Release Notes

1.8.0 (Requires minimum Cloud Exchange version 6.1.0 and minimum Netskope Tenant plugin version 1.6.1)

Added

Added support for the Add to Destination Profile action.
Added support for the Add to DNS Profile action.
Added support for the Add to Service Profile action.
Added support for the Create Device Classification action.
Added automatic removal of a host from its private app (via the revert action) when the associated record no longer matches the configured business rule.
Added coordinated cleanup of the shared client status iterator so it is removed only once no Netskope plugin (CRE or CLS) is using it.

Changed

Updated the Add Host to Private App action to roll hosts over into additional private apps when a private app reaches its host limit, with a Skip Excess Hosts option to skip the excess hosts instead

1.7.0

Added

Added the required hostname parameter to the device payload for device tagging APIs.
Added validation for required fields in entity mappings.
Increased the batch size for device tagging to 1000 devices per API call.

Changed

Updated rate limit handling to retry based on the Retry-After header value, with a 12-second delay between each device tagging API call.

Fixed

Fixed an issue to ensure the revert action is executed only for supported action types.

1.6.0

Added

Added support for the Tag/Untag Device action.
Added handling to split and store comma-separated UBA user records.
Added support to pull Netskope Device tags in CE.

Fixed

Fixed an issue where the plugin sends an empty dict if the expected fields are not found in the API response.

1.5.1

Added

Added support for partial failure in bulk action.
Added resolution for error logs.

Fixed

Fixed an issue while syncing empty values for records.
Fixed case sensitivity issue in email matching for the group actions.

1.5.0

Added

Added the revert action for UCI Impact Update to support Mark Anomaly as Allowed.

1.4.0

Added

Added support for pulling Devices from Client Status Events.
Added additional fields to pull for the Users entity.
Added support for port range in the Add host to Private App action.

1.3.0

Added

Added support for the UCI Reset action.
Added the feature to remove a tag from an application using the Tag/Untag Application action.
Added logger messages.

1.2.0

Added

Added bulk action support starting from CE v5.1.1.

Changed

Updated validation for the Tags parameter in the Add Host to Private App action.

1.1.1

Changed

Updated authentication for the V1 token.

1.1.0

Added

Added support for adding multiple hosts in the Add Host to Private App action.
Added a check to execute the revert action only when the host is available.
Added support for fetching domains of multiple applications in a single API request.

Changed

Made the Protocol parameter optional for the Add host to Private App action.

1.0.0

Added

Initial release.

This document explains how to configure the Netskope Risk Exchange v1.8.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin fetches Users from UBA Alerts, Applications from Applications Events, and Devices from Client Status Events of the Netskope Tenant. This plugin also supports these Actions: Add user to group, Remove user from group, Update UCI score, UCI Reset, Add host to Private App, Create or Update App Instance, Tag/Untag Application, Tag/Untag Device, Add to Destination Profile, Add to DNS Profile, Add to Service Profile, Create Device Classification, and No Action. Mark Anomaly as allowed is also supported for the Update UCI score action.

Prerequisites

To complete this configuration, you need:

A Netskope Tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
A Netskope Cloud Exchange tenant with the Tenant plugin (version 1.6.1 or higher) already configured and the Risk Exchange module enabled.
Connectivity to the Netskope Tenant with permission to generate v1 and v2 tokens.
Ensure the required service or feature to use the Netskope plugin is enabled on your Netskope tenant. If services or features are unavailable, please contact your Netskope administrator or Netskope Support.

Risk Exchange Plugin Support

This plugin fetches Users from UBA Alerts, Applications from Applications Events, and Devices from Client Status Events of the Netskope Tenant. This plugin also supports these Actions: Add user to group, Remove user from group, Update UCI score, UCI Reset, Add host to Private App, Create or Update App Instance, Tag/Untag Application, Tag/Untag Device, Add to Destination Profile, Add to DNS Profile, Add to Service Profile, Create Device Classification, and No Action. Mark Anomaly as allowed is also supported for the Update UCI score action.

Type of Data Pulled	Supported Actions
Application Events Users and their Risk Scores Devices from Client Status Events	Add user to group Remove user from group Update UCI score UCI Reset Add host to Private App Create or Update App Instance Tag/Untag Application Tag/Untag Device Add to Destination Profile Add to DNS Profile Add to Service Profile Create Device Classification No actions Mark Anomaly as Allowed

Note

To pull records related to Devices, you must use the Tenant plugin v1.4.0 or above.
To pull records related to Devices, you must map at least one of the fields under Application entity.
The device tagging feature is tested on Windows and iOS devices.

Mappings

Mappings are used to view the pulled Users, Applications, and Devices details. The fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mappings for Users

Plugin Field Label	Expected Data Type	Suggested Field Label	Aggregate Strategy	Example
email	String	Email	Unique	ashukla@netskope.com
ubaScore	Number	UBA Score	Overwrite	1000
policyName	String	Policy Name	Overwrite	External alert received via REST API
cci	Number	CCI	Overwrite	91
ccl	String	CCL	Overwrite	excellent
deviceClassification	String	Device Classification	Overwrite	managed
policyAction	List	Policy Action	Overwrite	{“Delete”}
severity	String	Severity	Overwrite	informational
destinationIP	String	Destination IP	Overwrite	31.186.239.204
sourceRegion	String	Source Region	Overwrite	Gujarat
sourceIP	String	Source IP	Overwrite	103.108.207.58
userIP	String	User IP	Overwrite	192.168.60.106
policyID	String	Policy ID	Overwrite	11, 4, 9, 8

Pull Mappings for Applications

Plugin Field Label	Expected Data Type	Suggested Field Label	Aggregate Strategy	Example
applicationName	String	Name	Unique	Amazon S3
applicationID	String	Netskope ID	Unique	9528
Vendor	String	Vendor	Overwrite	Amazon Web Services, Inc.
Source	String	Source	Overwrite	CRE Netskope
CCI	Number	CCI	Overwrite	91
CCL	String	CCL	Overwrite	excellent
Category	String	Category	Overwrite	Cloud Storage
Users	List	Users	Overwrite	{“ashukla@netskope.com”}
Deep Link	String	Deep Link	Overwrite	https://crest-plugin-support.de.goskope.com/ns#/app_index_detail/index/9528
Custom Tags	List	Custom Tags	Overwrite	{“Sanctioned”,“Enterprise”}
Discovery Domains	List	Discovery Domains	Overwrite	{“s3.amazonaws.com”,“s3-us-west-2.amazonaws.com”}
Steering Domains	List	Steering Domains	Overwrite	{“s3.amazonaws.com”,“s3-us-west-2.amazonaws.com”}

Pull Mappings for Devices

Plugin Field Label	Expected Data Type	Suggested Field Label	Aggregate Strategy	Example
Device ID	String	Device ID	Unique	6Ih62lClzdCYY0hrylay_0155A2F0-5101-C6A7-B9EA-9051318D7DC7
Netskope Device UID	String	Netskope Device UID	Unique	0155A2F0-5101-C6A7-B9EA-9051318D7DC7
Device Serial number	String	Device Serial number	Unique	PF2C5ZAM
User Key	List	User Key	Unique	{“0215db3EgdK0WFcvxvth”,“304ouvzd7Y3o3ncHjIQa”,“F9wi7b7rSMwH3tlk0Iu4”}
Hostname	String	Hostname	Overwrite	Win22-50-7-148
MAC Addresses	List	MAC Addresses	Overwrite	{“A8:7E:EA:BA:E2:AD”}
Last connected from Private IP	String	Last connected from Private IP	Overwrite	192.168.26.205
Last connected from Public IP	String	Last connected from Public IP	Overwrite	110.227.208.87
Operating System	String	Operating System	Overwrite	4
Operating System Version	String	Operating System Version	Overwrite	11.0.22631
Device Make	String	Device Make	Overwrite	VMware, Inc.
Device Model	String	Device Model	Overwrite	VMware7,1
Last Updated Timestamp	Datetime	Last Updated Timestamp	Overwrite	02/05/2026 6:29:07 PM
Management ID	String	Management ID	Overwrite	6D198229A5839C42A47E41A0E1C6BC12
Steering Config	String	Steering Config	Overwrite	Default tenant config
Region	String	Region	Overwrite	Maharashtra
User Name	String	User Name	Overwrite	deepthis@netskope.com
Device Classification Status	String	Device Classification Status	Overwrite	2

Note

If you have the same records across multiple plugins, make sure to map the same fields in the plugins.
From Cloud Exchange v6.1.0, records can be merged using normalization of string field values.
- To enable normalization, you must select the desired normalization type while creating the field in the schema editor.
  Supported normalization types include None, Uppercase, Lowercase, and Title Case.
- When configured, all incoming values for that field are normalized into a single standardized value, while the original plugin-specific values are also preserved.
- The normalized value is used for record matching and merging, ensuring that identical records are stored as a single record.
- During the update or action workflows, the system automatically uses the appropriate value:
  - Plugin-specific value (if available for the target plugin).
  - Otherwise, the normalized value is used.
- Normalization helps maintain data consistency across multiple integrations while preserving the original source values.

Permissions

You need a v2 token created using the Netskope Cloud Exchange Role.

The required permissions (privilege levels) per plugin are available in REST API scopes.

To use the newly added actions, make sure these endpoint access are available in your token inorder to use the plugin without any error.

Service Profile
Destination Profile
DNS Profile
Device Classification

API Details

List of APIs Used

API Endpoint	Method	Use Case
/api/v2/events/dataexport/alerts/uba	GET	Pull Users from UBA Alerts
/api/v2/events/dataexport/events/application	GET	Pull Applications from Application Events
/api/v2/events/dataexport/events/clientstatus	GET	Pull Devices from Client Status Events
/api/v2/events/dataexport/iterator/{iterator_name}	GET	Connectivity check
/api/v2/incidents/uba/getuci	POST	Refresh UCI score for Users
/api/v2/services/cci/app	GET	Enrich Applications with app details
/api/v2/services/cci/domain	GET	Enrich Applications with discovery and steering domains
/api/v2/services/cci/tags	GET/POST/PATCH	Enrich Applications with tags; Tag/Untag Application action
/api/v2/devices/device/tags/gettags	POST	Enrich Devices with tags; Tag/Untag Device action
/api/v2/devices/device/tags	POST	Create device tags
/api/v2/devices/device/tags/bulkadd	POST	Add device tags
/api/v2/devices/device/tags/bulkremove	POST	Remove device tags
/api/v2/devices/device/tags/bulkreplace	POST	Replace device tags
/api/v2/scim/Groups	GET/POST	List and create SCIM groups
/api/v2/scim/Groups/{group_id}	PATCH	Add or remove group members
/api/v2/scim/Users	GET	Resolve user by email
/api/v2/incidents/user/uciimpact	POST	Update UCI score
/api/v2/incidents/anomalies/{anomaly_id}/allow	POST	Mark Anomaly as Allowed (revert of Update UCI score)
/api/v2/incidents/users/uci/reset	POST	UCI Reset
/api/v2/steering/apps/private	GET/POST/PATCH/DELETE	List, create, update, and delete private apps
/api/v2/infrastructure/publishers	GET	List publishers
/api/v1/app_instances	POST	List, create, and update app instances
/api/v2/profiles/destinations	GET/POST/PATCH	List, create, and update destination profiles
/api/v2/profiles/destinations/{id}/values	PATCH	Append overflow values to a destination profile
/api/v2/profiles/destinations/deploy	POST	Deploy pending destination profile changes
/api/v2/profiles/dns	GET/POST/PATCH	List, create, and update DNS profiles
/api/v2/profiles/dns/domaincategories	GET	Fetch DNS domain categories
/api/v2/profiles/dns/recordtypes	GET	Fetch DNS record types
/api/v2/profiles/serviceobjects	GET/POST/PATCH	List, create, and update service profiles
/api/v2/deviceclassification/tags	GET/POST	List and create device classifications
/api/v2/deviceclassification/rules	GET/POST/PUT	List, create, and update device classification rules

