Netskope Security V1
The Netskope connector uses the Netskope API to manage events, alerts, reports, and policies.
Prerequisites
The Netskope connector requires a tenant instance and an API token.
Capabilities
The Netskope connector provides the following capabilities:
- Acknowledge Anomalies
- Get Reports Data
- Ingest Alerts
- Ingest Events
- Update URL list
- Update File Hash List
Configurations
Netskope V1 Authentication
Netskope V1 Authentication
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token | API Token | string | Required |
Actions
Get Alerts
Returns alerts generated by Netskope, including policy, DLP, and watch list alerts
Endpoint
- URL: api/v1/alerts
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.starttime | string | Required | Parameters for the Get Alerts action |
parameters.endtime | string | Required | Parameters for the Get Alerts action |
parameters.query | string | Optional | Parameters for the Get Alerts action |
parameters.type | string | Optional | Parameters for the Get Alerts action |
parameters.acked | boolean | Optional | Parameters for the Get Alerts action |
parameters.timeperiod | number | Optional | Parameters for the Get Alerts action |
parameters.insertionstarttime | string | Optional | Parameters for the Get Alerts action |
parameters.insertionendtime | string | Optional | Parameters for the Get Alerts action |
parameters.limit | number | Optional | Parameters for the Get Alerts action |
parameters.skip | number | Optional | Parameters for the Get Alerts action |
parameters.unsorted | boolean | Optional | Parameters for the Get Alerts action |
Input Example
{"parameters":{"starttime":"0000000000","endtime":"1673624111","query":"alert_name like 'test'","type":"anomaly","acked":true,"timeperiod":3600,"insertionstarttime":"1673624111","insertionendtime":"1673624111","limit":10000,"skip":4,"unsorted":false}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
msg | string | Output field: msg |
data | array | Response data |
Output Example
{"status":"active","msg":"string","data":["string"]}
Get Events
Returns events extracted from SaaS traffic and or logs
Endpoint
- URL: api/v1/events
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.starttime | string | Required | Parameters for the Get Events action |
parameters.endtime | string | Required | Parameters for the Get Events action |
parameters.query | string | Optional | Parameters for the Get Events action |
parameters.type | string | Required | Parameters for the Get Events action |
parameters.timeperiod | number | Optional | Parameters for the Get Events action |
parameters.insertionstarttime | string | Optional | Parameters for the Get Events action |
parameters.insertionendtime | string | Optional | Parameters for the Get Events action |
parameters.limit | number | Optional | Parameters for the Get Events action |
parameters.skip | number | Optional | Parameters for the Get Events action |
parameters.unsorted | boolean | Optional | Parameters for the Get Events action |
Input Example
{"parameters":{"starttime":"0000000000","endtime":"1673624111","query":"alert_name like 'test'","type":"anomaly","timeperiod":3600,"insertionstarttime":"1673624111","insertionendtime":"1673624111","limit":10000,"skip":4,"unsorted":false}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
msg | string | Output field: msg |
data | array | Response data |
data._id | string | Response data |
data._insertion_epoch_timestamp | number | Response data |
data.access_method | string | Response data |
data.app | string | Response data |
data.appcategory | string | Response data |
data.bypass_reason | string | Response data |
data.bypass_traffic | string | Response data |
data.category | string | Response data |
data.cci | number | Response data |
data.ccl | string | Response data |
data.connection_id | number | Response data |
data.count | number | Response data |
data.domain | string | Response data |
data.dst_country | string | Response data |
data.dst_geoip_src | number | Response data |
data.dst_latitude | number | Response data |
data.dst_location | string | Response data |
data.dst_longitude | number | Response data |
data.dst_region | string | Response data |
data.dst_timezone | string | Response data |
Output Example
{"status":"active","msg":"string","data":[{"_id":"string","_insertion_epoch_timestamp":123,"access_method":"string","app":"string","appcategory":"string","bypass_reason":"string","bypass_traffic":"string","category":"string","cci":123,"ccl":"string","connection_id":123,"count":123,"domain":"string","dst_country":"string","dst_geoip_src":123}]}
Update a File Hash List
Updates the File Hash List with the values provided. This replaces the existing values with the new values, so include the existing values you want to keep in the list
Endpoint
- URL: api/v1/updateFileHashList
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Required | Parameters for the Update a File Hash List action |
parameters.list | string | Required | Parameters for the Update a File Hash List action |
Input Example
{"parameters":{"name":"aarav-test-final","list":"e28eb9739b6e84d0f796e3acc0f5b71e"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
msg | string | Output field: msg |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 16 Jan 2023 16:48:02 GMT","Content-Type":"application/json; charset=UTF-8","Content-Length":"69","Connection":"keep-alive","Set-Cookie":"ci_session=zez1NluBs48IYOsWkv9Tfr%2CyjmtSq4mV; path=/; secure; HttpOnly, ci_sess...","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Security-Policy":"connect-src 'self' http://*.3gl.net *.mapbox.com ; default-src 'se...
