Netskope Security V2

Netskope V2 Api

Netskope Security V2 is a cloud security platform that provides visibility and control over data, users, and applications.

Netskope Security V2 is a leading cloud security platform that provides comprehensive visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. This connector enables Swimlane Turbine users to automate the retrieval and management of security events, alerts, and URL lists from Netskope. By integrating with Netskope Security V2, users can enhance their security operations with automated workflows, ensuring timely responses to security incidents and efficient management of security policies.

Prerequisites

Before you can use the Netskope Security V2 connector for Turbine, you'll need access to the Netskope API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing the Netskope API.

API Key: A unique key provided by Netskope to authenticate API requests.

Capabilities

This connector provides the following capabilities:

Ingest Events

Manage URL lists

Action Setup

For even ingestion actions, you will need to provide either Start Time and End Time, or Insertion Start Time and Insertion End Time. You can use relative datetimes for these inputs.

Relative Datetime Format

For the current time:
    now
Any other time:
    (+/-)(integer) (milliseconds|seconds|minutes|days|weeks|months|years)
    
examples:
    now
    -1 months
    +3 days
    -123 seconds

Additional Documentation

Netskope Security V2 Connector Documentation

Netskope Security V2 API Documentation

Netskope Security V2 Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Netskope-Api-Token	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Alerts

Fetches a list of alerts from Netskope Security V2, providing an overview of detected security incidents.

Endpoint

URL: api/v2/events/data/alert

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Optional	Parameters for the Get Alerts action
parameters.acked	string	Optional	Parameters for the Get Alerts action
parameters.query	string	Optional	Parameters for the Get Alerts action
parameters.limit	number	Optional	Parameters for the Get Alerts action
parameters.offset	number	Optional	Parameters for the Get Alerts action
parameters.starttime	number	Optional	Parameters for the Get Alerts action
parameters.endtime	number	Optional	Parameters for the Get Alerts action
parameters.insertionstarttime	number	Optional	Parameters for the Get Alerts action
parameters.insertionendtime	number	Optional	Parameters for the Get Alerts action

Input Example

{"parameters":{"starttime":1611091927,"endtime":1671474727,"limit":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result._category_id	string	Unique identifier
result._category_tags	array	Result of the operation
result._correlation_id	string	Unique identifier
result._ef_received_at	number	Result of the operation
result._enriched	boolean	Result of the operation
result._event_id	string	Unique identifier
result._forwarded_by	string	Result of the operation
result._gef_src_dp	string	Result of the operation
result._id	string	Unique identifier
result._insertion_epoch_timestamp	number	Result of the operation
result._raw_event_inserted_at	number	Result of the operation
result._service_identifier	string	Unique identifier
result._session_begin	string	Result of the operation
result._skip_geoip_lookup	string	Result of the operation
result.access_method	string	HTTP method to use
result.acked	string	Result of the operation
result.action	string	Result of the operation
result.activity	string	Result of the operation
result.alert	string	Result of the operation
result.alert_id	string	Unique identifier
result.alert_name	string	Name of the resource

Output Example

{"ok":123,"result":[{"_category_id":"string","_category_tags":[],"_correlation_id":"string","_ef_received_at":123,"_enriched":true,"_event_id":"string","_forwarded_by":"string","_gef_src_dp":"string","_id":"string","_insertion_epoch_timestamp":123,"_raw_event_inserted_at":123,"_service_identifier":"string","_session_begin":"string","_skip_geoip_lookup":"string","access_method":"string"}]}

Get Application Events

Retrieve event data for applications from Netskope Security V2, including user activity and security incidents.

Endpoint

URL: api/v2/events/data/application

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Application Events action
parameters.limit	number	Optional	Parameters for the Get Application Events action
parameters.offset	number	Optional	Parameters for the Get Application Events action
parameters.starttime	number	Optional	Parameters for the Get Application Events action
parameters.endtime	number	Optional	Parameters for the Get Application Events action
parameters.insertionstarttime	number	Optional	Parameters for the Get Application Events action
parameters.insertionendtime	number	Optional	Parameters for the Get Application Events action