Note

Here are the APIs used by the Netskope Tenant plugin for pulling alerts and events from the Netskope tenant:

GET – /api/v2/events/dataexport/alerts/uba
GET – /api/v2/events/dataexport/events/application
POST – /api/v2/events/dataexport/iterator/<iterator_name>?eventtype=clientstatus
GET – /api/v2/events/dataexport/iterator/<iterator_name>
GET – /api/v2/events/dataexport/iterator/<iterator_name>/events
DELETE – api/v2/events/dataexport/iterator/<iterator_name>

List App instances

API Endpoint: https://<tenant-url>/api/v1/app_instances

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
op	list
app	<app_name>
instance_id	<instance_id>
instance_name	<instance_name> (Name should be unique within app + instance_id or app + instance_name)

Body

{"token": <netskope_api_v1_token>}

Sample API Response

{
    "status": "success",
    "data": [
        {
            "app": "<app_name>",
            "instance_name": "<instance_name>",
            "instance_id": "<instance_id>",
            "type": "Custom",
            "tags": [
                "Unsanctioned"
            ],
            "last_modified": "2025-03-28 05:19:11",
            "custom": "0",
            "app_id": "355"
        }
    ]
}

Create/Update App Instances

API Endpoint: https://<tenant-url>/api/v1/app_instances

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
op	add/update

Body

{
    "instances": [
        {
            "app": "<app_name>",
            "instance_id": "<instance_id>",
            "instance_name": "<instance_name>",
            "tags": [
                "Unsanctioned" or "Sanctioned"
            ]
        },
        ….
    ],
    "token": "<netskope_api_v1_token>"
}

Sample API Response

{
    "status": "success",
    "msg": "Successfully updated/added instances"
}

Get the UCI Score of Users

API Endpoint: https://<tenant-url>/api/v2/incidents/uba/getuci

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "capPerUser": 1,
  "fromTime": 0,
  "users": [
    "<user_email>",
    ….
  ]
}

Sample API Response

{
  "usersUci": [
    {
      "confidences": [
        {
          "confidenceScore": 890,
          "start": 0
        }
      ],
      "userId": "<user_email>"
    },
    ….
  ]
}

Update the UCI Impact Score of a User

API Endpoint: https://<tenant-url>/api/v2/incidents/user/uciimpact

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "reason": "<reason for score update>",
  "score": 50,
  "source": "Netskope CE",
  "timestamp": 1654823213000,
  "user": "<user_email>"
}

Sample API Response

{
  "anomalyId": "6df62bd14c47f2d8ad10f964",
  "user": "<user_email>",
  "time": 1743163112000,
  "score": 1,
  "activity": "ActivityForUciImpactAPI",
  "eventId": "6df62bd14c47f2d8ad10f964",
  "anomalyCreatedTime": "2025-03-28T12:02:03Z",
  "source": "Netskope CE",
  "reason": "<reason for score update>"
}

Get users from the Netskope tenant.(For ‘Add User to Group’ and ‘Remove User to Group’ actions.)

API Endpoint: https://<tenant-url>/api/v2/scim/Users

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
count	100
startIndex	1

Sample API Response

{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "totalResults": 6,
  "Resources": [
    {
      "schemas": [
        "urn:ietf:params:scim:schemas:core:2.0:User"
      ],
      "id": "84579d2d-bc72-4f44-94d3-1957758452cf",
      "externalId": " ",
      "userName": "<user_email>",
      "active": true,
      "name": {
        "givenName": "<User>",
        "familyName": "<User>"
      },
      "meta": {
        "lastModified": "2025-02-25T15:10:49Z"
      },
      "emails": [
        {
          "type": "work",
          "value": "<user_email>",
          "primary": true
        }
      ]
    },
    ….
  ],
  "itemsPerPage": 6,
  "startIndex": 1
}

Get Groups from the Netskope Tenant

API Endpoint: https://<tenant-url>/api/v2/scim/Groups

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
count	100
startIndex	1

Sample API Response

{
  "Resources": [
    {
      "displayName": "<group_name>",
      "externalId": null,
      "id": "a0a5bd90-de3d-4e6d-a7d1-011661b4e5a5",
      "meta": {
        "lastModified": "2025-01-17T11:35:04Z"
      }
    },
    ….
  ],
  "itemsPerPage": 5,
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:ListResponse"
  ],
  "startIndex": 1,
  "totalResults": 5
}

Create a Group

API Endpoint: https://<tenant-url>/api/v2/scim/Groups

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "displayName": "<group_name>",
  "externalId": null,
  "meta": {
    "resourceType": "Group"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ]
}

Sample API Response

{
  "displayName": "<group_name>",
  "externalId": null,
  "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "members": [],
  "meta": {
    "resourceType": "Group"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "status": 201
}

Add Users to a Group

API Endpoint: https://<tenant-url>/api/v2/scim/Groups/<group_id>

Method: PATCH

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "Operations": [
    {
      "op": "add",
      "path": "members",
      "value": [
        {
          "value": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        }
      ]
    }
  ],
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ]
}

Sample API Response

Status Code 204: Empty response.

Remove Users from a Group

API Endpoint: https://<tenant-url>/api/v2/scim/Groups/<group_id>

Method: PATCH

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "Operations": [
    {
      "op": "remove",
      "path": "members",
      "value": [
        {
          "value": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        }
      ]
    }
  ],
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ]
}

Sample API Response

Status Code 204: Empty response.

Get Application Details

API Endpoint: https://<tenant-url>/api/v2/services/cci/app

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
apps	List of Application names separated by a ; (semicolon). 100 is the max allowed input size.

Sample API Response

{
  "data": [
    {
      "app_name": "Box",
      "category_name": "Cloud Storage",
      "cci": 79,
      "ccl": "high",
      "id": 355,
      "organisation": "Box, Inc"
    },
    ….
  ],
  "status": "Success",
  "status_code": 200,
  "total_query_count": 100
}

Get Application Domain Details

API Endpoint: https://<tenant-url>/api/v2/services/cci/domain

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
ids	List of Application ids separated by a ; (semicolon). 100 is the max allowed input size.

Sample API Response

{
  "data": [
    {
      "app_name": "Box",
      "discovery_domains": [
        "box.com",
         ….
      ],
      "id": 355,
      "steering_domains": [
        "box.com",
        ….
      ]
    }
  ],
  "status": "Success",
  "status_code": 200
}

Get a List of Private Apps

API Endpoint: https://<tenant-url>/api/v2/steering/apps/private

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
fields	app_id,app_name,host

Sample API Response

{
  "data": {
    "private_apps": [
      {
        "app_id": 51,
        "app_name": "[<private_app_name>]",
        "host": "198.19.214.180,1234"
      },
      ….
    ]
  },
  "status": "success",
  "total": 4
}

Create a Private App

API Endpoint: https://<tenant-url>/api/v2/steering/apps/private

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "displayName": "<group_name>",
  "externalId": null,
  "meta": {
    "resourceType": "Group"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ]
}

Sample API Response

{
  "displayName": "<group_name>",
  "externalId": null,
  "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "members": [],
  "meta": {
    "resourceType": "Group"
  },
  "schemas": [
    "urn:ietf:params:scim:schemas:core:2.0:Group"
  ],
  "status": 201
}

Update a Private App

API Endpoint: https://<tenant-url>/api/v2/steering/apps/private/<app_id>

Method: PATCH

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
    "host": "1.1.1.1,3.2.14.4",
    "protocols": [
        {
            "port": "23",
            "type": "TCP"
        }
    ],
    "publishers": [
        {
            "publisher_id": "3",
            "publisher_name": "<publisher_name>"
        }
    ],
    "tags": [
        {
            "tag_name": "test"
        }
    ]
}

Sample API Response

{
  "data": {
    "allow_unauthenticated_cors": false,
    "allow_uri_bypass": false,
    "app_id": 51,
    "app_name": "[<app_name>]",
    "app_option": {},
    "bypass_uris": [],
    "clientless_access": false,
    "host": "1.1.1.1,3.2.14.4",
    "id": 51,
    "is_user_portal_app": false,
    "modified_by": "apigw",
    "modify_time": "2025-04-01 04:03:31",
    "name": "[Risk Exchange Demo]",
    "policies": [],
    "private_app_protocol": "",
    "protocols": [
      {
        "created_at": "2025-04-01T04:03:31.659Z",
        "id": 270,
        "port": "23",
        "service_id": 3,
        "transport": "tcp",
        "updated_at": "2025-04-01T04:03:31.659Z"
      }
    ],
    "public_host": "",
    "reachability": {
      "reachable": false
    },
    "real_host": "",
    "service_publisher_assignments": [
      {
        "primary": null,
        "publisher_id": 3,
        "publisher_name": "<publisher_name>",
        "reachability": null,
        "service_id": 51
      }
    ],
    "steering_configs": [
      "Default tenant config"
    ],
    "supplement_dns_for_osx": false,
    "tags": [
      {
        "tag_id": 153,
        "tag_name": "test"
      }
    ],
    "trust_self_signed_certs": false,
    "uribypass_header_value": "",
    "use_publisher_dns": false
  },
  "status": "success"
}

Get Tags related Details for Particular Applications

API Endpoint: https://<tenant-url>/api/v2/services/cci/tags

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
apps	Box;Amazon Database;etc.

Sample API Response

{
  "data": {
    "Amazon Database": {
      "app_type": "Consumer",
      "id": 7564,
      "sanctioned": "No",
      "tags": []
    },
    "Box": {
      "app_type": "Enterprise",
      "id": 355,
      "sanctioned": "No",
      "tags": []
    },
    …..
  },
  "status": "Success",
  "status_code": 200
}

Create a CCI Tag

API Endpoint: https://<tenant-url>/api/v2/services/cci/tags

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "apps": [
    "Box",
    "Amazon Database",
    ….
  ],
  "tag": "<tag_name>"
}

OR

{
  "ids": [
    1,
    2,
    ….
  ],
  "tag": "<tag_name>"
}

Sample API Response

{
  "apps": [
    "Box",
    "Amazon Database"
  ],
  "message": "Tag created successfully and associated to the list of apps/ids",
  "status": "Success",
  "status_code": 200,
  "tag": "<tag_name>"
}

Update a CCI Tag

API Endpoint: https://<tenant-url>/api/v2/services/cci/tags/<tag_name>

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

Tag

{
  "action": "append",
  "apps": [
    "Box",
    "Amazon Database",
    ….
  ],
  "tag": "<tag_name>"
}

OR

{
  "action": "append",
  "ids": [
    1,
    2,
    ….
  ],
  "tag": "<tag_name>"
}

Untag

{
  "action": "remove",
  "apps": [
    "Box",
    "Amazon Database",
    ….
  ],
  "tag": "<tag_name>"
}

OR

{
  "action": "remove",
  "ids": [
    1,
    2,
    ….
  ],
  "tag": "<tag_name>"
}

Sample API Response

Tag
{
  "action": "append",
  "apps": [
    "Box",
    "Amazon Database"
  ],
  "message": "Tag updated successfully to the list of apps/ids",
  "status": "Success",
  "status_code": 200,
  "tag": "<tag_name>"
}