Get Reports Data
Returns the result of a report generated on one of the fields in the summarization database
Endpoint
- URL: api/v1/report
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.type | string | Required | Parameters for the Get Reports Data action |
parameters.starttime | string | Required | Parameters for the Get Reports Data action |
parameters.endtime | string | Required | Parameters for the Get Reports Data action |
parameters.groupby | string | Required | Parameters for the Get Reports Data action |
parameters.query | string | Optional | Parameters for the Get Reports Data action |
parameters.timeperiod | number | Optional | Parameters for the Get Reports Data action |
parameters.limit | number | Optional | Parameters for the Get Reports Data action |
parameters.skip | number | Optional | Parameters for the Get Reports Data action |
Input Example
{"parameters":{"type":"application","starttime":"0000000000","endtime":"1673624111","groupby":"application","query":"alert_type eq DLP","timeperiod":3600,"limit":3,"skip":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
msg | string | Output field: msg |
data | array | Response data |
data.count | number | Response data |
data.app | string | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 16 Jan 2023 16:24:00 GMT","Content-Type":"application/json; charset=UTF-8","Content-Length":"139","Connection":"keep-alive","Set-Cookie":"ci_session=4KMFGXQ7a%2ChGjXxfKjhy655MFQxeLdDS; path=/; secure; HttpOnly, ci_sess...","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Security-Policy":"connect-src 'self' http://*.3gl.net *.mapbox.com ; default-src 's...
Update a URL List
Updates the URL List with the values provided. This replaces the existing values with the new values, so include the existing values you want to keep in the list
Endpoint
- URL: api/v1/updateUrlList
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.name | string | Required | Parameters for the Update a URL List action |
parameters.list | string | Required | Parameters for the Update a URL List action |
Input Example
{"parameters":{"name":"2133213","list":"cedefaultpush.io"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
status | string | Status value |
msg | string | Output field: msg |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 16 Jan 2023 16:59:52 GMT","Content-Type":"application/json; charset=UTF-8","Content-Length":"58","Connection":"keep-alive","Set-Cookie":"ci_session=zEueorBjLuLZS7QgVtZgWPeXaKNZ4W9a; path=/; secure; HttpOnly, ci_sessio...","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Content-Security-Policy":"connect-src 'self' http://*.3gl.net *.mapbox.com ; default-src 'se...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-store, no-cache, must-revalidate |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | ο»Ώ |
Content-Length | The length of the response body in bytes | 69 |
Content-Security-Policy | HTTP response header: Content-Security-Policy | connect-src 'self' http://*.3gl.net *.mapbox.com ; default-src 'self' blob: https://analytics-alliances.goskope.com; img-src 'self' data: .mapbox.com ;object-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: http://.3gl.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com https://netdna.bootstrapcdn.com data:; |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Mon, 16 Jan 2023 16:48:02 GMT |
Expires | The date/time after which the response is considered stale | Thu, 19 Nov 1981 08:52:00 GMT |
Pragma | HTTP response header: Pragma | no-cache |
Server | Information about the software used by the origin server | nginx |
Set-Cookie | HTTP response header: Set-Cookie | ci_session=4KMFGXQ7a%2ChGjXxfKjhy655MFQxeLdDS; path=/; secure; HttpOnly, ci_session=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains |
Transfer-Encoding | HTTP response header: Transfer-Encoding | ο»Ώ |
Vary | HTTP response header: Vary | ο»Ώ |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Frame-Options | HTTP response header: X-Frame-Options | DENY, DENY |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |