This document explains how to configure the Netskope Ticket Orchestrator v2.5.0 plugin with the Ticket Orchestrator module of the Netskope Cloud Exchange platform. This plugin is used to pull Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, and Content) and Events (Incident and Endpoint) from the Netskope Tenant. It also supports updating and resolving incidents on the Netskope Tenant.
Prerequisites
To complete this configuration, you need:
- A Netskope Tenant (or multiple, for example, production and development/test instances).
- A Cloud Exchange Tenant with the Netskope Tenant plugin and a 3rd-party plugin, like CTO Jira Plugin, already configured.
Note
| Ticket Orchestrator Feature | Cloud Exchange Version | Ticket Orchestrator Version | Tenant Plugin Version |
|---|---|---|---|
| Resolve Incident | 6.1.0 & above | 2.5.0 & above | 1.6.0 & above |
| Custom Mappings | 6.0.0 & above | 2.4.0 & above | 1.5.0 & above |
| Auto Field Learning | 5.1.1 & above | 2.3.0 & above | 1.3.0 & above |
| DLP Incident Forensics | 5.1.2 & above | 2.3.0 & above | 1.5.0 & above |
Ticket Orchestrator Plugin Support
Fetches Alerts (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, UBA, CTEP, Device, Content) and Events (Incident, Endpoint) from the Netskope tenant. Supports updating incidents back to the Netskope Tenant.
| Data Type | Description |
|---|---|
| Alert Types | Yes (DLP, Malware, Policy, Compromised Credential, Malsite, Quarantine, Remediation, Security Assessment, Watchlist, CTEP, UBA, Device, Content) |
| Event Types | Yes (Incident, Endpoint) |
Mappings
Default Status Mappings
| Cloud Exchange Fields | Netskope Tenant Fields |
|---|---|
| New | new |
| In Progress | in_progress |
| On Hold | – |
| Closed | closed |
| Deleted | closed |
| Other | – |
Default Severity Mappings
| Cloud Exchange Fields | Netskope Tenant Fields |
|---|---|
| Critical | Critical |
| High | High |
| Medium | Medium |
| Low | Low |
| Informational | Low |
| Other | Low |
Notes
- If the Assignee field contains a invalid email or string then the ticket on Netskope Tenant will not be assigned.
- Status field may be unselected in the Netskope Tenant UI. If the Status used in Netskope Cloud Exchange does not exist on the Netskope Tenant, or does not exactly match with the statuses present on the Netskope Tenant.
Permissions
- Need V2 token created using the Netskope Cloud Exchange role.
- For Device and Content alerts, you will require the following permissions:
- /api/v2/events/dataexport/alerts/device(Read)
- /api/v2/events/dataexport/alerts/content(Read)
- For pulling forensics data for incident events, you will require the below permission:
API Details
List of APIs Used
Alerts
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/events/dataexport/alerts/compromisedcredential | GET | Pull Compromised Credential Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/dlp | GET | Pull DLP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malware | GET | Pull Malware Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/remediation | GET | Pull Remediation Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/securityassessment | GET | Pull Security Assessment Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/ctep | GET | Pull CTEP Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/malsite | GET | Pull Malsite Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/policy | GET | Pull Policy Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/quarantine | GET | Pull Quarantine Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/uba | GET | Pull UBA Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/watchlist | GET | Pull Watchlist Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/device | GET | Pull Device Alerts from the Netskope tenant. |
| /api/v2/events/dataexport/alerts/content | GET | Pull Content Alerts from the Netskope tenant. |
Events
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/events/dataexport/events/incident | GET | Pull Incident Events from the Netskope tenant. |
| /api/v2/incidents/dlpincidents/{id}/forensics | GET | pull Incident Forensics per dlp_incident_id |
| /api/v2/events/dataexport/events/endpoint | GET | Pull Endpoint Events from the Netskope tenant. |
| /api/v2/incidents/update | PATCH | To update incidents back to Netskope. |
Compromised Credential Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/compromisedcredential
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "20575270a59c8ef1d85d535c",
"acked": "false",
"alert": "yes",
"alert_name": "Secret share",
"alert_type": "Compromised Credential",
"app": "Friend2Friend",
"category": "Cloud Storage",
"cci": 29,
"ccl": "poor",
"count": 1,
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"timestamp": 1727659690,
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0495t@test.netskope.com",
"user": "dte1953ce410-0495t@test.netskope.com",
"userkey": "dte1953ce410-0495t@test.netskope.com",
"division": "",
"external_email": 0,
"mail": "",
"sAMAccountName": "",
"password_type": "",
"userPrincipalName": "",
"breach_date": 0,
"sAMAccountType": "",
"breach_id": "",
"breach_score": "",
"department": "",
"employeeType": "",
"matched_username": "",
"breach_media_references": "",
"email_source": "",
"breach_description": "",
"breach_target_references": "",
"distinguishedName": ""
}
DLP Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/dlp
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "31365da11ecc94a0d7edfb6f",
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"alert": "yes",
"alert_name": "GDrive Customer metadata shared externally",
"alert_type": "DLP",
"app": "Google Drive",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "high",
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 1,
"dst_latitude": 37.40599060058594,
"dst_location": "Mountain View",
"dst_longitude": -122.0785140991211,
"dst_region": "California",
"dstip": "172.217.14.78",
"exposure": "organisation_wide_link",
"ext_labels": [
{
"data_classification_label": "pym/uducbb2126/encryption_level_11",
"id": "6e05576c-782b-42b4-b8f7-71dfb9ffb5a0",
"instance": "uducbb2126",
"name": "encryption_level_11",
"vendor": "pym"
},
{
"data_classification_label": "ydu/ldmwyo2852/encryption_level_11",
"id": "20c2b17d-7612-4349-b1e1-62d0d6b48ccb",
"instance": "ldmwyo2852",
"name": "encryption_level_11",
"vendor": "ydu"
},
{
"data_classification_label": "uwa/eqpoco8593/encryption_level_9",
"id": "6f77b892-3888-4148-8168-d954856d2fea",
"instance": "eqpoco8593",
"name": "encryption_level_9",
"vendor": "uwa"
}
],
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "edd7df8bb5a774a7531a389287a3bd71cf8e62197d93a205860003ed8339a4de",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "Tenant Migration across MPs",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "unknown",
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Google Drive",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1716551379,
"title": "Tenant Migration across MPs",