Untag
{
  "action": "remove",
  "apps": [
    "Box",
    "Amazon Database"
  ],
  "message": "Tag deleted successfully from the list of apps/ids",
  "status": "Success",
  "status_code": 200,
  "tag": "<tag_name>"
}

Get a List of Publishers

API Endpoint: https://<tenant-url>/api/v2/infrastructure/publishers

Method: GET

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Parameters

Key	Value
fields	publisher_id,publisher_name

Sample API Response

{
  "data": {
    "publishers": [
      {
        "publisher_id": 3,
        "publisher_name": "<publisher_name>"
      },
      ….
    ]
  },
  "status": "success",
  "total": 5
}

Reset the UCI Score

API Endpoint: https://<tenant-url>/api/v2/incidents/users/uci/reset

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "users": [
    "<user_email>"
  ]
}

Sample API Response

{
  "result": "Success"
}

Mark Anomali as Allowed

API Endpoint: https://<tenant-url>/api/v2/incidents/anomalies/<anomaly_id>/allow

Method: POST

Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Netskope-API-Token	<netskope_api_v2_token>
X-CE-Installation-Id	<installation_id>

Body

{
  "reason": "Marking as Allowed from Netskope CE."
}

Sample API Response

{
  "anomalyId": "3ec04e4cedf2333d94caf649",
  "user": "<user_email>",
  "time": 1760036239000,
  "score": 0,
  "activity": "ActivityForUciImpactAPI",
  "eventId": "3ec04e4cedf2333d94caf649",
  "anomalyCreatedTime": "2025-10-09T18:57:20Z",
  "markAsAllowed": true,
  "reasonForAllowed": "Marking as Allowed from Netskope CE.",
  "source": "CE",
  "reason": "CE"
}

Pull UBA Alerts from Netskope tenant

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/uba

Method: GET

Request Headers

Key	Value
Netskope-API-Token	<netskope_api_v2_token>
User-Agent	netskope-ce-6.1.0

Sample API Response

{
    "_id": "b7dce8f570123bdd868a8315",
    "access_method": "UCI Impact API",
    "acked": "false",
    "action": "anomaly_detection",
    "activity": "ActivityForUciImpactAPI",
    "alert": "yes",
    "alert_id": "505464b05529c82e34d31970",
    "alert_name": "External alert from Netskope due to Risky User",
    "alert_type": "uba",
    "anomaly_type": "Fact",
    "app": "",
    "appcategory": "n/a",
    "category": "n/a",
    "cci": 0,
    "ccl": "unknown",
    "count": 1,
    "createdTime": "2025-02-24 08:15:55.461000",
    "device": "Other",
    "event_type": "uba_analytics",
    "instance_id": "",
    "organization_unit": "",
    "policy": "External alert received via REST API",
    "score": 1,
    "severity": "informational",
    "src_country": "IN",
    "src_geoip_src": 2,
    "src_latitude": 23.0276,
    "src_location": "Ahmedabad",
    "src_longitude": 72.5871,
    "src_region": "Gujarat",
    "src_zipcode": "380009",
    "srcip": "122.170.162.148",
    "timestamp": 1740384954,
    "type": "nspolicy",
    "ur_normalized": "tanushree.kurup@crestdata.ai",
    "user": "tanushree.kurup@crestdata.ai",
    "userkey": "tanushree.kurup@crestdata.ai",
    "windowId": 1740355200000,
    "record_type": "alert",
    "last_device": "",
    "surhn": "",
    "policy_id": "",
    "uba_ap1": "",
    "evt_src_chnl": "",
    "all_policy_matches": [],
    "threshold": 0,
    "web_universal_connector": "",
    "user_category": "",
    "managementID": "",
    "division": "",
    "download_app": "",
    "user_id": "",
    "dst_longitude": 0.0,
    "audit_type": "",
    "object_count": 0,
    "policy_name": "",
    "activity_status": "",
    "group": "",
    "act_user": "",
    "referer": "",
    "connection_id": 0,
    "app_category": "",
    "bin_timestamp": 0,
    "hostname": "",
    "app_activity": "",
    "md5": "",
    "risk_level_id": 0,
    "suppression_end_time": 0,
    "protocol": "",
    "request_type": "",
    "request_id": 0,
    "app_session_id": 0,
    "User_SPACE_Id": "",
    "user_name": "",
    "last_timestamp": 0,
    "netskope_activity": "",
    "dst_geoip_src": 0,
    "tss_scan_failed": "",
    "loginurl": "",
    "threshold_time": 0,
    "risk_level": "",
    "managed_app": "",
    "browser_version": "",
    "file_category": "",
    "from_user_category": "",
    "page": "",
    "last_location": "",
    "url": "",
    "uba_ap2": "",
    "sanctioned_instance": "",
    "object_id": "",
    "dst_timezone": "",
    "custom_attr": {},
    "to_object": "",
    "dst_country": "",
    "traffic_type": "",
    "telemetry_app": "",
    "page_site": "",
    "file_size": 0,
    "scopes": [],
    "anomalyData": {},
    "os": "",
    "audit_category": "",
    "tss_fail_reason": "",
    "userip": "",
    "last_app": "",
    "incident_id": 0,
    "suppression_start_time": 0,
    "dst_zipcode": "",
    "dstip": "",
    "policy_actions": [],
    "browser": "",
    "src_time": "",
    "sAMAccountName": "",
    "two_factor_auth": "",
    "uba_inst2": "",
    "site": "",
    "displayName": "",
    "sha256": "",
    "object": "",
    "last_country": "",
    "to_user": "",
    "object_type": "",
    "manager": "",
    "last_region": "",
    "dst_region": "",
    "dst_latitude": 0.0,
    "shared_credential_user": "",
    "file_type": "",
    "tss_mode": "",
    "appsuite": "",
    "device_classification": "",
    "logintype": "",
    "AccountType": "",
    "os_version": "",
    "parent_id": "",
    "TSS-scan": "",
    "user_role": "",
    "dst_location": "",
    "to_user_category": "",
    "user_confidence_index": 0,
    "mail": "",
    "browser_session_id": 0,
    "src_timezone": "",
    "useragent": "",
    "employeeType": "",
    "from_user": "",
    "uba_inst1": "",
    "User_SPACE_Name": "",
    "userPrincipalName": "",
    "transaction_id": 0,
    "distinguishedName": "",
    "profile_id": ""
}

Application Events

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/application

Method: GET

Request Headers

Key	Value
Netskope-API-Token	<netskope_api_v2_token>
User-Agent	netskope-ce-6.1.0

Sample API Response

{
    "_id": "5af424a2871523b6e13f853f",
    "access_method": "Client",
    "activity": "Download",
    "alert": "no",
    "app": "ContentSquare",
    "app_session_id": 8320876311700568950,
    "appcategory": "Web Analytics",
    "browser": "Edge",
    "browser_session_id": 5471226135867547944,
    "browser_version": "133.0.0.0",
    "category": "Web Analytics",
    "cci": 60,
    "ccl": "medium",
    "connection_id": 0,
    "count": 1,
    "device": "Windows Device",
    "device_classification": "not configured",
    "dst_country": "IE",
    "dst_latitude": 53.3382,
    "dst_location": "Dublin",
    "dst_longitude": -6.2591,
    "dst_region": "Leinster",
    "dst_timezone": "Europe/Dublin",
    "dst_zipcode": "D02",
    "dstip": "52.48.68.180",
    "dstport": 443,
    "hostname": "WIN11-50-12-151",
    "ja3": "261219d3f4c7b45e9e6014a0084dc181",
    "ja3s": "f4febc55ea12b31ae17cfb7e614afda8",
    "managed_app": "no",
    "netskope_pop": "IN-BOM2",
    "object": "pageview",
    "object_type": "File",
    "organization_unit": "",
    "os": "Windows 11",
    "os_version": "Windows NT 11.0",
    "other_categories": [
        "Content Server",
        "Web Analytics"
    ],
    "page": "c.contentsquare.net/pageview",
    "page_site": "contentsquare",
    "policy_id": "8467252215149297331 2025-02-19 10:04:24.766887",
    "protocol": "HTTPS/1.1",
    "request_id": 3045298505167235584,
    "severity": "unknown",
    "site": "ContentSquare",
    "src_country": "IN",
    "src_latitude": 23.0276,
    "src_location": "Ahmedabad",
    "src_longitude": 72.5871,
    "src_region": "Gujarat",
    "src_time": "Thu Feb 20 14:00:08 2025",
    "src_timezone": "Asia/Kolkata",
    "src_zipcode": "380006",
    "srcip": "182.69.215.65",
    "telemetry_app": "",
    "timestamp": 1740040217,
    "traffic_type": "CloudApp",
    "transaction_id": 1737423402988911503,
    "type": "nspolicy",
    "universal_connector": "yes",
    "ur_normalized": "tanushree.kurup@crestdata.ai",
    "url": "c.contentsquare.net/pageview",
    "user": "tanushree.kurup@crestdata.ai",
    "useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0",
    "userip": "10.50.12.151",
    "userkey": "tanushree.kurup@crestdata.ai",
    "record_type": "application",
    "suppression_key": "",
    "app_activity": "",
    "file_type": "",
    "dlp_incident_id": 0,
    "custom_connector": "",
    "file_path": "",
    "referer": "",
    "md5": "",
    "suppression_end_time": 0,
    "user_id": "",
    "tss_mode": "",
    "channel_id": "",
    "dlp_rule_count": 0,
    "web_universal_connector": "",
    "tss_fail_reason": "",
    "src_geoip_src": 0,
    "owner": "",
    "alert_type": "",
    "total_collaborator_count": 0,
    "to_user": "",
    "ext_labels": [],
    "shared_with": "",
    "sessionid": "",
    "client_bytes": 0,
    "appsuite": "",
    "mime_type": "",
    "dlp_rule_severity": "",
    "workspace_id": "",
    "instance_id": "",
    "logintype": "",
    "policy": "",
    "log_file_name": "",
    "retro_scan_name": "",
    "justification_reason": "",
    "user_category": "",
    "netskope_activity": "",
    "justification_type": "",
    "smtp_to": [],
    "parent_id": "",
    "nsdeviceuid": "",
    "dlp_profile": "",
    "file_lang": "",
    "file_size": 0,
    "userPrincipalName": "",
    "org": "",
    "audit_type": "",
    "title": "",
    "orignal_file_path": "",
    "object_id": "",
    "dsthost": "",
    "from_user": "",
    "req_cnt": 0,
    "sanctioned_instance": "",
    "dlp_rule": "",
    "loginurl": "",
    "scan_type": "",
    "sAMAccountName": "",
    "serial": "",
    "managementID": "",
    "custom_attr": {},
    "from_user_category": "",
    "notify_template": "",
    "dlp_parent_id": 0,
    "user_confidence_index": 0,
    "internal_collaborator_count": 0,
    "dlp_unique_count": 0,
    "dlp_mail_parent_id": "",
    "true_obj_category": "",
    "dst_geoip_src": 0,
    "exposure": "",
    "dlp_is_unique_count": "",
    "numbytes": 0,
    "dlp_fail_reason": "",
    "suppression_start_time": 0,
    "audit_category": "",
    "true_obj_type": "",
    "data_center": "",
    "instance": "",
    "server_bytes": 0,
    "modified": 0,
    "action": "",
    "conn_duration": 0,
    "data_type": "",
    "fromlogs": "",
    "resp_cnt": 0,
    "workspace": "",
    "dlp_file": "",
    "CononicalName": "",
    "tss_scan_failed": "",
    "dlp_scan_failed": "",
    "sha256": ""
}

Create Client Status Iterator

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/netskope_ce_cs_iterator?

