin": "netskope.plugins.Default.jira_itsm.main",
"tenant": null,
"active": true,
"parameters": {
"auth": {
"url": "<Jira_Server_URL>",
"email": "<Jira_Email_ID>",
"api_token": "<Jira_API_Token>"
},
"params": {
"issue_type": "Task"
}
},
"storage": {},
"pollIntervalUnit": "minutes",
"pollInterval": 1,
"updateIncidents": false
}
ビジネスルール構成
Ticket Orchestratorビジネスルールを作成します
API Endpoint: https://<CE_URL>/api/itsm/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"muted": false,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {}
}
キュー構成
キューを構成します
API Endpoint: https://<CE_URL>/api/itsm/business_rule
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}"
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
Sample API Response
{
"muted": false,
"unmuteAt": null,
"name": "Alerts from Netskope",
"filters": {
"query": "configuration Like \"Netskope Ticket Orchestrator CTO\"",
"mongo": "{\"configuration\":{\"$regex\":\"Netskope Ticket Orchestrator CTO\"}}",
"isValid": true
},
"dedupeRules": [],
"muteRules": [],
"queues": {
"Jira CTO": [
{
"label": "CTO Jira - Task",
"value": "10001:10008",
"requireApproval": false,
"defaultMappings": {
"mappings": [
{
"extracted_field": "custom_message",
"destination_field": "summary",
"custom_message": "Netskope $appCategory alert name: $alertName, Event Name: $alert_name"
},
{
"extracted_field": "custom_message",
"destination_field": "description",
"custom_message": "Alert/Event ID: $id\nAlert/Event App: $app\nAlert/Event User: $user\n\nAlert Name: $alertName\nAlert Type: $alertType\nAlert App Category: $appCategory\n\nEvent Name: $alert_name\nEvent Type: $eventType"
}
],
"dedup": [
{
"extracted_field": "custom_message",
"destination_field": "comment",
"custom_message": "Received new alert/event with Alert/Event ID: $id and Alert Name: $alertName, Event Name: $alert_name in Cloud Exchange."
}
]
}
}
]
}
}
リスクエクスチェンジ（CRE）
これらのAPIを使用して、Risk Exchangeプラグインの設定、各エンティティのビジネスルールの作成、アクションの設定を行います。
プラグイン設定
Netskope Risk Exchangeプラグインを構成します
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"pluginName": "Netskope Risk Exchange"
}
Sample API Response
{
"name": "Netskope CRE",
"tenant": "<tenant_name>",
"active": true,
"plugin": "netskope.plugins.Default.netskope_ztre.main",
"pollIntervalUnit": "seconds",
"pollInterval": 30,
"parameters": {
"initial_range": 1,
"days": 7
},
"mappedEntities": [
{
"entity": "Users",
"destination": "Users",
"fields": [
{
"source": "email",
"destination": "email"
},
{
"source": "ubaScore",
"destination": "ubascore"
},
{
"source": "policyName",
"destination": "policy"
}
]
},
{
"entity": "Applications",
"destination": "Applications",
"fields": [
{
"source": "applicationName",
"destination": "name"
},
{
"source": "applicationId",
"destination": "netskope_id"
},
{
"source": "vendor",
"destination": "vendor"
},
{
"source": "source",
"destination": "source"
},
{
"source": "cci",
"destination": "cci"
},
{
"source": "ccl",
"destination": "ccl"
},
{
"source": "categoryName",
"destination": "category"
},
{
"source": "users",
"destination": "users"
},
{
"source": "deepLink",
"destination": "deep_link"
},
{
"source": "customTags",
"destination": "custom_tags"
},
{
"source": "discoveryDomains",
"destination": "discovery_domains"
},
{
"source": "steeringDomains",
"destination": "steering_domains"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
CrowdStrikeプラグインを設定する
API Endpoint: https://<CE_URL>/api/cre/configurations
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"pluginName": "CrowdStrike"
}
Sample API Response
{
"name": "CrowdStrike CRE",
"tenant": null,
"active": true,
"plugin": "netskope.plugins.Default.crowdstrike_ztre.main",
"pollIntervalUnit": "minutes",
"pollInterval": 10,
"parameters": {
"base_url": "https://api.crowdstrike.com",
"client_id": "<client_id>",
"client_secret": "<client_secret>",
"maximum_score": 100
},
"mappedEntities": [
{
"entity": "Agents",
"destination": "Devices",
"fields": [
{
"source": "Host ID",
"destination": "id"
},
{
"source": "System Serial Number",
"destination": "system_serial_number"
},
{
"source": "Overall Assessment Score",
"destination": "overall_assessment_score"
},
{
"source": "Netskope Normalized Score",
"destination": "netskope_normalized_score"
}
]
}
],
"lastRunAt": null,
"lastRunSuccess": null,
"pluginName": null
}
ビジネスルール構成
Usersエンティティのビジネスルールを作成する
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CRE Users Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Users"
}
Sample API Response
{
"name": "CRE Users Rule",
"entity": "Users",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
デバイスエンティティのビジネスルールの作成
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CRE Device Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Devices"
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Applicationsエンティティのビジネスルールを作成します
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CRE Applications Rule",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"entity": "Applications"
}
Sample API Response
{
"name": "CRE Applications Rule",
"entity": "Applications",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
アクション設定
アクションを設定する
API Endpoint: https://<CE_URL>/api/cre/business_rules
Method: PATCH
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CRE Device Rule",
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"requireApproval": true
}
]
}
}
Sample API Response
{
"name": "CRE Device Rule",
"entity": "Devices",
"entityFilters": {
"query": "lastUpdated >= \"2026-07-11T15:27:28+0530\"",
"mongo": "{\"lastUpdated\":{\"$gte\":\"2026-07-11T09:57:28Z\"}}"
},
"actions": {
"CrowdStrike CRE": [
{
"label": "No action",
"value": "generate",
"parameters": {},
"generateAlert": true,
"performLater": false,
"requireApproval": true,
"performRevert": false
}
]
},
"sourceConfiguration": null,
"muted": false,
"unmuteAt": null
}
Exact データ Match (EDM)
これらのAPIを使って、Exact データ Matchプラグインを構成し、共有を構成します。
プラグイン設定
Netskope EDMプラグインを構成する
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.netskope_edm.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope EDM",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope EDM",
"plugin": "netskope.plugins.Default.netskope_edm.main",
"pluginName": "Netskope Exact Data Match",
"pluginVersion": "1.0.1",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null,
"pluginType": null,
"tenant": "<tenant_name>"
}
Linuxファイル共有EDMプラグインの設定
API Endpoint: https://<CE_URL>/api/edm/plugins/configurations/netskope.plugins.Default.linux_file_share_edm.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"active": true,
"pluginType": null,
"pollInterval": 12,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share EDM",
"plugin": "netskope.plugins.Default.linux_file_share_edm.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22,
"filepath": "/home/devuser/performance/1M_edm_dataset.csv",
"delimiter": ",",
"remove_quotes": true
},
"sanity_inputs": {
"sanitization_input": [
{
"field": "Column_1",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": true
},
{
"field": "Column_2",
"normalization": "string",
"caseSensitivity": "none",
"nameColumn": false
},
{
"field": "Column_3",
"normalization": "none",
"caseSensitivity": "sensitive",
"nameColumn": false
},
{
"field": "Column_4",
"normalization": "none",
"caseSensitivity": "insensitive",
"nameColumn": false
},
{
"field": "Column_5",
"normalization": "none",
"caseSensitivity": "none",
"nameColumn": false
}
],
"exclude_stopwords": true
},
"sanity_results": {
"sanity_preview": {
"sanitizationStatus": true,
"message": "Sanitization Done Successfully"
},
"is_unsanitized_data": false
}
},
"lockedAt": null,
"pluginType": null,
"tenant": null
}
共有構成
EDM共有を構成します
API Endpoint: https://<CE_URL>/api/edm/business_rules
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
}
}
Sample API Response
{
"name": "80959f82-2c81-4bd4-ab03-91990f95dbaa",
"sharedWith": {
"Linux File Share EDM": {
"Netskope EDM": [
{
"label": "Share EDM Hashes",
"value": "share_edm_hash",
"parameters": {}
}
]
}
},
"status": "scheduled",