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "rowkuxqaxdxnlnlw",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "RoWkuxQAxDxNlNLw",
"userkey": "RoWkuxQAxDxNlNLw",
"record_type": "alert",
"page_site": "",
"act_user": "",
"src_longitude": 0.0,
"dst_timezone": "",
"device_classification": "",
"to_user": "",
"dlp_file": "",
"connection_id": 0,
"external_collaborator_count": 0,
"incident_id": 0,
"dlp_fingerprint_classification": "",
"activity": "",
"from_storage": "",
"user_confidence_index": 0,
"browser_version": "",
"dynamic_classification": "",
"smtp_to": [],
"dlp_rule_severity": "",
"shared_with": "",
"outer_doc_type": 0,
"orignal_file_path": "",
"channel": "",
"data_type": "",
"userip": "",
"sanctioned_instance": "",
"src_region": "",
"true_filetype": "",
"dlp_rule_count": 0,
"shared_domains": "",
"owner_pdl": "",
"dlp_unique_count": 0,
"transaction_id": 0,
"browser_session_id": 0,
"userCountry": "",
"bcc": "",
"displayName": "",
"srcip": "",
"dlp_mail_parent_id": "",
"hostname": "",
"classification_name": "",
"protocol": "",
"sAMAccountName": "",
"violating_user": "",
"manager": "",
"src_time": "",
"src_country": "",
"true_obj_category": "",
"message_size": 0,
"dlp_fingerprint_score": 0,
"src_geoip_src": 0,
"os_version": "",
"true_type_id": 0,
"to_storage": "",
"tss_mode": "",
"managed_app": "",
"file_password_protected": "",
"dlp_incident_id": 0,
"managementID": "",
"dlp_fingerprint_match": "",
"src_timezone": "",
"mail": "",
"total_collaborator_count": 0,
"from_user": "",
"app_activity": "",
"user_id": "",
"custom_attr": {},
"group": "",
"file_cls_encrypted": false,
"universal_connector": "",
"message_id": "",
"file_category": "",
"dlp_parent_id": 0,
"sub_type": "",
"src_latitude": 0.0,
"userPrincipalName": "",
"dlp_is_unique_count": "",
"dlp_rule_score": 0,
"src_zipcode": "",
"dlp_rule": "",
"referer": "",
"app_session_id": 0,
"parent_id": "",
"retro_scan_name": "",
"src_location": "",
"dst_zipcode": "",
"dlp_profile": "",
"true_obj_type": "",
"violating_user_type": "",
"policy_id": "",
"web_universal_connector": "",
"appsuite": "",
"severity": "",
"sha256": "",
"collaborated": "",
"page": ""
}
Malware Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malware
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"TSS-scan": "TSS-Scan-V3",
"_id": "389551cd1bdaa1ae4947c334",
"access_method": "Client",
"acked": "false",
"action": "Detection",
"activity": "Browse",
"alert": "yes",
"alert_name": "GT:JS.Adware.Popunder.4.34B7F109",
"alert_type": "Malware",
"app": "hitomi",
"app_name": "hitomi",
"app_session_id": 4113602168491103340,
"appcategory": "Adult Content - Pornography",
"browser_session_id": 2610528494199657827,
"category": "Adult Content - Pornography",
"cci": "",
"ccl": "",
"connection_id": 5767115909713174088,
"count": 1,
"detection_engine": "Netskope AV",
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "UA",
"dst_latitude": 50.45465850830078,
"dst_location": "Kyiv",
"dst_longitude": 30.523799896240234,
"dst_region": "Kyiv",
"dst_timezone": "Europe/Kyiv",
"dst_zipcode": "N/A",
"dstip": "185.255.122.62",
"file_category": "Text",
"file_id": "1dda26cbf77944ccb931f3444b554c74",
"file_size": 2277,
"file_type": "text/html",
"hostname": "ub20-50-5-28",
"incident_id": 7718454634228557343,
"instance": "",
"local_md5": "cda70ab0130f915723a53a5d9270e7a5",
"malware_id": "3d81bec28fff68180bf8baa5727924ba",
"malware_name": "GT:JS.Adware.Popunder.4.34B7F109",
"malware_profile": "1",
"malware_severity": "high",
"malware_type": "Virus",
"managed_app": "no",
"md5": "cda70ab0130f915723a53a5d9270e7a5",
"ml_detection": "None",
"object_type": "File",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 20.04",
"page": "hitomi.la/",
"page_site": "Web Background",
"policy": "Threat-Malware-Policy-Crest-SRE-Test",
"policy_id": "342F7551F4D4469E47D7736209486319 2024-07-01 16:28:12.174470",
"protocol": "HTTPS/1.1",
"request_id": 2907585389470724608,
"scanner_result": "malicious",
"severity": "High",
"severity_id": 3,
"sha256": "d330ea88b7a0c2f9190717d8f39a2e3942474c3fefe8b68112e7b93fde0fa9d4",
"site": "hitomi",
"src_country": "IN",
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_time": "Wed Aug 14 13:48:00 2024",
"src_timezone": "Asia/Kolkata",
"src_zipcode": "382350",
"srcip": "110.226.17.67",
"timestamp": 1723623535,
"traffic_type": "Web",
"transaction_id": 7718454634228557343,
"true_filetype": "HTML",
"tss_mode": "inline",
"type": "nspolicy",
"ur_normalized": "nipun.brahmbhatt@crestdata.ai",
"url": "hitomi.la/",
"user": "nipun.brahmbhatt@crestdata.ai",
"user_id": "nipun.brahmbhatt@crestdata.ai",
"userip": "10.50.5.28",
"record_type": "alert",
"department": "",
"scan_time": 0,
"tss_scan_failed": "",
"usr_udf_supervisorname": "",
"instance_id": "",
"nsdeviceuid": "",
"modified_date": 0,
"dst_geoip_src": 0,
"local_sha256": "",
"sha1": "",
"usr_udf_primarydomain": "",
"fastscan_results": "",
"sanctioned_instance": "",
"company": "",
"user_confidence_index": 0,
"src_geoip_src": 0,
"usr_udf_businesssegmentlevel1": "",
"referer": "",
"parent_id": "",
"created_date": 0,
"usr_udf_businesssegmentlevel2": "",
"filename": "",
"from_user": "",
"file_path": "",
"manager": "",
"browser": "",
"detection_type": "",
"title": "",
"object_id": "",
"mime_type": "",
"usr_display_name": "",
"usr_udf_businesssegmentlevel4": "",
"userPrincipalName": "",
"appsuite": "",
"scan_type": "",
"tss_license": "",
"managementID": "",
"usr_status": "",
"object": "",
"custom_attr": {},
"userCountry": "",
"usr_title": "",
"usr_udf_businesssegmentlevel3": "",
"file_name": "",
"shared_type": "",
"usr_udf_companyname": "",
"shared_with": "",
"tss_fail_reason": "",
"usr_udf_supervisorid": "",
"browser_version": "",
"usr_udf_employeeid": ""
}
Remediation Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/remediation
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "448ca50ee6142a954d64c577",
"access_method": "API Connector",
"acked": "true",
"action": "alert",
"activity": "Download",
"alert": "yes",
"alert_name": "Remediation alert",
"alert_type": "Remediation",
"app": "Clanwilliam Health",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 9,
"ccl": "poor",
"count": 1,
"device": "Other",
"dst_country": "NL",
"dst_geoip_src": 2,
"dst_latitude": 52.3759,
"dst_location": "Amsterdam",
"dst_longitude": 4.8975,
"dst_region": "North Holland",
"dst_zipcode": "1012",
"dstip": "31.186.239.8",
"file_size": 118585,
"file_type": "application/vnd.google-apps.document",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"object": "VTRapjqhGbaDXqHR",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 7.0",
"policy": "policy_ga34",
"request_id": "2459149802892628500",
"site": "Clanwilliam Health",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.8",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0268t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0268t@test.netskope.com",
"managementID": "",
"from_user": "",
"os_version": "",
"app_session_id": 0,
"malware_severity": "",
"actions_taken": "",
"transaction_id": 0,
"notify_template": "",
"page": "",