Input Example

{"parameters":{"query":"string","limit":123,"offset":123,"starttime":123,"endtime":123,"insertionstarttime":123,"insertionendtime":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result.User_SPACE_Id	string	Unique identifier
result.User_SPACE_Name	string	Name of the resource
result._category_id	string	Unique identifier
result._correlation_id	string	Unique identifier
result._ef_received_at	number	Result of the operation
result._event_id	string	Unique identifier
result._forwarded_by	string	Result of the operation
result._gef_src_dp	string	Result of the operation
result._id	string	Unique identifier
result._insertion_epoch_timestamp	number	Result of the operation
result._raw_event_inserted_at	number	Result of the operation
result._service_identifier	string	Unique identifier
result._session_begin	number	Result of the operation
result.access_method	string	HTTP method to use
result.action	string	Result of the operation
result.activity	string	Result of the operation
result.alert	string	Result of the operation
result.app	string	Result of the operation
result.app_category	string	Result of the operation
result.appcategory	string	Result of the operation
result.browser	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:41:35 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept-Encoding","RateLimit-Reset":"1","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Limit":"4","RateLimit-Remaining":"3","X-Kong-Upstream-Latency":"438","X-Kong-Proxy-Latency":"18","Via":"kong/2.8.1.2-enterprise-edition","Content-Encoding":"gzip"},"reason":"OK","json_body":{...

Get Audit Events

Retrieve a list of audit events from Netskope Security V2, including user activities and policy violations.

Endpoint

URL: api/v2/events/data/audit

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Audit Events action
parameters.limit	number	Optional	Parameters for the Get Audit Events action
parameters.offset	number	Optional	Parameters for the Get Audit Events action
parameters.starttime	number	Optional	Parameters for the Get Audit Events action
parameters.endtime	number	Optional	Parameters for the Get Audit Events action
parameters.insertionstarttime	number	Optional	Parameters for the Get Audit Events action
parameters.insertionendtime	number	Optional	Parameters for the Get Audit Events action

Input Example

{"parameters":{"query":"string","limit":123,"offset":123,"starttime":123,"endtime":123,"insertionstarttime":123,"insertionendtime":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result.is_netskope_personnel	boolean	Result of the operation
result.type	string	Type of the resource
result.timestamp	number	Result of the operation
result.user	string	Result of the operation
result.supporting_data	object	Response data
result.supporting_data.data_values	array	Response data
result.supporting_data.data_type	string	Response data
result.severity_level	number	Result of the operation
result.audit_log_event	string	Result of the operation
result.organization_unit	string	Result of the operation
result.ur_normalized	string	Result of the operation
result.ccl	string	Result of the operation
result.count	number	Result of the operation
result._insertion_epoch_timestamp	number	Result of the operation
result._id	string	Unique identifier
analyze_result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:45:04 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept-Encoding","RateLimit-Reset":"1","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Remaining":"3","RateLimit-Limit":"4","X-Kong-Upstream-Latency":"17","X-Kong-Proxy-Latency":"16","Via":"kong/2.8.1.2-enterprise-edition","Content-Encoding":"gzip"},"reason":"OK","json_body":{"...

Get Infrastructure Events

Retrieve infrastructure-related events from Netskope Security V2 for analysis and monitoring.

Endpoint

URL: api/v2/events/data/infrastructure

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Infrastructure Events action
parameters.limit	number	Optional	Parameters for the Get Infrastructure Events action
parameters.offset	number	Optional	Parameters for the Get Infrastructure Events action
parameters.starttime	number	Optional	Parameters for the Get Infrastructure Events action
parameters.endtime	number	Optional	Parameters for the Get Infrastructure Events action
parameters.insertionstarttime	number	Optional	Parameters for the Get Infrastructure Events action
parameters.insertionendtime	number	Optional	Parameters for the Get Infrastructure Events action

Input Example

{"parameters":{"query":"string","limit":123,"offset":123,"starttime":123,"endtime":123,"insertionstarttime":123,"insertionendtime":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result.file_name	string	Name of the resource
result.file	string	Result of the operation
analyze_result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:47:03 GMT","Content-Type":"application/json","Content-Length":"48","Connection":"keep-alive","RateLimit-Remaining":"3","RateLimit-Limit":"4","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Reset":"1","X-Kong-Upstream-Latency":"52","X-Kong-Proxy-Latency":"21","Via":"kong/2.8.1.2-enterprise-edition","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Frame-Options":"DEN...

Get Network Events

Retrieve network events from Netskope Security V2, providing insights into traffic patterns and security threats.