"createdAt": "2026-07-18T10:54:00.171621Z",
"updatedAt": "2026-07-18T10:54:00.171624Z",
"sharedAt": null
}
カスタムファイル分類（CFC）
これらのAPIを使用して、カスタムファイル分類プラグインを構成し、ビジネスルールを作成し、共有を構成します。
プラグイン設定
Netskope CFCプラグインの設定
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.netskope_cfc.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Netskope CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {},
"sslValidation": true,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Netskope CFC",
"plugin": "netskope.plugins.Default.netskope_cfc.main",
"pluginName": "Netskope Custom File Classification",
"pluginVersion": "1.1.0",
"netskope": true,
"pushSupported": true,
"pullSupported": false,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": true,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {},
"lockedAt": null
}
Linuxファイル共有CFCプラグインの設定
API Endpoint: https://<CE_URL>/api/cfc/configuration/netskope.plugins.Default.linux_file_share_cfc.main
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "Linux File Share CFC",
"tenant": "<tenant_name>",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"active": true,
"pollInterval": 12,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"sslValidation": false,
"pollIntervalUnit": "hours"
}
Sample API Response
{
"name": "Linux File Share CFC",
"plugin": "netskope.plugins.Default.linux_file_share_cfc.main",
"pluginName": "Linux File Share",
"pluginVersion": "1.1.0",
"netskope": false,
"pushSupported": false,
"pullSupported": true,
"active": true,
"tenant": "<tenant_name>",
"sslValidation": false,
"pollInterval": 12,
"pollIntervalUnit": "hours",
"lastRunAt": null,
"lastRunSuccess": null,
"parameters": {
"configuration_parameters": {
"server_ip": "<server_ip>",
"username": "<username>",
"password": "<password>",
"port": 22
},
"directory_configuration": {
"directory_paths": [
{
"directory_path": "/home/devuser/cfc/test_images",
"filename_filter": ".*.jpg",
"error": {}
}
]
},
"file_results": {
"file_count_result": {
"data": [
{
"directoryPath": "/home/devuser/cfc/test_images",
"filenameFilter": ".*.jpg",
"filesCount": 100,
"filesSize": 791964015
}
],
"filesCount": {
"total": 100,
"error": false,
"message": "Total file count is within the allowed file count limit."
},
"filesSize": {
"total": 791964015,
"error": false,
"message": "Total file size is within the allowed file size limit."
}
}
}
},
"lockedAt": null
}
ビジネスルール構成
CFCビジネスルールの作成
API Endpoint: https://<CE_URL>/api/cfc/business_rule
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"name": "CFC Rule",
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
}
}
Sample API Response
{
"name": "CFC Rule",
"muted": false,
"unmuteAt": null,
"filters": {
"query": "lastFetched >= \"2026-07-12T14:53:09+0530\"",
"mongo": "{\"lastFetched\":{\"$gte\":\"2026-07-12T09:23:09Z\"}}"
},
"exceptions": [],
"mapped": false,
"updatedBy": "admin",
"updatedAt": "2026-07-19T09:25:14.813000"
}
共有構成
CFC共有を構成します
API Endpoint: https://<CE_URL>/api/cfc/sharing
Method: POST
Request Headers
| 鍵 | Value |
|---|---|
| Authorization | Bearer <generated_access_token_value> |
| Content-Type | アプリケーション/json |
Request Body
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierID": "1510609487600855817",
"classifierName": "performance",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
},
"classifierType": "custom"
}
]
}
Sample API Response
{
"sourceConfiguration": "Linux File Share CFC",
"destinationConfiguration": "Netskope CFC",
"actions": [
{
"label": "Share CFC Hashes",
"value": "share_cfc_hash",
"parameters": {}
}
],
"mappings": [
{
"businessRule": "CFC Rule",
"classifierName": "performance",
"classifierType": "custom",
"classifierID": "1510609487600855817",
"trainingType": "positive",
"errorState": {
"error": false,
"errorMessage": ""
}
}
],
"status": "scheduled",
"errorState": {
"error": false,
"errorMessage": ""
},
"createdAt": "2026-07-19T09:32:57.270695Z",
"createdBy": "admin",
"updatedAt": "2026-07-19T09:32:57.270702Z",
"updatedBy": "admin",
"sharedAt": null
}