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>

Request Parameters

Key	Value
eventtype	clientstatus

Sample API Response – if created successfully [202]

{
   "message":"Creation of the iterator, netskope_ce_cs_<unique_id_added> is in progress. Please use the iterator status API to check the status of the iterator. Please note that the iterator name has changed by appending an identifier to ensure uniqueness."
}

Sample API Response – if iterator cannot be created as already exists [400]

{
   "message":"Only one iterator is allowed per event type. Please use the existing iterator,<iterator_name>, or delete the existing iterator."
}

Check Status of Client Status Iterator

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/<iterator_name>

Method: GET

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>

Sample API Response

{
    "status": "Ready"
}

Fetch Data from Client Status Iterator

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/<iterator_name>/events

Method: GET

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>

Request Parameters

Key	Value
operation	next

Sample API Response

_id,as,asn,city,client_install_time,client_version,count,continent,country,device_hash,device_id,enriched,guid,heart_beat,host_info.client_version,host_info.device_make,host_info.device_model,host_info.hostname,host_info.last_update_timestamp,host_info.mac_addresses,host_info.managementID,host_info.nsdeviceuid,host_info.old_nsdeviceuid,host_info.os,host_info.os_version,host_info.serial_number,host_info.steering_config,isp,last_connected_from_private_ip,last_connected_from_public_ip,last_event_timestamp,last_seen_device_event.actor,last_seen_device_event.event,last_seen_device_event.event_details,last_seen_device_event.npa_status,last_seen_device_event.service_name,last_seen_device_event.status,last_seen_device_event.status_v2,last_seen_device_event.timestamp,latitude,longitude,organization,postal_code,region,timestamp,user_info.device_classification_status,user_info.orgkey,user_info.userkey,user_info.username,zipcode,record_type
a7b8a3dd4aa3bebfac869f21,,,,0,123.0.0.2272,1,,,84a3c71061af4152f4e961f9,0AGE55ntv6Lg06dd2F30_092BDAE2-138E-38A4-1BC3-6BC72C4663E8,false,a9981877-c2be-4d8f-bf31-27410d8269d8,false,,"VMware, Inc.","VMware7,1",Win11-50-1-105,1740377213,00:50:56:81:A7:00,,092BDAE2-138E-38A4-1BC3-6BC72C4663E8,AFADEEE3-C9F6-3C54-E215-46EE64F4358C,0,11.0.22621,VMware-42 01 fa 68 fb 6b 7c 57-20 3c 42 df d2 c7 02 32,Default tenant config,,0.0.0.0,,1741034210,0,17,,8,Internet Security,0,0,1741034210,0,0,,,,0,0,lDFAMb4aR2ohwCHthoV,0AGE55ntv6Lg06dd2F30,nilay.modi@crestdata.ai,"396321",clientstatus
1c07aa9d8ad899d02b7c083b,,,,0,123.0.0.2272,1,,,84a3c71061af4152f4e961f9,0AGE55ntv6Lg06dd2F30_092BDAE2-138E-38A4-1BC3-6BC72C4663E8,false,a9981877-c2be-4d8f-bf31-27410d8269d8,false,,"VMware, Inc.","VMware7,1",Win11-50-1-105,1740377213,00:50:56:81:A7:00,,092BDAE2-138E-38A4-1BC3-6BC72C4663E8,AFADEEE3-C9F6-3C54-E215-46EE64F4358C,0,11.0.22621,VMware-42 01 fa 68 fb 6b 7c 57-20 3c 42 df d2 c7 02 32,Default tenant config,,0.0.0.0,,1741034205,0,7,Tunnel Down Due to SSL Error,8,Internet Security,1,0,1741034205,0,0,,,,0,0,lDFAMb4aR2ohwCHthoV,0AGE55ntv6Lg06dd2F30,nilay.modi@crestdata.ai,"396321",clientstatus

Sample API Response Headers

Delete Client Status Iterator

API Endpoint: https://<tenant-url>/api/v2/events/dataexport/iterator/netskope_ce_cs_iterator_28b7611b-da34-4836-8bdb-89caa3320b6e

Method: GET

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>

Sample API Response

{
    "message": "Successfully deleted the iterator, netskope_ce_cs_iterator_28b7611b-da34-4836-8bdb-89caa3320b6e."
}

To Fetch Tags from Netskope

API Endpoint: https://<tenant-url>/api/v2/devices/device/tags/gettags

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body (To fetch tags for a specific device)

{"devices": [{"nsdeviceuid": device_uid, "userkey": user_key}]}

Request Body (To fetch all tags from Netskope)

{
"devices": [],
"offset": 0,
"limit": 10
}

Sample API Response

{
    "success": true,
    "data": {
        "data": [
            {
                "id": 78,
                "name": "LocalMachine",
                "description": "Tag created by Cloud Exchange",
                "device_count": null,
                "device_classification_count": null
            }
        ],
        "total_count": 1,
        "offset": 0,
        "limit": 20
    }
}

Create Tags on Netskope

API Endpoint: https://<tenant-url>/api/v2/devices/device/tags

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
  "name": "Test Tag",
  "description": "test tag"
}

Sample API Response

{
    "success": true,
    "data": {
        "id": 750,
        "name": "Test111",
        "description": "test tag"
    }
}

To Bulk Add Tags on Netskope devices

API Endpoint: https://<tenant-url>/api/v2/devices/device/tags/bulkadd

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{"tags": [1,2,3], "devices": [{"nsdeviceuid": device_uid, "userkey": user_key}]}

Sample API Response

{
    "success": true,
    "data": {
        "affected_device_tags": 0,
        "affected_device_classification_tags": 0,
        "message": "Tags added successfully"
    }
}

To Bulk Remove Tags from Netskope

API Endpoint: https://<tenant-url>/api/v2/devices/device/tags/bulkremove

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{"tags": [1,2,3], "devices": [{"nsdeviceuid": device_uid, "userkey": user_key}]}

Sample API Response

{
    "success": true,
    "data": {
        "affected_device_tags": 30,
        "affected_device_classification_tags": 0,
        "message": "Tags removed successfully"
    }
}

To Bulk Replace Tags on Netskope Devices

API Endpoint: https://<tenant-url>/api/v2/devices/device/tags/bulkreplace

Method: POST

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "tags": [225, 228, 36, 72, 564], 
    "devices": 
    [
        {"nsdeviceuid": "1925721B-DD2B-6A1-6AA6-7C308D25760C", "userkey": "F9wi7b7rSMwH3tlkIu4"},
        {"nsdeviceuid": "1925721B-DD2B-6A1-6AA6-7C308D25760C", "userkey": "304ouvzd7Y3o3ncjIQa"},
        {"nsdeviceuid": "30B0C195-2BD0-073-465E-74124106A0D3", "userkey": "d37cCoXokC6wkH0eQm5o"},
        {"nsdeviceuid": "9D8AA13B-8866-2025-3112-057515BC31CD", "userkey": "d37cCoXokC6wkH0eQm5o"},
        {"nsdeviceuid": "34B80882-A016-1C8-F457-32EA45FAC429", "userkey": "418qSjsvqLClw2eSfjp"},
        {"nsdeviceuid": "0155A2F0-5101-C6A7-B9EA-9051318D7DC7", "userkey": "6Ih62lClzdCYY0rylay"}
    ]
}

Sample API Response

{
    "success": true,
    "data": {
        "affected_device_tags": 30,
        "affected_device_classification_tags": 0,
        "message": "Tags replaced successfully"
    }
}

Get Destination Profiles

Endpoint: GET /api/v2/profiles/destinations

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Query Parameters

Parameter	Description
fields	Comma-separated list of fields to return, e.g. id,name,type,values_count,description

Sample Response

{
    "elements": [
        {
            "id": "6581ae70-0c4d-4d62-877e-be6902a4d451",
            "name": "CIDR_test",
            "description": "Created from Netskope CE.",
            "type": "insensitive",
            "values": [
                "CIDR:10.0.0.0/8",
                "CIDR:192.168.0.0/16",
                "CIDR:10.20.6.8/24",
                "CIDR:10.10.2.6/32"
            ],
            "values_count": 4,
            "status": "applied",
            "create_by": "Core Team SA",
            "create_time": "2026-06-11T12:02:34.768Z",
            "modify_by": "netskope.user@netskope.com",
            "modify_time": "2026-06-15T12:02:14.659Z",
            "label_ids": []
        }
    ]
}

Create Destination Profiles

Endpoint: POST /api/v2/profiles/destinations

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "name": "My Destination Profile",
    "description": "Created from Netskope CE.",
    "type": "insensitive",
    "values": ["domain.name.com"]
}

Sample Response

{
    "id": "80d52344-856e-4364-b913-c1c18a054fde",
    "name": "Insensitive Match Type123",
    "description": "",
    "type": "insensitive",
    "values": [
        "domain.name.com"
    ],
    "values_count": 1,
    "status": "applied",
    "create_by": "Ambrish RBACv3",
    "create_time": "2026-06-28T19:56:27.432801274Z",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "2026-06-28T19:56:27.432801274Z",
    "label_ids": []
}

Update Destination Profiles

Endpoint: PATCH /api/v2/profiles/destinations/{id}

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "type": "regex",
    "values": ["10.40.12.34"],
    "description": "Created from Netskope CE."
}

Sample Response

{
    "id": "80d52344-856e-4364-b913-c1c18a054fde",
    "name": "Insensitive Match Type123",
    "description": "",
    "type": "regex",
    "values": [
        "10.40.12.34"
    ],
    "values_count": 1,
    "status": "applied",
    "create_by": "Ambrish RBACv3",
    "create_time": "2026-06-28T19:56:27.432Z",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "2026-06-28T19:57:54.798299216Z",
    "label_ids": []
}

Append Values to Destination Profiles

Endpoint: PATCH /api/v2/profiles/destinations/{id}/values

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "operation": {
        "op": "append",
        "values": ["MALWARE.COM"]
    }
}

Sample Response

{
    "id": "80d52344-856e-4364-b913-c1c18a054fde",
    "name": "Insensitive Match Type123",
    "description": "",
    "type": "regex",
    "values": [
        "10.40.12.34",
        "MALWARE.COM"
    ],
    "values_count": 2,
    "status": "applied",
    "create_by": "Ambrish RBACv3",
    "create_time": "2026-06-28T19:56:27.432Z",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "2026-06-28T19:58:28.211Z",
    "label_ids": []
}

Deploy Destination Profile Changes

Endpoint: POST /api/v2/profiles/destinations/deploy

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Sample Response

Get DNS Profiles

Endpoint: GET /api/v2/profiles/dns

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Query Parameters

Parameter	Description
fields	Comma-separated list of fields to return (no spaces after commas), e.g. id,name,domain_config,custom_config,log_traffic,status,tunnel_config,description
sortby	Field to sort by, e.g. name
sortorder	Sort order: asc or desc
limit	Maximum number of profiles to return
offset	Pagination offset

Sample Response

{
    "profiles": [
        {
            "create_by": "ambrish.shukla@crestdata.ai",
            "create_time": "Wed, 24 Jun 2026 20:22:06 GMT",
            "custom_config": {
                "bypass_original_dns": false,
                "enable": false,
                "fallback_to_netskope_dns": true,
                "server_ip": []
            },
            "description": "CRE Netskope Demo",
            "domain_config": {
                "allow_list": [
                    {
                        "destination_profiles": [],
                        "domain_names": [
                            "exploit.com",
                            "malware.trojan.com",
                            "ec2-13-48-217-94.eu-north-1.compute.amazonaws.com",
                            "ec2-54-209-113-57.compute-1.amazonaws.com",
                            "ec2-3-85-47-203.compute-1.amazonaws.com",
                            "ec2-34-201-78-156.compute-1.amazonaws.com"
                        ],
                        "record_types": [
                            "All Record Types"
                        ]
                    }
                ],
                "block_all_except_allow_list": false,
                "block_list": [
                    {
                        "destination_profiles": [],
                        "domain_names": [
                            "ec2-13-211-47-83.ap-southeast-2.compute.amazonaws.com",
                            "ec2-18-212-93-14.compute-1.amazonaws.com",
                            "ec2-54-66-91-35.ap-southeast-2.compute.amazonaws.com",
                            "ec2-54-164-31-112.compute-1.amazonaws.com",
                            "ec2-44-202-58-97.compute-1.amazonaws.com",
                            "ec2-52-49-211-17.eu-west-1.compute.amazonaws.com",
                            "ec2-18-234-76-48.compute-1.amazonaws.com"
                        ],
                        "record_types": [
                            "MX",
                            "NS"
                        ]
                    }
                ],
                "security_categories": [
                    {
                        "action": "Block",
                        "name": "Newly Observed Domain"
                    },
                    {
                        "action": "Block",
                        "name": "Security Risk - Spyware & Questionable Software"
                    }
                ],
                "sinkhole_ip": ""
            },
            "id": "5ebb15c2-700a-11f1-8c73-b6a3c22e7aa4",
            "log_traffic": "Blocked DNS",
            "modify_by": "Ambrish RBACv3",
            "modify_time": "Wed, 24 Jun 2026 21:31:25 GMT",
            "name": "CRE Netskope Demo",
            "status": "Applied",
            "tunnel_config": {
                "allow_list": [],
                "enable": false
            }
        }
    ],
    "total": 1
}

Create a DNS Profile

Endpoint: POST /api/v2/profiles/dns

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "name": "CRE Demo",
    "description": "description",
    "log_traffic": "Blocked DNS",
    "domain_config": {
        "allow_list": [
            {
                "domain_names": ["abc.com"],
                "destination_profiles": [],
                "record_types": ["All Record Types"]
            }
        ],
        "block_list": [
            {
                "domain_names": ["xyz.com"],
                "destination_profiles": [],
                "record_types": ["All Record Types"]
            }
        ],
        "security_categories": [
            {
                "action": "Sinkhole",
                "name": "Newly Registered Domain"
            }
        ],
        "sinkhole_ip": "1.2.3.4",
        "block_all_except_allow_list": false
    },
    "custom_config": {
        "bypass_original_dns": false,
        "enable": false,
        "fallback_to_netskope_dns": true,
        "server_ip": []
    },
    "tunnel_config": {
        "allow_list": [],
        "enable": false
    }
}

Sample Response

{
    "applied_time": "2026-06-28 20:00:13",
    "create_by": "Ambrish RBACv3",
    "create_time": "Sun, 28 Jun 2026 20:00:13 GMT",
    "custom_config": {
        "bypass_original_dns": false,
        "enable": false,
        "fallback_to_netskope_dns": true,
        "server_ip": []
    },
    "description": "description",
    "domain_config": {
        "allow_list": [
            {
                "destination_profiles": [],
                "domain_names": ["abc.com"],
                "record_types": ["All Record Types"]
            }
        ],
        "block_all_except_allow_list": false,
        "block_list": [
            {
                "destination_profiles": [],
                "domain_names": ["xyz.com"],
                "record_types": ["All Record Types"]
            }
        ],
        "security_categories": [
            {
                "action": "Sinkhole",
                "name": "Newly Registered Domain"
            }
        ],
        "sinkhole_ip": "1.2.3.4"
    },
    "id": "f9709442-732b-11f1-8c73-b6a3c22e7aa4",
    "log_traffic": "Blocked DNS",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "Sun, 28 Jun 2026 20:00:13 GMT",
    "name": "CRE Demo",
    "status": "Applied",
    "tunnel_config": {
        "allow_list": [],
        "enable": false
    }
}

Update a DNS Profile

Endpoint: PATCH /api/v2/profiles/dns/{id}

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "domain_config": {
        "allow_list": [
            {
                "domain_names": ["abc.com"],
                "destination_profiles": [],
                "record_types": ["All Record Types"]
            }
        ],
        "block_list": [
            {
                "domain_names": ["abc.com"],
                "destination_profiles": [],
                "record_types": ["A"]
            }
        ],
        "security_categories": [
            {
                "action": "Sinkhole",
                "name": "Newly Registered Domain"
            }
        ],
        "sinkhole_ip": "1.2.3.4",
        "block_all_except_allow_list": false
    }
}

Sample Response

{
    "applied_time": "2026-06-28 20:04:03",
    "create_by": "Ambrish RBACv3",
    "create_time": "Sun, 28 Jun 2026 20:00:13 GMT",
    "custom_config": {
        "bypass_original_dns": false,
        "enable": false,
        "fallback_to_netskope_dns": true,
        "server_ip": []
    },
    "description": "description",
    "domain_config": {
        "allow_list": [
            {
                "destination_profiles": [],
                "domain_names": ["abc.com"],
                "record_types": ["All Record Types"]
            }
        ],
        "block_all_except_allow_list": false,
        "block_list": [
            {
                "destination_profiles": [],
                "domain_names": ["abc.com"],
                "record_types": ["A"]
            }
        ],
        "security_categories": [
            {
                "action": "Sinkhole",
                "name": "Newly Registered Domain"
            }
        ],
        "sinkhole_ip": "1.2.3.4"
    },
    "id": "f9709442-732b-11f1-8c73-b6a3c22e7aa4",
    "log_traffic": "Blocked DNS",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "Sun, 28 Jun 2026 20:04:03 GMT",
    "name": "CRE Demo",
    "status": "Applied",
    "tunnel_config": {
        "allow_list": [],
        "enable": false
    }
}

Get DNS Security Categories

Endpoint: GET /api/v2/profiles/dns/domaincategories

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Sample Response

{
    "domaincategories": [
        {"category_type": "Security", "id": "575", "name": "Newly Observed Domain"},
        {"category_type": "Security", "id": "574", "name": "Newly Registered Domain"},
        {"category_type": "Security", "id": "583", "name": "Security Risk - Ad Fraud"},
        {"category_type": "Security", "id": "588", "name": "Security Risk - Attack"},
        {"category_type": "Security", "id": "578", "name": "Security Risk - Botnets"},
        {"category_type": "Security", "id": "579", "name": "Security Risk - Command and Control server"},
        {"category_type": "Security", "id": "580", "name": "Security Risk - Compromised/malicious sites"},
        {"category_type": "Security", "id": "589", "name": "Security Risk - Cryptocurrency Mining"},
        {"category_type": "Security", "id": "594", "name": "Security Risk - DGA"},
        {"category_type": "Security", "id": "584", "name": "Security Risk - Hacking"}
    ],
    "total": 15
}

Get DNS Record Types

Endpoint: GET /api/v2/profiles/dns/recordtypes

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Sample Response

{
    "recordtypes": [
        {"id": "13", "name": "A"},
        {"id": "62", "name": "AAAA"},
        {"id": "83", "name": "ANY"},
        {"id": "6",  "name": "All Record Types"},
        {"id": "76", "name": "CERT"},
        {"id": "27", "name": "CNAME"},
        {"id": "48", "name": "MX"},
        {"id": "20", "name": "NS"},
        {"id": "41", "name": "PTR"},
        {"id": "34", "name": "SOA"}
    ],
    "total": 12
}

Get Service Profiles

Endpoint: GET /api/v2/profiles/serviceobjects

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Query Parameters

Parameter	Description
type	Filter by profile type; use CUSTOM to list only editable profiles

Sample Response

{
    "services": [
        {
            "create_by": "Ambrish RBACv3",
            "create_time": "Fri, 15 May 2026 09:28:58 GMT",
            "description": "my service description",
            "id": "80870fec-5040-11f1-967d-12b76cb1b053",
            "modify_by": "Ambrish RBACv3",
            "modify_time": "Wed, 27 May 2026 06:34:05 GMT",
            "name": "Trial1",
            "protocols": {
                "icmp": false
            },
            "status": "APPLIED",
            "type": "CUSTOM"
        }
    ],
    "total": 1
}

Create a Service Profile

Endpoint: POST /api/v2/profiles/serviceobjects

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "name": "CRE Demo",
    "description": "cre demo",
    "protocols": {"tcp": ["40"], “udp”: [“50”], “tcp_udp”: [“60”], “icmp”: false}
}

Sample Response

{
    "create_by": "Ambrish RBACv3",
    "create_time": "Sun, 28 Jun 2026 20:07:08 GMT",
    "description": "cre demo",
    "id": "f12d4216-732c-11f1-8b87-de79fdbeee53",
    "modify_by": "Ambrish RBACv3",
    "modify_time": "Sun, 28 Jun 2026 20:07:08 GMT",
    "name": "CRE Demo",
    "protocols": {"tcp": ["40"], “udp”: [“50”], “tcp_udp”: [“60”], “icmp”: false},
    "status": "applied",
    "type": "custom"
}

Update a Service Profile

Endpoint: PATCH /api/v2/profiles/serviceobjects/{id}

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
“protocols”: {
“tcp”: [“8000”]
},
“description”: “updated description”
}

Sample Response

{
“create_by”: “Ambrish RBACv3”,
“create_time”: “Sun, 28 Jun 2026 20:07:08 GMT”,
“description”: “cre demo”,
“id”: “f12d4216-732c-11f1-8b87-de79fdbeee53”,
“modify_by”: “Ambrish RBACv3”,
“modify_time”: “Sun, 28 Jun 2026 20:08:21 GMT”,
“name”: “CRE Demo”,
“protocols”: {“tcp”: [“8000”]},
“status”: “applied”,
“type”: “custom”
}

Get Device Classifications

Endpoint: GET /api/v2/deviceclassification/tags

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Query Parameters

Parameter	Description
limit	Maximum number of records per page
offset	Pagination offset

Sample Response

[
    {
        "id": 28155,
        "priority": 10,
        "name": "CRE Netskope Demo Device Classification",
        "description": "Created from Netskope CE.",
        "modifiedBy": "NetskopeCE-Dev",
        "modifiedTime": "2026-06-26T07:33:46.000Z",
        "policyNames": []
    }
]

Create a Device Classification

Endpoint: POST /api/v2/deviceclassification/tags

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

[
    {
        "name": "CRE Netskope Demo Device Classification",
        "description": "Created from Netskope CE."
    }
]

Sample Response

{
    "status": true,
    "data": [28449]
}

Get Device Classification Rules

Endpoint: GET /api/v2/deviceclassification/rules

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Sample Response

[
    {
        "conditions": {
            "$or": [
                {
                    "$and": [
                        {
                            "$or": [
                                {"device_tag_check": {"tag_id": 4947}},
                                {"device_tag_check": {"tag_id": 1461}},
                                {"device_tag_check": {"tag_id": 1455}}
                            ]
                        }
                    ]
                }
            ]
        },
        "id": 28758,
        "name": "CRE Netskope Demo Device Classification Rule",
        "label": "CRE Netskope Demo Device Classification",
        "os": "windows",
        "modifiedBy": "NetskopeCE-Dev",
        "modifiedTime": "2026-06-26T08:25:36.000Z"
    }
]

Create a Device Classification Rule

Endpoint: POST /api/v2/deviceclassification/rules

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

[
    {
        "conditions": {
            "$or": [
                {
                    "$and": [
                        {
                            "$or": [
                                {"device_tag_check": {"tag_id": 1234}},
                                {"device_tag_check": {"tag_id": 5678}}
                            ]
                        }
                    ]
                }
            ]
        },
        "label": "CRE Netskope Demo Device Classification",
        "name": "CRE Netskope Demo Device Classification Rule",
        "os": "windows"
    }
]

Sample Response (Status 201 No Response)

Update a Device Classification Rule

Endpoint: PUT /api/v2/deviceclassification/rules/{id}

Request Headers

Key	Value
User-Agent	netskope-ce-6.1.0
Authorization	Bearer <v2 token>
Content-Type	application/json

Request Body

{
    "conditions": {
        "$or": [
            {
                "$and": [
                    {
                        "$or": [
                            {"device_tag_check": {"tag_id": 1234}},
                            {"device_tag_check": {"tag_id": 5678}}
                        ]
                    }
                ]
            }
        ]
    },
    "label": "CRE Netskope Demo Device Classification",
    "name": "CRE Netskope Demo Device Classification Rule",
    "os": "windows"
}

Sample Response (Status 200 No Response)

Performance Matrix

Here is the performance matrix conducted on a Large Cloud Exchange Stack with these specifications while pulling 500K Users, Applications and Devices.