"browser_session_id": 0,
"src_time": "",
"tss_mode": "",
"managed_app": "",
"severity": "",
"nsdeviceuid": "",
"remediation_profile": "",
"dlp_profile": "",
"malware_name": "",
"endpoints": "",
"connection_id": 0,
"policy_id": "",
"endpoint_count": 0,
"dst_timezone": "",
"profile_hits": [],
"malware_id": "",
"hostname": "",
"edr_app": "",
"device_classification": "",
"userip": "",
"appsuite": "",
"protocol": "",
"incident_id": 0,
"src_timezone": "",
"sanctioned_instance": "",
"page_site": "",
"malware_type": "",
"all_policy_matches": []
}
Security Assessment Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/securityassessment
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "15bbca35f014e9618efdc629",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "alert",
"activity": "Introspection Scan",
"alert": "yes",
"alert_name": "security-accessment-alert",
"alert_type": "Security Assessment",
"app": "LinkedIn",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"ccl": "medium",
"count": 1,
"device": "Other",
"dst_country": "FR",
"dst_geoip_src": 1,
"dst_latitude": 48.883411,
"dst_location": "Puteaux",
"dst_longitude": 2.23894,
"dst_region": "Ile-de-France",
"dstip": "193.248.155.211",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "OlWmGNTVpEVLCgWo",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"request_id": "2459149802892628500",
"sa_profile_id": 1,
"sa_profile_name": "CRzpqYgDBoKRThmb",
"sa_rule_id": "icveiWoIMGqmEfUy",
"sa_rule_name": "RLYnpTzcFeiRcQYr",
"sa_rule_severity": "High",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "LinkedIn",
"src_country": "FR",
"src_geoip_src": 1,
"src_latitude": 48.883411,
"src_location": "Puteaux",
"src_longitude": 2.23894,
"src_region": "Ile-de-France",
"srcip": "193.248.155.211",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
CTEP Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/ctep
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_correlation_id": "d54406dc-5457-4699-8754-c8eece88a804",
"_event_id": "8de38a44-4ae5-44ac-a097-f9e3ce2aac2a",
"_forwarded_by": "na",
"_generator_id": "ad4c77a8-ac83-4493-936c-8d6394038556",
"_id": "d62273697847e13a884e7562",
"_insertion_epoch_timestamp": 1727659690,
"_raw_event_inserted_at": 1676185709059,
"_seq_id": 117219,
"_service_identifier": "na",
"_skip_geoip_lookup": "yes",
"access_method": "API Connector",
"acked": "false",
"action": "block",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "c2",
"alert_type": "c2",
"app": "X3host",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 16,
"ccl": "poor",
"count": 1,
"device": "11-inch iPad Pro",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 45.8234,
"dst_location": "Boardman",
"dst_longitude": -119.7257,
"dst_region": "Oregon",
"dst_zipcode": "97818",
"dstip": "52.218.153.131",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 118783,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"legal_hold_profile_name": "oejTJocnOabNirPx",
"lh_custodian_email": "ELGkdoczLAkrQMuq",
"lh_custodian_name": "iRwQlRYvjwsFlVpg",
"lh_dest_app": "dOkImPvoHqwfXFaU",
"lh_dest_instance": "LKMHXgSCmGTmVbZL",
"lh_fileid": "taAjyAQRSWraghfP",
"lh_filename": "rsjjtAjqpCcYjaOU",
"lh_filepath": "IhYDbjTXhzqtUZeD",
"lh_original_filename": "vWijvCFegHYDULbn",
"lh_shared": "WCLXYCUEBjqOlWHt",
"lh_shared_with": "SwUYQdzFHslSQoxr",
"lh_version": 1,
"local_sha256": "fd856057ed7703e9b53458c7dbb6a3dc4ce9b957f3b307d81f06bf09c9bd8de3",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "OLizsiNCpTCziLEC",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "iOS 9.6",
"other_categories": [],
"owner": "dte1953ce410-0778t@test.netskope.com",
"policy": "policy_ga13",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "X3host technologies",
"src_country": "NL",
"src_geoip_src": 2,
"src_latitude": 52.3759,
"src_location": "Amsterdam",
"src_longitude": 4.8975,
"src_region": "North Holland",
"src_zipcode": "1012",
"srcip": "31.186.239.204",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0494t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0494t@test.netskope.com",
"userkey": "dte1953ce410-0494t@test.netskope.com"
}
Malsite Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/malsite
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "01f6ca78bec577883076a738",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "bget.ru",
"alert_type": "malsite",
"app": "",
"app_session_id": 4910069257574835437,
"appcategory": "Security Risk - Compromised/malicious sites",
"browser_session_id": 1141245448937753175,
"category": "Security Risk - Compromised/malicious sites",
"cci": 0,
"ccl": "unknown",
"connection_id": 0,
"count": 1,
"device": "Linux Device",
"device_classification": "not configured",
"dst_country": "RU",
"dst_latitude": 59.9417,
"dst_location": "St Petersburg",
"dst_longitude": 30.3096,
"dst_region": "St.-Petersburg",
"dst_timezone": "Europe/Moscow",
"dst_zipcode": "195213",
"dstip": "5.101.158.143",
"dstport": 443,
"hostname": "ip-172-31-37-148",
"incident_id": 7989528656047608655,
"ja3": "07ff1e545ef8ab3fcf8a4dc9272221c2",
"ja3s": "NotAvailable",
"malicious": "yes",
"malsite_category": [
"Malicious Site"
],
"malsite_country": "RU",
"malsite_id": "ae7c3ade12353ae7165e9b2f",
"malsite_ip_host": "5.101.158.143",
"malsite_latitude": 59.9417,
"malsite_longitude": 30.3096,
"malsite_region": "St.-Petersburg",
"managed_app": "no",
"notify_template": "block_page.html",
"organization_unit": "",
"os": "Linux",
"os_version": "Linux 22.04",
"other_categories": [
"Security Risk",
"Security Risk - Compromised/malicious sites"
],
"page": "bget.ru/",
"page_site": "bget",
"policy": "TestMalsite2",
"policy_id": "F1AE7109B6FC54098C582D3B0F149521 2024-05-28 13:48:56.784091",
"protocol": "HTTPS/1.1",
"request_id": 2851228580036571136,
"severity_level": "med",
"severity_level_id": 1,
"site": "bget",
"src_country": "US",
"src_latitude": 39.0469,
"src_location": "Ashburn",
"src_longitude": -77.4903,
"src_region": "Virginia",
"src_time": "Tue May 28 10:07:00 2024",
"src_timezone": "America/New_York",
"src_zipcode": "20149",
"srcip": "18.209.94.135",
"telemetry_app": "",
"threat_match_field": "domain",
"threat_match_value": "bget.ru",
"threat_source_id": 1,
"timestamp": 1716905279,
"traffic_type": "Web",
"transaction_id": 7989528656047608655,
"type": "malsite",
"ur_normalized": "keshavhazard@gmail.com",
"url": "bget.ru/",
"user": "keshavhazard@gmail.com",
"useragent": "python-requests/2.25.1",
"userip": "172.31.37.148",
"record_type": "alert",
"malsite_reputation": "",
"object": "",
"org": "",
"fromlogs": "",
"log_file_name": "",
"req_cnt": 0,
"browser_version": "",
"numbytes": 0,
"department": "",
"division": "",
"retro_scan_name": "",
"sfwder": "",
"browser": "",
"custom_attr": {},
"malsite_confidence": 0,
"server_bytes": 0,
"client_bytes": 0,
"malsite_first_seen": 0,
"co": "",
"sAMAccountName": "",
"src_geoip_src": 0,
"gateway": "",
"referer": "",
"suppression_start_time": 0,
"resp_cnt": 0,
"conn_duration": 0,
"serial": "",
"malsite_hostility": "",
"dsthost": "",
"dst_geoip_src": 0,