Description	Specification
Stack Size	Large RAM: 32 GB Core: 16
Time taken to store the pulled and updated user records	~60 mins
Time taken to store the pulled and updated application records	~60 mins
Time taken to store the pulled device records	~1 hr 20 mins

Note

These readings are for pulling and storing the records. Updating the record with scores might take more time as the plugin will do API calls for updating records every hour.

User Agent

netskope-ce-6.1.0

Workflow

Configure the Risk Exchange plugin.
Configure a Business Rule.
Configure Actions.
Validate the Risk Exchange plugin.

Watch a Video

Click play to watch a video.

Configure the Risk Exchange Plugin

In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Netskope Risk Exchange v1.8.0 (CRE) plugin.
Add a Configuration Name and change the Sync Interval if needed.
Click Next and enter the Configuration Parameters:
- Initial Range for Events (in hours): Number of hours to pull the app/device event data for the initial run. Valid range is 0–8760.
- Initial Range for Alerts (in days): Number of days to pull the UBA alert data for the initial run. Valid range is 0–365.
The Initial Range will be respected only once when you configure the plugin, and then if you edit these fields, then it will not have any effect on pulling records.
Click Next and configure Entity Sources for Users, Applications, and Devices.
- If you want to pull users, then configure entity source for Users.
- If you want to pull applications, then configure entity source for Applications.
- If you want to pull devices, then configure entity source for Devices.
Configure the Entity source for Users.
Select Users from the Entity dropdown, or click Add New Entity to create a new entity.
Map the plugin fields for users entity with Risk Exchange fields (map the email string field of the plugin with the Email string field of Users entity.
Note
- Data type of the field will be enclosed in “()”
- To pull records related to Devices, it is necessary to map at least one field for the Applications Entity Source.
Click Add to map multiple fields, (like to map the ubaScore Number field).
Click Add Field to add a new Number field in the Users entity.
Add a Field Label, select a Data Type, Normalization, enable or disable the Unique restriction for the new field being added, and then select an Aggregate Strategy. When finished, click Save.
Similarly, configure Entity sources for Applications (previously known as Application Risk Exchange) and Devices, and do Field mappings for the plugin and the Risk Exchange fields.
Click Save.

Configure a Business Rule for Risk Exchange

In Risk Exchange, go to Business Rules and click Create New Rule.
Enter a Rule name and select the entity for which you want to create this rule. Create a filter rule.
Click Save.
You can see what your users’ scores are by going to Records in the Risk Exchange left panel and selecting the Users entity.

Configure Actions for Risk Exchange

All of the actions are one of two types:

Source: This type represents the field of the Entity (like Users, Application, Devices Entity). This type can have dynamic values for each record of the entity.
Static: This type represents the static value for a particular action.

To configure actions:

In Risk Exchange, go to Actions and click Add Action Configuration.
From the Business Rule dropdown, select the Business Rule you created.
From the Target Plugin Configuration dropdown, select your Risk Exchange plugin.
From the Actions dropdown, select one of these actions:
- Add user to group: When triggered, users are added to that group.
- Remove user from group: When triggered, users are removed from that group.
- Update UCI score: When triggered, user score will be reduced per the Score (Reduction) field.
- UCI reset: When triggered, user score will be reset to 1000.
- Add host to Private App: When triggered, the host will be added to the configured Private App.
- Create or Update App Instance: When triggered, app instances will be created or updated per the configuration.
- Tag/Untag application: When triggered, the application will be tagged or untagged per the configuration.
- Add to Destination Profile: This will append the new records in the already created Destination Profile or in the new Destination Profile.
- Add to DNS Profile: This will append the new records in the already created DNS Profile or in the new DNS Profile.
- Add to Service Profile: This will append the new records in the already created Service Profile or in the new Service Profile.
- Create Device Classification: This will append the new Tags in the already created Device Classification rule or in the new Device Classification rule.
- No action: This does not perform any actions on users. Enable the Generate Alert toggle. Enabling the Generate Alert toggle ensures that new alerts are added in the Ticket Orchestrator module whenever this action is executed.
Note

Make sure to enable the Ticket Orchestrator module at Settings > General.
If you wish to perform an action during the Maintenance Window, enable the Perform action during Maintenance Window toggle. The Action will be performed during the Maintenance Window; otherwise, it will be performed instantly.
Disable the Require Approval toggle. Disabling this toggle will trigger the action automatically without any manual intervention. If the toggle is enabled, each action will require manual approval from the Cloud Exchange user.
Click Save.
To perform the actions, click Sync, add a Time Period, and click Fetch. The number of records for the action will be taken when you click Sync again.

Add a User to a Group

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Add user to group.
For the Action Parameters, enter these values:
- User Email: Email address of the user to add to group. It must exist in SCIM.
- Group: Select an existing group from the Static dropdown, or select Create new group.
- Group name: Provide a SCIM group name if Create new group is selected in the Group field.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Remove a User from a Group

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Remove user from group.
For the Action Parameters, enter these values:
- User Email: Email address of the user to remove from group. It must exist in SCIM.
- Group: Select an existing group from the Static dropdown.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.
Note
- The Add User to a Group and Remove User from a Group actions support user emails in any letter case.
- For example, if the Netskope Tenant has a SCIM user with the email abc.xyz@gmail.com, and a 3rd-party system has the same user listed as , both actions will treat them as the same user and consider the email to be abc.xyz@gmail.com during execution.

Update a UCI Score

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Update UCI Score.
For the Action Parameters, enter these values:
- User Email: Email of the user to trigger the score change.
- Source (Reduction): Score to be reduced from the UCI.
- Source: Name of the source reporting this.
- Reason: Reason for this score change.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Reset the UCI Score

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select UCI Reset.
For the Action Parameters, use User Email. Select a field for the User Email, or provide Static comma-separated User Emails to reset the UCI score. The User’s UCI score will be reset to 1000.
Note
- While providing the User Email in the Static field, make sure that the email you are providing matches the case with the user available on Netskope; otherwise, you will not be able to perform the UCI Reset action, and the plugin will give this error message:
  CRE Netskope Risk Exchange [configuration_name]: Some of the provided users’ UCI not found while performing the ‘UCI Reset’ action on the users.
- For example, if any user abc@gmail.com exists on Netskope, and the email that exists on Cloud Exchange is Abc@gmail.com, and you perform the action on that user email, it will give the above error message.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Add a Host to a Private App

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Add Host to Private App.
For the Action Parameters, enter these values:
- Host: Host address to append to the private app. Multiple comma-separated values are supported. Example: host-1, host-2.
- Tags: Tags to set for the private app. These tags will overwrite existing tags available on your tenant. Multiple comma-separated values are supported. Example: tag-1, tag-2.
- Private App Name: Select a private app from the Static field dropdown.
- Create New Private App: Create private app with given name. Provide a Private App Name in the Static field if you selected Create new private app for the Private App Name.
- Protocol: Select Protocol from the Static field dropdown. Valid values are TCP and UDP.
- TCP Ports: Comma-separated ports for the TCP protocol. Only enter this in the Static field if you selected TCP for the Protocol.
- UDP Ports: Comma-separated ports for the UDP protocol. Only enter this in the Static field if you selected UDP for the Protocol.
- Publisher: Select Publishers from the Static field dropdown.
- Use Publisher DNS: Select Yes or No from the Static field dropdown for Use Publishers DNS.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

In the Netskope Tenant, we have seen that only 20 private apps are allowed at a time on the tenant.

Create or Update an App Instance

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Create or Update App Instance.
For the Action Parameters, enter these values:
- Instance ID: For AWS, use the account ID. For Azure, use the Subscription. For GCP, use the Project. The app + instance_id combo must be new.
- Instance Name: Used to change instance name, and must be unique. Name should be unique within app + instance_id or app + instance_name.
- Application Name: Name of the application.
- Tag: Select Tag from the Static field dropdown.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Tag/Untag an Application

Click here to watch a video.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Tag/Untag application.
For the Action Parameters, enter these values:
- Tag Action: Whether to Add/Remove tag(s) from the application(s). Select a Tag Action from the Static field dropdown.
- Tags: Select field for the tags, or provide Static comma-separated tag values.
- Application Names: Select a field for the Application Names, or provide a Static comma-separated Application Names. 100 is the max allowed input size for Static values.
  Note
  - You have to only provide either Application Names or Application IDs. Providing both will give an error and the Action configuration will not be saved.
  - You will not be able to configure actions for tagging and untagging applications at same time with the same business rule. To use both of these action types, create separate actions: one for adding tags, and one for removing tags.
- Application IDs: Select field for the Application IDs or provide Static comma separated Application IDs. 100 is the max allowed input size for Static values.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Tag/Untag a Device

Click here to watch a video.

In Risk Exchange, go to Actions click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Tag/Untag application.
In the Action Parameters, enter these details:
- Tag Action: Select whether to add, remove, or replace tags on the devices. Select a Tag Action from the static dropdown only. Note: at max 5 tags are allowed per user-device pair on Netskope.
- Tags: Select a source field for the tags or provide static comma-separated tag values. Note that for the Replace action, if tags are not provided or empty, all tags will be removed from the device.
- Netskope Device UID: The Device UID of the device to which the tag action should be performed. Select a source field or provide a static value.
- User Key: The User Key of the user associated with the device on which the tag action should be performed. Select a source field or provide a static value.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Note

You will not be able to configure actions for add, remove and replace tags from devices at same time with the same business rule. To all the action types create separate business rules for adding, removing and replacing.

Add to a Destination Profile

Click here to watch a video.

In Risk Exchange, go to Actions click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Add to Destination Profile.
In the Action Parameters, enter these details:
- Operation: Select whether to append the values to the existing values or replace the current values with new values on the profile. Select from the Static field dropdown only.
- Destination Profile: Select an existing destination profile from the Static field dropdown or select Create new profile.
- Create New Profile: Name of the destination profile to create. Provide the name in the Static field only if ‘Create new profile’ is selected in Destination Profile. The profile name should not exceed 100 characters and it cannot contain ‘”‘ (Double Quotes) or ‘;’ (Semicolon).
- Profile Description: Description for the destination profile. It will add or replace the current description with provided. The description should not exceed {MAX_DESTINATION_PROFILE_DESC_LENGTH} characters.
- Match Type: Match type for the destination profile. Select from the Static field dropdown only. It will add or replace the current match type with the provided value.
- Apply Pending Changes: Select ‘Yes’ to deploy pending changes and retry when the destination profile has undeployed changes. Select from the Static field dropdown only.
- Network Targets: Select a Source field for the destination values or provide Static comma-separated values, IPs, or URLs to add to the profile.
- Tenant Exact-Match Value Limit: Maximum number of exact-match (Case Insensitive / Case Sensitive) values allowed tenant-wide, used as the capacity ceiling when adding values to a profile. Provide a positive integer in the Static field only. The default tenant limit is 300000. If you have increased limit enter that value here. Leave empty to use the default of 300000.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Add to a DNS Profile

Click here to watch a video.

In Risk Exchange, go to Actions click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Add to DNS Profile.
In the Action Parameters, enter these details:
- Operation: Select whether to append the values to the existing values or replace the current values with new values on the profile. Select from the Static field dropdown only.
- Action Type: Whether to add the domains to the allow list or the block list of the DNS profile. Select from the Static field dropdown only.
- DNS Profile: Select an existing DNS profile from the Static field dropdown, or select Create new DNS Profile.
- Create New DNS Profile: Name of the DNS profile to create. Provide the name in the Static field only if ‘Create new DNS Profile’ is selected in DNS Profile. The profile name should not exceed 255 characters and it cannot contain ‘(‘, ‘)’ or ‘”‘.
- Profile Description: Description for the DNS profile to be created. Used only when ‘Create new DNS Profile’ is selected in DNS Profile. The description should not exceed 255 characters.
- Categories: Select the security categories to apply on the DNS profile from the Static field dropdown only. The same category cannot be selected with both ‘Block’ and ‘Sinkhole’ actions. Selecting any ‘Sinkhole’ variant requires a value in the ‘Sinkhole IP’ parameter.
- Sinkhole IP: Sinkhole IP address for the DNS profile. Required only when a ‘(Sinkhole)’ category is selected in Categories. Provide in the Static field only.
- Record Types: Select the DNS record types from the Static field dropdown. The ‘All Record Types’ value cannot be selected together with any other Record Type value.
- Block all except Allow list: Select ‘Yes’ to block all domains except those on the allow list. Select from the Static field dropdown only.
- Domain Names: Select a Source field for the domain names or provide Static comma-separated domains or FQDNs to add to the DNS profile.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

The maximum limit of a DNS Profile per Action Type is 16 mb. That means, a destination’s allow list and blocklist can hold data up to 16 mb separately.

Add to a Service Profile

Click here to watch a video.

In Risk Exchange, go to Actions click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Add to Service Profile.
In the Action Parameters, enter these details:
1. Operation: Select whether to append the values to the existing values or replace the current values with new values on the profile. Select from the Static field dropdown only.
2. Service Profile: Select an existing custom service profile from the Static field dropdown or select ‘Create new service profile’. Only custom (editable) profiles are listed.
3. Service Profile Name: Name of the service profile to create. Provide the name in the Static field only if ‘Create new service profile’ is selected in Service Profile. The profile name should not exceed 255 characters.
4. Description: Description for the service profile to be created. Used only when ‘Create new service profile’ is selected in Service Profile. The description should not exceed 512 characters.
5. TCP Ports: Select a Source field for the TCP ports or provide Static comma-separated ports or port ranges (e.g. 9000-9500).
6. UDP Ports: Select a Source field for the UDP ports or provide Static comma-separated ports or port ranges (e.g. 9000-9500).
7. TCP/UDP Ports: Select a Source field for the TCP_UDP ports or provide Static comma-separated ports or port ranges (e.g. 9000-9500).
8. ICMP: Select ‘Yes’ to enable the ICMP protocol on the service profile. Select from the Static field dropdown only.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

Create a Device Classification

Click here to watch a video.

In Risk Exchange, go to Actions click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select Create Device Classification.
In the Action Parameters, enter these details:
1. Operation: Select whether to append the values to the existing values or replace the current values with new values on the rule. Select from the Static field dropdown only.
2. Device Classification: Select an existing device classification from the Static field dropdown to use as the rule’s classification, or select Create New Device Classification.
3. Device Classification Name: Name of the device classification to create. Provide the name in the Static field only if Create new Device Classification is selected in Device Classification. The name should not exceed 80 characters.
4. Device Classification Rule: Select an existing device classification rule to update from the Static field dropdown, or select Create New Device Classification Rule.
5. Device Classification Rule Name: Name of the device classification rule to create. Provide the name in the Static field only if Create new Device Classification Rule is selected in Device Classification Rule. The rule name should not exceed 80 characters.
6. Operating System: Target operating system for the device classification rule. Select from the Static field dropdown only.
7. Match Type: Select the Match Type (Logical Operator) to be applied on thetags in the Device Classification Rule. Select from the Static field dropdown only.
8. Group Match Type: Select how the top-level condition groups are combined in the Device Classification Rule. ‘All’ requires every group to match; Any requires at least one group to match. Takes effect when more than 5 tags are provided (creating multiple tag groups) or when the existing rule already contains multiple condition groups. Select from the Static field dropdown only.
9. Tags: Select a Source field for the device tags or provide Static comma-separated device tag names to use in the rule conditions. If more than 5 tags are provided, they are split into groups of 5 and each group becomes a separate condition block in the rule. For an Append, new tags are unioned with the existing ones and the result is re-grouped. Each tag must already exist on the Netskope Tenant.
Enable the Require Approval toggle if Approval is needed before performing an action on the users.
Click Save.

No Actions

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business Rule and your Risk Exchange plugin.
For Actions, select No actions. Make sure the Generate Alert toggle is enabled to generate alerts in the Ticket Orchestrator module.
Enable the Require Approval toggle if Approval is needed before performing an action on the Users.
Click Save.
Note
- For Cloud Exchange v5.1.0, there is no Bulk action support. For Cloud Exchange v5.1.1 Bulk action is supported for the following actions:
- For the API limits of each action, you can refer to the below documentations:

Mark Anomaly as Allowed

In Risk Exchange, go to Action Logs.
Select a log where you have performed the Update UCI Score action.
Click Revert from the upper right corner of the logs section.
Click Revert.

Note

For performing Mark Anomaly as Allowed action, you will need minimum Cloud Exchange v6.0.0 and Netskope Risk Exchange Plugin v1.5.0.
From Cloud Exchange v6.1.0 and Netskope Risk Exchange v1.7.0, improvements have been made to the revert action handling to ensure correct behavior across plugins.

If a revert action is triggered, the system now validates whether the plugin and the specific action support revert functionality. Based on this validation:

If the plugin does not support revert, the operation will be skipped or failed with appropriate logs.
If the plugin supports revert but the specific action does not, the revert will fail with clear logs.
If both plugin and action support revert, the revert operation will execute successfully.

The system ensures that revert actions are not re-executed as normal actions, preventing unintended behavior.
Additionally, validation is performed before initiating revert actions to avoid invalid operations. Logs provide clear visibility into success, failure, or skipped scenarios.
The Mark Anomaly as Allowed action is only supported to revert the UCI reduction done by performing the Update UCI Score action in Cloud Exchange.

All the above actions can be used as a source or destination in a Real-Time Protection policy. You can refer to the documentation for configuring a policy.

Validate the Risk Exchange Plugin

Validate that UBA Alerts are Present in your Tenant

To validate UBA Alerts are present in the Netskope tenant:

Log in to your Netskope tenant.
Go to Skope IT.
Go to Alerts > Add Filter > Inside Alert Type > Select Uba and click Apply.

Validate Application Events are Present in your Tenant

To validate Application Events are present in the Netskope tenant

Log in to your Netskope tenant.
Go to Skope IT.
Go to Application Events.

Validate Client Status Events (Devices) are Present in your Tenant

To validate Application Events are present in the Netskope tenant.

Log in to your Netskope tenant.
Go to Settings > Security Cloud Platform > Devices.

Validate in Cloud Exchange

Pulling of Users

To validate the pulling of UBA Alerts from the Netskope tenant:

Go to Logging in Cloud Exchange and search for the pulled logs.
To verify the Users pulled from Netskope, go to Risk Exchange > Records, and select the Entity that was used in the User section of the Risk Exchange plugin.

Pulling of Applications

To validate the pulling of UBA Alerts from the Netskope tenant:

In Cloud Exchange, go to Logging and search for the pulled logs by using the keywords pulled and application.
To verify the Applications pulled from the Netskope, go to Risk Exchange > Records page, and select the Entity that was used in the Application section of the Risk Exchange plugin.

Pulling of Devices

Go to the Logging in Cloud Exchange. Search for the pulled logs by using the keyword device.
To verify the Devices pulled from Netskope, go to Risk Exchange > Record and select the Entity that was configured in the Devices section of Risk Exchange plugin.

Validate Performed Actions

Validate Add a User to a Group

To validate the Add User to Group action, go to Logging and apply the filter shown here:

To validate in the Netskope tenant:

Select the group name that you selected while adding the Action configuration and click View Details.
Go to Settings > Security Cloud Platform > Groups.

Validate Remove a User from a Group

To validate the Remove User from Group action, go to Logging and apply the filter shown here:

To validate in the Netskope tenant:

Go to Settings > Security Cloud Platform > Groups.
Select the group name that you used while adding the Action configuration for the Remove from Group action, and click View Details.

Validate Update a UCI Score

To validate the Update UCI Score action, go to Logging and apply the filter shown here:

To validate in the Netskope tenant, go to Incidents > Behavior Analytics and select the user whose score has been updated.

Validate Reset the UCI Score

To validate the UCI Reset action, go to Logging and apply the filter shown here:

To validate in the Netskope tenant, go to Incidents > Behavior Analytics and select the user whose score has been updated.

Validate Add a Host to a Private App

To validate the Add Host to Private App action, go to Logging and apply the filter shown here:

To validate in the Netskope Tenant:

Go to Settings > Security Cloud Platform > App Definition.
Select the Private app name that you configured while adding an Action configuration to add a host to a private app and check for hosts.

If any records that were filtered earlier and added to the private app, no longer exist after filtering the records, it will perform the revert action and remove the hosts from the private app.

Validate Create or Update an App Instance

To validate the Create or Update App Instance action, go to Logging and apply the filter shown here:

To validate in the Netskope tenant, go to Policies > App Instance. The updated app instances are displayed on this page.

Validate Tag/Untag Application

To validate the Tag Application action, go to Logging and apply the filter shown here:

To validate in the Netskope Tenant:

Go to Skope IT > Applications and select the application for which a tag has been added.
Go to About section of Application check for the tags.

Follow the same process for Untagging an application. You can verify the action with the filter shown here:

To validate the application is untagged on Netskope Tenant, select the application that has been untagged.

Validate Tag/Untag Device

To validate the Tag Device action, go to Logging and apply the filter shown here:

To validate in the Netskope Tenant:

Go to Settings > Security Cloud Platform > Devices and select the device for which a tag has been added.

Follow the same process for replacing the tags for the device.You can verify the action with the filter shown here:

To validate the tags have been replaced for the device on Netskope Tenant, select the device for which tags have been replaced.