"universal_connector": "",
"malsite_active": "",
"from_user": "",
"object_type": "",
"suppression_end_time": 0,
"malsite_last_seen": 0,
"severity": "",
"aggregated_user": "",
"malsite_consecutive": "",
"appsuite": ""
}
Policy Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/policy
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3ceffe626afca6f5d46befb6",
"access_method": "Client",
"acked": "false",
"action": "block",
"alert": "yes",
"alert_name": "testprivateapp with2nd opt",
"alert_type": "policy",
"app": "[ExtraHop-Demo]",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"client_bytes": 0,
"client_packets": 0,
"count": 1,
"device": "Windows",
"dsthost": "netskope.atlassian.net",
"dstip": "",
"dstport": 443,
"end_time": "2025-02-28T08:22:47+00:00",
"hostname": "WIN11-50-12-151",
"ip_protocol": "TCP",
"network_session_id": "9452921695540616650",
"num_sessions": 1,
"numbytes": 0,
"organization_unit": "",
"os": "Windows",
"os_version": "11.0.22621",
"other_categories": [],
"policy": "testprivateapp with2nd opt",
"protocol": "Http",
"protocol_port": "TCP:443",
"publisher_cn": "",
"publisher_name": "",
"server_bytes": 0,
"server_packets": 0,
"session_duration": 0,
"site": "netskope.atlassian.net",
"srcip": "",
"srcport": 30700,
"start_time": "2025-02-28T08:22:32+00:00",
"timestamp": 1740731072,
"total_packets": 0,
"traffic_type": "PrivateApp",
"tunnel_id": "53125",
"tunnel_type": "NPA",
"tunnel_up_time": 0,
"type": "network",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userip": "",
"record_type": "alert",
"suppression_key": "",
"app_activity": "",
"file_type": "",
"url": "",
"policy_id": "",
"custom_connector": "",
"quarantine_profile": "",
"q_original_shared": "",
"file_path": "",
"profile_emails": [],
"referer": "",
"md5": "",
"redirect_url": "",
"page_site": "",
"malware_name": "",
"suppression_end_time": 0,
"user_id": "",
"distinguishedName": "",
"severity": "",
"src_timezone": "",
"tss_mode": "",
"managed_app": "",
"tss_fail_reason": "",
"src_geoip_src": 0,
"owner": "",
"aggregated_user": "",
"group": "",
"total_collaborator_count": 0,
"userCountry": "",
"browser": "",
"to_user": "",
"from_object": "",
"ext_labels": [],
"shared_with": "",
"useragent": "",
"sessionid": "",
"network": "",
"malicious": "",
"quarantine_file_id": "",
"appsuite": "",
"remediation_profile": "",
"universal_connector": "",
"mime_type": "",
"browser_version": "",
"src_zipcode": "",
"access_key_id": "",
"src_latitude": 0.0,
"malware_type": "",
"dynamic_classification": "",
"src_region": "",
"q_original_version": "",
"instance_id": "",
"message_id": "",
"sfwder": "",
"q_admin": "",
"q_app": "",
"object_type": "",
"log_file_name": "",
"malware_severity": "",
"retro_scan_name": "",
"displayName": "",
"justification_reason": "",
"q_instance": "",
"src_location": "",
"gateway": "",
"forward_to_proxy_xau": "",
"justification_type": "",
"smtp_to": [],
"app_session_id": 0,
"request_id": 0,
"app_scopes": "",
"parent_id": "",
"file_category": "",
"file_id": "",
"dlp_profile": "",
"nsdeviceuid": "",
"risk_level": "",
"encrypt_failure": "",
"quarantine_file_name": "",
"src_longitude": 0.0,
"file_size": 0,
"org": "",
"user_tmp": "",
"activity_status": "",
"threat_match_value": "",
"malsite_category": [],
"dst_timezone": "",
"all_policy_matches": [],
"incident_id": 0,
"orignal_file_path": "",
"object_id": "",
"act_user": "",
"http_status": "",
"dst_country": "",
"from_user": "",
"req_cnt": 0,
"transaction_id": 0,
"browser_session_id": 0,
"sanctioned_instance": "",
"from_storage": "",
"tss-mode": "",
"cc": "",
"activity": "",
"sAMAccountName": "",
"scan_type": "",
"serial": "",
"src_time": "",
"managementID": "",
"object": "",
"q_original_filepath": "",
"custom_attr": {},
"shared_domains": "",
"q_original_filename": "",
"notify_template": "",
"connection_id": 0,
"telemetry_app": "",
"threat_source_id": 0,
"user_confidence_index": 0,
"TSS-scan": "",
"internal_collaborator_count": 0,
"last_name": "",
"mail": "",
"sAMAccountType": "",
"memberOf": "",
"smtp_status": "",
"Title": "",
"dst_location": "",
"bcc": "",
"dst_geoip_src": 0,
"exposure": "",
"activity_type": "",
"dlp_fail_reason": "",
"dst_zipcode": "",
"message_size": 0,
"suppression_start_time": 0,
"trust_computer_checked": "",
"device_classification": "",
"instance": "",
"to_storage": "",
"dst_latitude": 0.0,
"division": "",
"object_count": 0,
"to_object": "",
"modified": 0,
"sender": "",
"dst_region": "",
"page": "",
"conn_duration": 0,
"two_factor_auth": "",
"dst_longitude": 0.0,
"data_type": "",
"quarantine_profile_id": "",
"malware_id": "",
"manager": "",
"src_country": "",
"event_type": "",
"external_collaborator_count": 0,
"resp_cnt": 0,
"threat_match_field": "",
"tss_scan_failed": "",
"dlp_scan_failed": "",
"sha256": ""
}
Quarantine Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/quarantine
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "63d6a681f0d64a6f41cc084c",
"_insertion_epoch_timestamp": 1727659690,
"access_method": "API Connector",
"acked": "false",
"action": "quarantine-sahil",
"activity": "Login Successful",
"alert": "yes",
"alert_name": "quarantine-alert",
"alert_type": "quarantine",
"app": "Dropbox",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 81,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "US",
"dst_geoip_src": 2,
"dst_latitude": 33.1432,
"dst_location": "San Marcos",
"dst_longitude": -117.1666,
"dst_region": "California",
"dst_zipcode": "92069",
"dstip": "98.176.143.16",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "\\/My Drive\\/Clickhouse\\/Tenant Migration across MPs",
"file_size": 196869,
"file_type": "application\\/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application\\/vnd.google-apps.document",
"modified": 1613760236,
"object": "weclTNVzKoULFCYX",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local\\/Netskope\\/Active Users\\/US & International\\/Full Time",
"os": "unknown",
"other_categories": [],
"owner": "foobar",
"policy": "GDrive Customer metadata shared externally",
"q_admin": "KgBNclCNvMfSfwAe",
"q_app": "Box",
"q_instance": "IXlwfxAfRQMyUbso",
"q_original_filename": "huSgEkeGhFjPDLhS",
"q_original_filepath": "oJmMLhuvhIyXlarC",
"q_original_shared": "private",
"q_original_version": "1",
"q_shared_with": "PqtCjqtPLVOOFkWk",
"quarantine_action_reason": "TuJbfomareEgmNNT",
"quarantine_app": "Amazon S3",
"quarantine_failure": "mDsCCrKldEQdhrEF",
"quarantine_file_id": "jeCCFYBKuaBggvol",
"quarantine_file_name": "GEXNzZEGpZFQAuUv",
"quarantine_profile": "fQECcfyXhgGUOJSO",
"quarantine_profile_id": "xfFlQTBQWxjnIsXZ",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"shared_with": "none",
"site": "Dropbox",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "crest_sup_de_202112031049-0@crest.netskope.com",
"url": "https:\\/\\/drive.google.com\\/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "crest_sup_de_202112031049-0@crest.netskope.com",
"usergroup": [],
"userkey": "crest_sup_de_202112031049-0@crest.netskope.com"
}
UBA Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/uba
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "b7dce8f570123bdd868a8315",
"access_method": "UCI Impact API",
"acked": "false",
"action": "anomaly_detection",
"activity": "ActivityForUciImpactAPI",
"alert": "yes",
"alert_id": "505464b05529c82e34d31970",
"alert_name": "External alert from Netskope due to Risky User",
"alert_type": "uba",
"anomaly_type": "Fact",
"app": "",
"appcategory": "n/a",
"category": "n/a",
"cci": 0,
"ccl": "unknown",
"count": 1,
"createdTime": "2025-02-24 08:15:55.461000",
"device": "Other",
"event_type": "uba_analytics",
"instance_id": "",
"organization_unit": "",
"policy": "External alert received via REST API",
"score": 1,
"severity": "informational",
"src_country": "IN",
"src_geoip_src": 2,
"src_latitude": 23.0276,
"src_location": "Ahmedabad",
"src_longitude": 72.5871,
"src_region": "Gujarat",
"src_zipcode": "380009",
"srcip": "122.170.162.148",
"timestamp": 1740384954,
"type": "nspolicy",
"ur_normalized": "tanushree.kurup@crestdata.ai",
"user": "tanushree.kurup@crestdata.ai",
"userkey": "tanushree.kurup@crestdata.ai",
"windowId": 1740355200000,
"record_type": "alert",
"last_device": "",
"surhn": "",
"policy_id": "",
"uba_ap1": "",
"evt_src_chnl": "",
"all_policy_matches": [],
"threshold": 0,
"web_universal_connector": "",
"user_category": "",
"managementID": "",
"division": "",
"download_app": "",
"user_id": "",
"dst_longitude": 0.0,
"audit_type": "",
"object_count": 0,
"policy_name": "",
"activity_status": "",
"group": "",
"act_user": "",
"referer": "",
"connection_id": 0,
"app_category": "",
"bin_timestamp": 0,
"hostname": "",
"app_activity": "",
"md5": "",
"risk_level_id": 0,
"suppression_end_time": 0,
"protocol": "",
"request_type": "",
"request_id": 0,
"app_session_id": 0,
"User_SPACE_Id": "",
"user_name": "",
"last_timestamp": 0,
"netskope_activity": "",
"dst_geoip_src": 0,
"tss_scan_failed": "",
"loginurl": "",
"threshold_time": 0,
"risk_level": "",
"managed_app": "",
"browser_version": "",
"file_category": "",
"from_user_category": "",
"page": "",
"last_location": "",
"url": "",
"uba_ap2": "",
"sanctioned_instance": "",
"object_id": "",
"dst_timezone": "",
"custom_attr": {},
"to_object": "",
"dst_country": "",
"traffic_type": "",
"telemetry_app": "",
"page_site": "",
"file_size": 0,
"scopes": [],
"anomalyData": {},
"os": "",
"audit_category": "",
"tss_fail_reason": "",
"userip": "",
"last_app": "",
"incident_id": 0,
"suppression_start_time": 0,
"dst_zipcode": "",
"dstip": "",
"policy_actions": [],
"browser": "",
"src_time": "",
"sAMAccountName": "",
"two_factor_auth": "",
"uba_inst2": "",
"site": "",
"displayName": "",
"sha256": "",
"object": "",
"last_country": "",
"to_user": "",
"object_type": "",
"manager": "",
"last_region": "",
"dst_region": "",
"dst_latitude": 0.0,
"shared_credential_user": "",
"file_type": "",
"tss_mode": "",
"appsuite": "",
"device_classification": "",
"logintype": "",
"AccountType": "",
"os_version": "",
"parent_id": "",
"TSS-scan": "",
"user_role": "",
"dst_location": "",
"to_user_category": "",
"user_confidence_index": 0,
"mail": "",
"browser_session_id": 0,
"src_timezone": "",
"useragent": "",
"employeeType": "",
"from_user": "",
"uba_inst1": "",
"User_SPACE_Name": "",
"userPrincipalName": "",
"transaction_id": 0,
"distinguishedName": "",
"profile_id": ""
}
Watchlist Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/watchlist
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "ad921f96aaf7dc5b6fe5d628",
"access_method": "API Connector",
"acked": "true",
"activity": "Upload",
"alert": "yes",
"alert_name": "watchlist fired",
"alert_type": "watchlist",
"app": "Amazon App Suite",
"appcategory": "Cloud Storage",
"browser": "unknown",
"category": "Cloud Storage",
"cci": 89,
"ccl": "high",
"count": 1,
"device": "Other",
"dst_country": "IN",
"dst_geoip_src": 2,
"dst_latitude": 19.0748,
"dst_location": "Mumbai",
"dst_longitude": 72.8856,
"dst_region": "Maharashtra",
"dst_zipcode": "400072",
"dstip": "182.75.130.70",
"exposure": "organisation_wide_link",
"file_lang": "ENGLISH",
"file_path": "/My Drive/Clickhouse/Tenant Migration across MPs",
"file_size": 119268,
"file_type": "application/vnd.google-apps.document",
"instance": "netskope.com",
"instance_id": "netskope.com",
"local_sha256": "aa477dd147d603cd0bd65b6dfb09021654e212aa3200ceb03e3a1e1d0fb37fdb",
"md5": "4bf7680195ecaed55e3edabb5d95ca01",
"mime_type": "application/vnd.google-apps.document",
"modified": 1613760236,
"object": "uVwtiXcnOjCdpJHt",
"object_id": "14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"object_type": "File",
"organization_unit": "netskope.local/Netskope/Active Users/US & International/Full Time",
"os": "Windows 8.0",
"owner": "dte1953ce410-0545t@test.netskope.com",
"policy": "policy_ga26",
"request_id": "2459149802892628500",
"scan_type": "Ongoing",
"site": "Amazon App Suite",
"src_country": "DE",
"src_geoip_src": 2,
"src_latitude": 50.1188,
"src_location": "Frankfurt am Main",
"src_longitude": 8.6843,
"src_region": "Hesse",
"src_zipcode": "60313",
"srcip": "8.39.144.84",
"suppression_key": "Tenant Migration across MPs",
"timestamp": 1727659690,
"traffic_type": "CloudApp",
"type": "nspolicy",
"ur_normalized": "dte1953ce410-0191t@test.netskope.com",
"url": "https://drive.google.com/open?id=14WLYNjJxKgEyqIoNAcb57aPGx9_klcxTo3MyjF82rGg",
"user": "dte1953ce410-0191t@test.netskope.com",
"userkey": "dte1953ce410-0191t@test.netskope.com",
"dst_timezone": "",
"two_factor_auth": "",
"dlp_fail_reason": "",
"title": "",
"conn_duration": 0,
"shared_domains": "",
"user_id": "",
"notify_template": "",
"severity_id": 0,
"TSS-scan": "",
"universal_connector": "",
"to_user_category": "",
"web_url": "",
"severity": "",
"netskope_activity": "",
"malware_severity": "",
"dlp_is_unique_count": "",
"sAMAccountName": "",
"hostname": "",
"sanctioned_instance": "",
"object_count": 0,
"dlp_rule": "",
"protocol": "",
"file_id": "",
"audit_type": "",
"internal_collaborator_count": 0,
"dlp_scan_failed": "",
"appsuite": "",
"dlp_rule_severity": "",
"telemetry_app": "",
"to_user": "",
"true_obj_category": "",
"useragent": "",
"shared_with": "",
"justification_reason": "",
"dlp_parent_id": 0,
"referer": "",
"src_timezone": "",
"connection_id": 0,
"app_session_id": 0,
"from_user_category": "",
"client_bytes": 0,
"malware_name": "",
"total_collaborator_count": 0,
"policy_id": "",
"workspace": "",
"data_type": "",
"dlp_profile": "",
"act_user": "",
"malware_profile": "",
"file_name": "",
"fromlogs": "",
"ml_detection": "",
"app_activity": "",
"malware_id": "",
"dstport": 0,
"transaction_id": 0,
"detection_engine": "",
"to_storage": "",
"parent_id": "",
"managed_app": "",
"external_collaborator_count": 0,
"nsdeviceuid": "",
"tss_fail_reason": "",
"managementID": "",
"workspace_id": "",
"true_obj_type": "",
"justification_type": "",
"aggregated_user": "",
"network": "",
"org": "",
"page_site": "",
"userPrincipalName": "",
"tss_mode": "",
"suppression_end_time": 0,
"true_type_id": 0,
"server_bytes": 0,
"manager": "",
"suppression_start_time": 0,
"file_category": "",
"app_name": "",
"audit_category": "",
"incident_id": 0,
"serial": "",
"resp_cnt": 0,
"browser_version": "",
"all_policy_matches": [],
"enterprise": "",
"numbytes": 0,
"device_classification": "",
"from_object": "",
"dlp_rule_count": 0,
"dsthost": "",
"src_time": "",
"user_category": "",
"browser_session_id": 0,
"sfwder": "",
"scanner_result": "",
"dlp_file": "",
"os_version": "",
"to_object": "",
"malware_type": "",
"log_file_name": "",
"web_universal_connector": "",
"enterprise_id": "",
"dlp_incident_id": 0,
"from_user": "",
"userip": "",
"page": "",
"req_cnt": 0,
"from_storage": "",
"tss_scan_failed": "",
"local_md5": ""
}
Device Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/device
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "983681ec8804b23e77c2c292",
"access_method": "Endpoint",
"action": "block",
"activity": "Insert",
"alert": "yes",
"alert_name": "TestBlock",
"alert_type": "Device",
"computer_name": "N49J4M9T3C",
"count": 1,
"device_classification": "not configured",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"policy": "TestBlock",
"policy_action": "block",
"policy_name_enforced": "TestBlock",
"timestamp": 1720005433,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_id": "USB\\VID_03f0&PID_1985&REV_0110",
"usb_device_name": "USB Flash Drive",
"usb_device_sn": "070D2C206FCFA597",
"usb_device_type": "usb mass storage",
"usb_product_id": "6533",
"usb_vendor_id": "HP",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"connection_type": "",
"driver": "",
"os_user_name": "",
"usb_is_encrypted": false,
"location": "",
"custom_attr": {}
}
Content Alerts
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/alerts/content
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "3f14cdb17c8385f9a6acfab4",
"access_method": "Endpoint",
"action": "block",
"activity": "Create",
"alert": "yes",
"alert_name": "mmm1",
"alert_type": "Content",
"app": "DesktopServicesHelper",
"computer_name": "N49J4M9T3C",
"count": 1,
"destination_file_directory": "/Volumes/KALI LINUX",
"destination_file_name": "urls.txt",
"destination_file_path": "/Volumes/KALI LINUX/urls.txt",
"device_classification": "not configured",
"dlp_incident_id": 8329186087212438192,
"dlp_profile": "DLPTest",
"file_size": 52483,
"file_type": "Plain Text file",
"incident_id": 8329186087212438192,
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"organization_unit": "",
"os": "macOS",
"os_details": "Mac OS X Sonoma 14.3.1 arm64",
"os_user_name": "kmaheshwari",
"pid": "0",
"policy": "mmm1",
"policy_action": "block",
"policy_name_enforced": "mmm1",
"process_name": "DesktopServicesHelper",
"process_path": "/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources",
"sha256": "23a129d56da1579a68862808a22b7b3e1d64682cc7d4c725fdc8a8c7980310b6",
"site": "DesktopServicesHelper",
"timestamp": 1719993896,
"traffic_type": "",
"type": "endpoint",
"ur_normalized": "kmaheshwari@netskope.com",
"usb_device_type": "usb mass storage",
"user": "kmaheshwari@netskope.com",
"userkey": "kmaheshwari@netskope.com",
"record_type": "alert",
"custom_attr": {},
"process_cert_subject": "",
"device": ""
}
Incident Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/incident
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "6d462e0db470c7247e75322fd380031271d1be18db9d707ef6f3affc792f11b1",
"access_method": "Endpoint Protection",
"acting_user": "kmaheshwari@netskope.com",
"activity": "Create",
"app": "DesktopServicesHelper",
"assignee": "None",
"dlp_incident_id": 7268524954762607217,
"dlp_match_info": [
{
"dlp_action": "block",
"dlp_forensic_id": 1711868037568704387,
"dlp_policy": "mmm1",
"dlp_profile_name": "DLPTest",
"dlp_rules": []
}
],
"file_path": "/Volumes/KALI LINUX/urls.txt",
"file_size": 52483,
"file_type": "Plain Text file",
"md5": "da3faaff0b406f6aa4685aee47ece41c",
"object": "urls.txt",
"object_id": "hash_kmaheshwari@netskope.com_da3faaff0b406f6aa4685aee47ece41c_7b4a2e1f194ccb4e8eca958a472bfe3c3741d7a6",
"severity": "Low",
"status": "new",
"timestamp": 1719993903,
"title": "urls.txt",
"user": "kmaheshwari@netskope.com",
"record_type": "incident",
"instance": "",
"src_location": "",
"app_session_id": 0,
"zip_file_id": "",
"connection_id": 0,
"destination_site": "",
"to_user": "",
"latest_incident_id": 0,
"from_user": "",
"site": "",
"dst_location": "",
"inline_dlp_match_info": [],
"destination_instance_id": "",
"instance_id": "",
"channel": "",
"original_file_snapshot_id": "",
"bcc": "",
"referer": "",
"dlp_file": "",
"destination_app": "",
"true_obj_type": "",
"file_lang": "",
"url": "",
"true_obj_category": "",
"cc": "",
"owner_pdl": "",
"classification": "",
"object_type": "",
"ext_labels": [],
"exposure": "",
"dlp_parent_id": 0,
"owner": "",
"user_id": ""
}
Incident Forensics
API Endpoint: https://<tenant-url>/api/v2/incidents/dlpincidents/{id}/forensics
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Request Parameters
| Key | Value |
|---|---|
| dlp_incident_id in path param | dlp_incident_id |
Sample API Response4
{
"status": "success",
"data": {
"meta": "{\"metadata_content\":\"filename: sensitive_data_onedrive_share.txt file_md5: 0bcafac7ce40ad3ebad1664307a046f1 file_type: text/plain file_lang: ENGLISH object_id: {\\\"drive_id\\\": \\\"b!PM0toX-2uEqSwuqUx0SzyDAe0n7GMw1Eok5wsoIE5ALI55tDhn-rSJB-vB4UWs5e\\\", \\\"driveitem_id\\\": \\\"014GLSS7Z2KV57XD3LXNFLWFO3HXHVREJB\\\", \\\"site_collection_id\\\": \\\"a12dcd3c-b67f-4ab8-92c2-ea94c744b3c8\\\"} ns_text_classifier: others \",\"dlp_match_info\":[{\"dlp_profile_name\":\"DLP-PCI\",\"dlp_rules\":[{\"dlp_rule_name\":\"Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":3,\"dlp_data_identifiers\":[[{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"Number\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":78,\"score\":1,\"end_offset\":93,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"378282XXXXX0005\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":96,\"score\":1,\"end_offset\":110,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"371449XXXXX8431\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"371449XXXXX8431\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"},{\"dlp_profile_name\":\"US Financial Data\",\"dlp_rules\":[{\"dlp_rule_name\":\"US-Bank-CC\",\"dlp_rule_severity\":\"Low\",\"dlp_incident_rule_count\":2,\"dlp_data_identifiers\":[[{\"start_offset\":19,\"score\":1,\"end_offset\":29,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"Type\\n\\n\",\"match\":\"Credit Card\",\"suffix\":\" Number\"},{\"start_offset\":41,\"score\":1,\"end_offset\":56,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\"\\n\\n\"},{\"start_offset\":59,\"score\":1,\"end_offset\":73,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"match\":\"378282XXXXX0005\",\"suffix\":\"\\n\\n\\n\\nAmerican\"}],[{\"start_offset\":115,\"score\":1,\"end_offset\":130,\"entity_name\":\"industries/banking/bank_names/us\",\"type\":\"content\",\"prefix\":\"3714XXXXXXXX31\\n\\n\\n\\n\",\"match\":\"American Express\",\"suffix\":\" Corporate\"},{\"start_offset\":143,\"score\":1,\"end_offset\":157,\"entity_name\":\"numbers/payment_card_numbers/major\",\"type\":\"content\",\"prefix\":\"\\n\\n\",\"match\":\"378734XXXXX1000\",\"suffix\":\"\\n\\n\\n\\nAustralian\"},{\"start_offset\":203,\"score\":1,\"end_offset\":213,\"entity_name\":\"numbers/payment_card_number_terms/eng\",\"type\":\"content\",\"prefix\":\"...5610591081018250\\n\\n\\n\\n\",\"match\":\"Diners Club\",\"suffix\":\"\\n\\n30569309025904\"}]]}],\"dlp_action\":\"quarantine\",\"action_threshold_met\":true,\"dlp_policy\":\"CDS Data Protection Policy\",\"dlp_scan_type\":\"Ongoing\",\"dlp_policy_hash\":\"policy hash\"}]}",
"content": " Credit Card Type\n\nCredit Card Number\n\n\n\nAmerican Express\n\n37XXXXXXXXX0005\n\n\n\nAmerican Express\n\n37XXXXXXXXX8431\n\n\n\nAmerican Express Corporate\n\n37XXXXXXXXX1000\n\n\n\nAustralian BankCard\n\n5610XXXXXXXX50\n\n\n\nDiners Club\n\n30569XXXXXXXX5904\n\n\n\nDiners Club\n\n3852XXXXXXXX37\n\n\n\nDiscover\n\n60111XXXXXXXX117\n\n\n\nDiscover\n\n6011XXXXXXXX424\n\n\n\nJCB\n\n35301XXXXXXXX00\n\n\n\nJCB\n\n356XXXXXXXX05\n\n\n\nMasterCard\n\n555XXXXXXXX444\n\n\n\nMasterCard\n\n5105XXXXXXXX00\n\n\n\nVisa\n\n41XXXXXXXX111\n\n\n\nVisa\n\n401XXXXXXXX1881\n\n\n\nVisa\n\n422XXXXXXXX222"
}
}
Endpoint Events
API Endpoint: https://<tenant-url>/api/v2/events/dataexport/events/endpoint
Method: GET
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Sample API Response
{
"_id": "dffd23ac520f696e1c4bd020",
"access_method": "Endpoint",
"activity_type": "Process Start",
"alert": "no",
"alert_generated": false,
"computer_name": "win11-50-1-92",
"device_type": "Bluetooth File Transfer",
"os": "Windows",
"os_details": "Microsoft Windows 11 Pro 10.0.22621 64-bit",
"policy_action": "allow",
"process_name": "python.exe",
"process_path": "\\??\\C:\\Program Files\\Python312\\python.exe",
"sub_type": "SUBTYPE_DEVICE_CONTROL",
"timestamp": 1725847324,
"type": "endpoint",
"user": "shubham.singhal@crestdata.ai",
"record_type": "epdlp",
"executable_hash": "",
"location": "",
"device_sn": "",
"app": "",
"destination_file_name": "",
"printer_identifier": "",
"file_type": "",
"dlp_profile_name": "",
"dlp_profile": "",
"event_recovered": false,
"destination_file_path": "",
"dlp_incident_id": 0,
"device_name": "",
"source_file_directory": "",
"alert_type": "",
"process_cert_subject": "",
"policy_name": "",
"source_file_name": "",
"incident_id": 0,
"action": "",
"policy_name_enforced": "",
"policy_version": "",
"executable_signed": false,
"file_size": 0,
"justification": "",
"product_id": "",
"vendor_id": "",
"device_id": "",
"destination_file_directory": "",
"dlp_rule": "",
"device": "",
"alert_name": "",
"pid": "",
"port": "",
"connection_type": "",
"sha256": "",
"policy_action_enforced": "",
"activity": "",
"driver": "",
"unc_path": "",
"file_origin": "",
"os_user_name": "",
"md5": ""
}
Update Incident Events
API Endpoint: https://<tenant-url>/api/v2/incidents/update
Method: PATCH
Request Headers
| Key | Value |
|---|---|
| Netskope-API-Token | <netskope_api_v2_token> |
| User-Agent | netskope-ce-6.1.0 |
Request Payload
{
"payload": [
{
"field": "status",
"new_value": "in_progress",
"object_id": "incident_object_id",
"old_value": "new",
"user": "user@domain.com"
}
]
}
Sample API Response
{
"result": [
{
"ok": 1,
"result": "string"
}
]
}
Performance Matrix
These readings are collected on a Large Cloud Exchange Stack with these specifications.
Performed performance for pulling and storing 200k Alerts/Events to Cloud Exchange.
| Description | Specification |
|---|---|
| Stack details | Size: Large RAM: 32 GB CPU: 16 Cores |
| Storing Alerts/Events per minute | ~ 120k |
Notes
- To achieve the above performance we increase the number of workers in the core otherwise the average performance would be around ~60k Events/Alerts per minute.
- This figure represents the average performance across all alert and event types; however, the retrieval rate for incidents may fall below the average, with an estimated rate of approximately 1,500 incident events per minute.
User Agent
netskope-ce-6.1.0
Workflow
- Configure the Ticket Orchestrator plugin.
- Configure a Business Rule.
- Configure a Queue with a third-party plugin (like Jira).
- Validate the plugin.
Watch a Video
Click play to watch a video.
Configure the Ticket Orchestrator Plugin
-
In Cloud Exchange, go to Settings > General and enable the Ticket Orchestrator module.
-
In Settings, go to the Plugin Store. Search for and select the Netskope Ticket Orchestrator v2.5.0 (CTO) plugin.
-
Enter a configuration name and select a configured Netskope tenant from the dropdown.
Note
Update incident back to Netskope Tenant toggle needs to be enabled to use the resolve incident queue configuration.
-
Click Next and enter the values for the Configuration Parameters.
- Alert Types: Selected types of alerts will be fetched.
- Initial Range for Alerts (in days): Number of days to pull the data for the initial run.
- Event Types: Selected types of event will be fetched.
- Initial Range for Events (in hours): Number of hours to pull the events data for the initial run.
- Alert/Event Query: Only the alerts/events matching this filter query will be stored and considered for ticket creation. If kept blank all the Alerts and Events will be considered for ticket creation.
- Pull DLP Incident Forensics: Forensics fields for DLP Incidents will be fetched.
Note
- By default Forensics Originalfile Url (forensics_originalfile_url) and Forensics Subfile Url (forensics_subfile_url) fields will be included irrespective of whether Pull DLP Incident Forensics is YES or NO.
- If either the Netskope Ticket Orchestrator plugin or the Netskope Log Shipper plugin has the “Pull DLP Incident Forensics” field set to Yes, both plugins will automatically retrieve forensic fields for incident events.
- Keeping the Pull DLP Incident Forensics field as Yes might impact the performance of the Netskope log shipper plugin as it will make additional API calls that will impact the performance of the plugin.
- Any change in the value of the “Pull DLP Incident Forensics” field will not be respected once the plugin is configured, unless you restart the core or delete the Tenant plugin and CTO Netskope Ticket Orchestrator plugin and re-configure both the plugins.
-
Click Next and configure mapping details for updating Incidents.
Note
For the Netskope Tenant Fields, you will have to provide the exact values that are used on the Netskope Tenant and expected by the Netskope Tenant’s API.
-
To create a new Netskope CE field for custom status or severity, click Add New under any Netskope CE Field.
-
Enter the field name and click Add Field.
-
Click Add to add a new row under Mapping. Select the newly added field and map it with Netskope Tenant fields per your need.
Note
Similarly, you can create a new field under the Severity section and map it with required severity.
-
Click Save.
Create a Business Rule for Ticket Orchestrator
-
Go to Business Rules and click Create New Rule.
-
Enter the Rule name and create a filter query.
-
Click Save.
Add a Queue for Ticket Orchestrator
-
Go to Ticket Orchestrator > Queues and click Add Queue Configuration.
-
Select the Business Rule, a Configuration (your Netskope Ticket Orchestratorplugin), and Resolve Incident for Queue.
Note
- Keep the Require Approval toggle enabled if you want to manually approve the execution of each resolve incident action on the Tickets page.
- Resolve incident action will be performed based on Update Incidents back to the Netskope Tenant toggle and the Sharing Sync Interval set in the plugin configuration.
- The Resolved Incident action will be supported with the Ticket Orchestrator plugin v2.5.0 and CE v6.1.0.
-
Click Save.
Validate the Ticket Orchestrator Plugin
Validate Alerts are Present in your Netskope Tenant
- Log in to your Netskope Tenant.
- Click Skope IT.
- Click Alerts > Filters and select the Last x Days according to your requirements.
Validate Incident Events are Present in your Tenant
- Log in to your Netskope Tenant.
- Click Skope IT.
- Click Incidents > DLP and select the Last x Days according to your requirements.
Validate Endpoint Events are Present in your Tenant
- Log in to your Netskope Tenant.
- Click Skope IT.
- Click Skope IT > Endpoint Events and select the Last x Days according to your requirements.
Validate the Pull
To validate the pulling of Alerts and Events from the Netskope tenant, first you need to check the pulled logs for Alerts and Events.
Go to Logging and add a filter using the plugin name. You can also use this sample filter query: message Like “pulled” && message Like “CTO Netskope Ticket Orchestrator”.
To validate the storing of Alerts in the Cloud Exchange, go to Ticket Orchestrator > Alerts.
To validate the storing of Events in Cloud Exchange, go to Ticket Orchestrator > Events.
Go to the Ticket Orchestrator > Tickets and check for the created Tickets.
Validate the Incident is updated on Netskope from Cloud Exchange
Incident update works only when the user has enabled Update Incidents back to the Netskope Tenant for this plugin and happens at the configured sync interval. When the ticket is updated on 3rd-party platform (like Jira), Cloud Exchange will sync the updated status (at 3rd-party plugin sync interval), and after that it will initiate the incident update on Netskope tenants.
- Go to the Ticket Orchestrator > Tickets and check for the created Tickets.
- Expand the incident type and check for Incident Sync Status.
- Go to Incidents > DLP and select the Incident that was updated from Cloud Exchange.
- Click Check Object History.
- Verify the updated incident from the history.
Note
If the 3rd-party plugin does not support sync for severity, the Ticket Orchestrator will not update severity on the Netskope Tenant, and you may observe errors in Cloud Exchange for skipping a severity update on the Netskope Tenant.
Example for resolved incident on Netskope Tenant.
Troubleshooting the Ticket Orchestrator Plugin
Receiving an Error while configuring Ticket Orchestrator
Getting the error: The Netskope tenant API V2 token does not have necessary permissions configured. Refer to the list of endpoints for which the token is missing permission. **
Cause: The provided V2 token does not have the minimum required permissions to configure the tenant in Cloud Exchange.
What to do:
- Go to Logging and look for a warning log similar to the following pattern:
TENANT Netskope Tenant (Required) [Netskope Tenant]: For Netskope Tenant, received 403 error for following endpoint(s). - Expand the log and get the list of endpoints for which permissions are missing.
- Update the v2 token permissions and add the permission for the above endpoint list from the Netskope Dashboard.
Getting the error: Invalid status mapping provided.
Cause: The configured plugin is not the latest version.
What to do:
Go to the Plugin repository page and fetch the latest plugin to configure it.
Receiving an error in configured Business Rules
Getting errors in configured business rules like Invalid field type detected, reconfigure the business rule using the Edit button.
Cause: The configured business rule has a field, for which the datatype has been changed/updated.
What to do:
Click Edit to edit the business rule, and then select the same field with the appropriate operator to filter the alerts/events.
Receiving error while updating the incidents status
Getting the error: Error occurred while updating the incidents’ status to Netskope Tenant for batch No. x
Cause: The provided V2 token does not have the minimum required permissions to update the incidents’ status back to the Netskope Tenant.
What to do:
- Go to Logging and look for the error message regarding the Ticket Orchestrator plugin.
- Expand the log and get the information regarding the error
- Provide the /api/v2/incidents/update read and write permissions to the V2 token.
Resolve incident workflow is not working
It may be due to the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
What to do:
Enable the Update incident back to netskope toggle disabled in the Netskope Ticket Orchestrator plugin configuration.
Known Behaviors
Error while deleting the Netskope Ticket Orchestrator plugin
Users will encounter an error message while deleting the Ticket Orchestrator v2.3.0 plugin, still the configuration will be deleted but the value for Pull DLP Incident Forensics will not be deleted from the Tenant configuration. Due to which if the user deletes Ticket Orchestrator v2.3.0, and if you want to reconfigure it, then you also need to delete the configured tenant and configure a fresh tenant, or you need to configure the Ticket Orchestrator plugin with the same name that you used earlier (Name of the old plugin configuration can be found in the logs on the Logging page). Before configuring the plugin with the same name, please refer to the below Known Behavior.
| 08/06/2025 10:13:27 AM | CE_1049 | error | Error occurred while processing request for api/itsm/configurations. |
Netskope Ticket Orchestrator plugin pulls forensics fields even if the Pull DLP Incident Forensics field is set to No or vice-versa
It may be due to one of these reasons:
- If either the Ticket Orchestrator plugin or the Netskope Log Shipper plugin has the Pull DLP Incident Forensics field set to Yes, both plugins will automatically retrieve forensic fields for incident events.
- Any change in the value of the Pull DLP Incident Forensics field will not be respected once the plugin is configured, unless you delete the Netskope Ticket Orchestrator plugin as well as tenant plugin and reconfigure both the plugins.
- If you have configured Ticket Orchestrator with Pull DLP Incident Forensics field set to Yes, and you delete that plugin configuration, and then you reconfigure the Netskope Ticket Orchestrator with same or different name, but with the Pull DLP Incident Forensics field set to No, then the plugin will still keep pulling forensics fields. To overcome this issue, you need to delete the Ticket Orchestrator plugin as well as the Netskope tenant and reconfigure both the plugins.
Behaviors related to the Update Incidents back to the Netskope Tenant toggle
- Even if the 3rd-party plugin does not support the storing of Severity or Assignee fields, still the CTO Netskope Plugin will make an API call to update Severity or Assignee from current value to other.
- If the Assignee field contains a invalid email or string then the ticket on Netskope Tenant will not be assigned.
- Status field may be unselected on Netskope Tenant UI, if the Status used in Netskope Cloud Exchange does not exist on Netskope Tenant or does not exactly match with the statuses present on the Netskope Tenant.
- We have observed multiple instances of a 500 Internal Server Error when attempting to update the severity of incidents within our Netskope Tenant.
The Update Incidents back to the Netskope Tenant toggle gets disabled after the plugin upgrade
If you have an already configured Netskope Ticket Orchestrator plugin with Update Incidents back to the Netskope Tenant toggle as enabled, and you upgrade the plugin, then this toggle will be disabled. You need to manually enable it by editing the plugin configuration after upgrading the plugin.
Behaviors related to resolve incident workflow
- To verify the incident action was successfully triggered, we need to check Incident Sync Status for the particular ticket.
- Users may observe logs for updating incidents on Netskope tenant at every sync interval.
- If the resolve incident action is triggered with ‘Update Incidents back to the Netskope Tenant’ toggle disabled then edit the plugin to enable Update Incidents back to the Netskope Tenant toggle, in this case the the incident ticket may not get resolved on the Netskope Tenant.
- If the incident on which resolve incident action is performed, is already in resolved state on Netskope tenant then Incident Sync Status will never get updated in Cloud Exchange.