Follow the same process for Untagging a Device. You can verify the action with the filter shown here:

To validate the device is untagged on Netskope Tenant, select the device that has been untagged.

Validate Mark Anomaly as Allowed

To validate the Mark Anomaly as Allowed action, go to Logging and apply the filter shown below:

To validate on the Netskope tenant, go to Incidents > Behavior Analytics, and select the user on whom the action was performed.

Validate Add to Destination Profile

To validate the Add to Destination Profile action, go to Logging and apply the filter shown below:

To validate in the Netskope tenant, go to Policies > Profiles > Destination and select the destination profile you have created/updated.

Validate Add to DNS Profile

To validate the Add to DNS Profile action, go to Logging and apply the filter shown below:

To validate in the Netskope tenant, go to Policies > Profiles > DNS and select the profile you have created/updated.

Validate Add to Service Profile

To validate the Add to Service Profile action, go to Logging and apply the filter shown below:

To validate in the Netskope tenant, go to Policies > Profiles > Service and select the profile you have created/updated.

Validate Create Device Classification

To validate the Create Device Classification action, go to Logging and apply the filter shown below:

To validate in the Netskope tenant, go to Settings > Manage > Device Classification and select the Device Classification Rule you have created/updated.

The Device Classification with Windows Server OS will not contain any tags, and the action will be marked as success in Cloud Exchange.

Troubleshooting the Risk Exchange Plugin

Receiving an Error While Configuring the Risk Exchange Plugin

Getting the error: The Netskope tenant API V2 token does not have necessary permissions configured. Refer to the list of endpoints for which the token is missing permission. **

Cause: The provided V2 token does not have the minimum required permissions to configure the tenant in Cloud Exchange.

What to do:

Go to Logging and look for warning log similar to the following pattern:
TENANT Netskope Tenant (Required) [Netskope Tenant]: For Netskope Tenant, received 403 error for following endpoint(s)
Expand the log and get the list of endpoints for which permissions are missing.
Update the v2 token permissions, and add the permissions for the above endpoint list from the Netskope Dashboard.

Validation error occurred, Cannot create Client Status Iterator

Getting the error: “TENANT Netskope Tenant (Required) [crest-plugin-support]: Validation error occurred, Cannot create Client Status Iterator. One iterator already exists for the Client Status event for your tenant. Delete the existing iterator to continue.”

Cause: The Netskope tenant only supports creating one iterator at a time. So, if the iterator is already created due to some reason, then you will not be able to configure the Risk Exchange plugin.

What to do: Delete the existing iterator from your Netskope tenant, and then reconfigure the Risk Exchange plugin in Cloud Exchange.

Error while configuring or upgrading the Risk Exchange plugin

If you are encountering the error shown below while configuring or upgrading the Risk Exchange plugin, then it might be because your Netskope tenant has an already created iterator and as of now Netskope Tenant only supports creating one iterator at a time.

What to do: You need to manually delete the existing iterator on your Netskope Tenant then configure/upgrade the CRE Netskope Risk Exchange plugin. For more details on iterator deletion, refer to the documentation and reach out to your Netskope tenant support to delete an iterator.

Unable to pull records related devices

If you are unable to pull records-related devices, then it may be because you have not mapped any of the fields under the Application Entity for Cloud Exchange. To pull the devices, it is mandatory to map at least one of the fields from the Applications entity.

What to do: Currently in Cloud Exchange, to pull the devices, it is mandatory to map at least one of the fields from applications entities. So, map at least one of the fields under Application entity, then pull records-related devices.

Facing issue with the Tag/Untag Application action after upgrading plugin to latest version

If you have previously configured Risk Exchange v1.2.0 or older with the Tag application action configured in Cloud Exchange v5.1.1, and then upgrade the Risk Exchange plugin to latest version (v1.3.0), you may face these issues if you edit the action:

The name of the action in the Actions page should be changed to Tag/Untag application, but it is not changed.
New action parameter Tag action should be added with a default value Add; instead, by default the Static value is selected, and no default value is there.
The old action parameters should remain as it is, but all of them are changed.

What to do:

Edit the action and change the action parameters according to your requirements.

Note

After editing the action, it will still not change the name of the action on the Actions page.
Configure a new action with your required parameters.

Facing an issue while updating the plugin after upgrading to latest version

If you are facing error while updating the plugin after upgrading it to the latest version, it might be due to below mentioned reason:

If you are upgrading the plugin to v1.6.0, and getting the above error message, it might be due to the reason that you have not mapped one of the mandatory fields in the plugin. As from v1.6.0 plugin, we have changed these fields to mandatory.

If you are upgrading the plugin to v1.7.0 or above, and getting the above error message, it might be due to the reason that you have not mapped one of the mandatory fields in the plugin. As from v1.7.0 plugin, we have changed these fields to mandatory.

What to do: Edit the plugin and add the mandatory fields in the field mapping.

Facing issue while performing the Tag/Untag Device action

If you are not able to perform the Tag/Untag Device action in Netskope Risk Exchange v1.6.0, it might be due to your tenant not having the device tagging flag enabled, or you do not have the permission to perform device tagging.

What to do: Verify the required permissions for device tagging from prerequisites, and if the device tagging flag is not enabled, contact your Netskope Tenant support team.

Facing issue with the ‘Tag/Untag Device’ action after upgrading plugin to latest version

If you have previously configured Risk Exchange v1.6.0 or older with the Tag/untag Device action configured in Cloud Exchange, and then upgrade the Risk Exchange plugin to latest version (v1.7.0), you may face these issues if you edit the action:

A New action parameter Hostname should be added with a default value; instead, by default no value is there.

What to do:

Edit the action and change the action parameters according to your requirements.
Configure a new action with your required parameters.

Not able to see the Private app action configuration after upgrading to v1.8.0

After upgrading the plugin to v1.8.0, you might face the following issue in the UI:

You might not be able to see the action configuration.

What to do: Delete the existing action configuration and create a new action with desired configuration.

Facing error with the ‘Create Device Classification’ action

If you are facing an error while performing Create Device Classification action, it might be due to the Device Classification Rule already existing, and you have provided a different OS from the existing one.

What to do: Go to the Netskope tenant and verify the OS that already exists for Device Classification Rule.

Receiving Error while performing Destination/DNS/Service Profile or Device Classification action

If you receive a 403 error while performing Destination/DNS/Service Profile or Device Classification action, it will be due to insufficient permissions in the V2 token.

What to do:

Clone the Netskope Cloud Exchange role and add required permissions to the new role then generate token with this role:
Click Save and then Generate a token using this New Custom Role.

Devices are not being fetched from Netskope Risk Exchange plugin

This could be due to the following reason: when both Netskope Risk Exchange and Netskope Log Shipper are configured, and the Device entity is selected in CRE, a client_status iterator gets created for the tenant. If Client Status is not selected in the Event Types of the Netskope Log Shipper plugin, the existing iterator gets deleted during the CLS cleanup task (on plugin save). Since Client Status is not selected in the Event Types, the required iterator is not maintained. As a result, the task fails.

Steps to check the error:

Download the diagnostic file.
Unzip the diagnostic file and check for the below error message in the core.log file.

INFO/ForkPoolWorker-76194] Task common.pull[3c539ed9-0aa3-4ea9-b7f8-4d28c4e6b412] succeeded in 0.6612727344036102s: {'success': False, 'message': 'AttributeError("\\'NetskopePluginHelper\\' object has no attribute \\'tenant_name\\'")', 'trace': 'Traceback (most recent call last):
cloudexchange_core_1  |   File "/opt/netskope/common/utils/task_decorator.py", line 160, in wrapper
cloudexchange_core_1  |     ret = func(*args, **kwargs)
cloudexchange_core_1  |           ^^^^^^^^^^^^^^^^^^^^^
cloudexchange_core_1  |   File "/opt/netskope/common/celery/pull.py", line 132, in pull
cloudexchange_core_1  |     for data, data_sub_type, sub_type_config_mapping, is_expo_backoff in pulled_data:
cloudexchange_core_1  |   File "/opt/netskope/plugins/Default/netskope_provider/main.py", line 580, in pull
cloudexchange_core_1  |     client.sub_types = sub_type_config_mapping.keys()
cloudexchange_core_1  |     ^^^^^^^^^^^^^^^^
cloudexchange_core_1  |   File "/opt/netskope/plugins/Default/netskope_provider/utils/iterator_helper.py", line 523, in sub_types
cloudexchange_core_1  |     is_iterator_ready = self.netskope_api_plugin_helper.check_iterator_status(
cloudexchange_core_1  |                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
cloudexchange_core_1  |   File "/opt/netskope/plugins/Default/netskope_provider/utils/iterator_api_helper.py", line 728, in check_iterator_status
cloudexchange_core_1  |    ...'}

What to do:

Go to the Netskope CLS plugin configuration.
Select Client Status in the Event Types.
Save the plugin configuration.
This updates the iterator and allows event ingestion to the SIEM platform to resume successfully.

Limitations

When using the Tag/Untag application action, ensure that the tag name has 75 characters or less, because Netskope does not support tags with more than 75 characters. Although, in the Action Logs, you will see the action is passed, because in this case, the API is giving 200 response codes.
For Tag/Untag Device action, below are the limitations:
- The supported tag length for devices is 80 characters. And providing more than 80 characters in the tag will give errors.
- Only 5 tags per User-Device pair is allowed on Netskope Tenant. And if you have a device with more than one user, it will have a limit of tags accordingly.

Known Behaviors

In Netskope Cloud Exchange v5.1.1 and above, when performing bulk actions, the Action Logs page may display all batches as passed, even if some batches fail. To identify failed batches, you must check the plugin logs for detailed information.
To pull records related to devices, it is necessary to map at least one field for the Applications Entity.
You will not be able to configure/upgrade the plugin if your Netskope tenant has an already created iterator, as Netskope Tenant only supports creating one iterator at a time. You need to delete the iterator on their tenant, and then configure/upgrade the Risk Exchange plugin.
If you have provided multiple ports and ranges while configuring Add to Private App Sharing, it might convert the multiple ports in one range as per the API limitations, and it could be seen as shown:
The Plugin will stop working if someone deletes the iterator from the Netskope tenant associated with this plugin. You may encounter this error:
TENANT Netskope Tenant (Required) [crest-plugin-support]: Received exit code 404, Resource not found while Checking status of iterator with name netskope_ce_cs_iterator_585b563e-cf26-46eb-8ba2-6c1959f398eb.
There are some failure behaviors for different actions, that are listed below:
- For UCI Reset action, if any of the email is not available on Netskope Tenant, the action will be failed for all the users filtered in Business Rule.
- For Create or Update App Instance action, if any of the app in the batch is not a known app to Netskope Tenant, the action will be failed for that particular batch.
- For Tag/Untag Application action, if all the apps in the batch are not known to Netskope Tenant, only then the action will be failed for that batch.
- For Tag/Untag Device action, if an action fails for a tag, all action statuses in one batch will be marked as failed.
- Also an error is encountered while performing the tagging action if the device already has five tags attached to it, as it exceeds the supported tag limit.
The logs display the total number of events processed, while the actual number of devices records stored is lower.
We have observed that if more than 5 tags are added to a Device Classification, it will create a new group, but the tags were not visible in the UI.
If a Device Classification Rule belongs to a Device Classification, and while configuring the action in Cloud Exchange, we added another Device Classification, the rule will be moved to that Device Classification.

Actions	Batch Size
Add user to group	5000
Remove user from group	5000
Tag application	100
Create or Update App Instance	500