Endpoint

URL: api/v2/events/data/network

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Network Events action
parameters.limit	number	Optional	Parameters for the Get Network Events action
parameters.offset	number	Optional	Parameters for the Get Network Events action
parameters.starttime	number	Optional	Parameters for the Get Network Events action
parameters.endtime	number	Optional	Parameters for the Get Network Events action
parameters.insertionstarttime	number	Optional	Parameters for the Get Network Events action
parameters.insertionendtime	number	Optional	Parameters for the Get Network Events action

Input Example

{"parameters":{"query":"string","limit":123,"offset":123,"starttime":123,"endtime":123,"insertionstarttime":123,"insertionendtime":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result._correlation_id	string	Unique identifier
result._ef_received_at	number	Result of the operation
result._event_id	string	Unique identifier
result._forwarded_by	string	Result of the operation
result._gef_src_dp	string	Result of the operation
result._id	string	Unique identifier
result._insertion_epoch_timestamp	number	Result of the operation
result._raw_event_inserted_at	number	Result of the operation
result._service_identifier	string	Unique identifier
result.access_method	string	HTTP method to use
result.action	string	Result of the operation
result.app	string	Result of the operation
result.appcategory	string	Result of the operation
result.category	string	Result of the operation
result.cci	number	Result of the operation
result.ccl	string	Result of the operation
result.client_bytes	number	Result of the operation
result.client_packets	number	Result of the operation
result.count	number	Result of the operation
result.device	string	Result of the operation
result.domain	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:49:08 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept-Encoding","RateLimit-Reset":"1","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Limit":"4","RateLimit-Remaining":"3","X-Kong-Upstream-Latency":"2050","X-Kong-Proxy-Latency":"16","Via":"kong/2.8.1.2-enterprise-edition","Content-Encoding":"gzip"},"reason":"OK","json_body":...

Get Page Events

Fetches a list of page events from Netskope Security V2, providing insights into user activity and traffic events.

Endpoint

URL: api/v2/events/data/page

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Page Events action
parameters.limit	number	Optional	Parameters for the Get Page Events action
parameters.offset	number	Optional	Parameters for the Get Page Events action
parameters.starttime	number	Optional	Parameters for the Get Page Events action
parameters.endtime	number	Optional	Parameters for the Get Page Events action
parameters.insertionstarttime	number	Optional	Parameters for the Get Page Events action
parameters.insertionendtime	number	Optional	Parameters for the Get Page Events action

Input Example

{"parameters":{"query":"string","limit":123,"offset":123,"starttime":123,"endtime":123,"insertionstarttime":123,"insertionendtime":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ok	number	Output field: ok
result	array	Result of the operation
result._category_id	string	Unique identifier
result._correlation_id	string	Unique identifier
result._ef_received_at	number	Result of the operation
result._event_id	string	Unique identifier
result._forwarded_by	string	Result of the operation
result._gef_src_dp	string	Result of the operation
result._id	string	Unique identifier
result._insertion_epoch_timestamp	number	Result of the operation
result._nshostname	string	Name of the resource
result._raw_event_inserted_at	number	Result of the operation
result._service_identifier	string	Unique identifier
result._skip_geoip_lookup	string	Result of the operation
result._src_epoch_now	number	Result of the operation
result.access_method	string	HTTP method to use
result.app	string	Result of the operation
result.appcategory	string	Result of the operation
result.bypass_reason	string	Response reason phrase
result.bypass_traffic	string	Result of the operation
result.category	string	Result of the operation
result.cci	number	Result of the operation
result.ccl	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:50:47 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept-Encoding","RateLimit-Reset":"1","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Limit":"4","RateLimit-Remaining":"3","X-Kong-Upstream-Latency":"734","X-Kong-Proxy-Latency":"36","Via":"kong/2.8.1.2-enterprise-edition","Content-Encoding":"gzip"},"reason":"OK","json_body":{...

Get URL list by ID

Retrieves a specific URL list from Netskope Security V2 using the unique identifier provided in the path parameters.

Endpoint

URL: api/v2/policy/urllist/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Get URL list by ID action

Input Example

{"path_parameters":{"id":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
name	string	Name of the resource
data	object	Response data
data.urls	array	Response data
data.type	string	Response data
data.json_version	number	Response data
modify_by	string	Output field: modify_by
modify_time	string	Time value
modify_type	string	Type of the resource
pending	number	Output field: pending

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 18:54:33 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"251","Connection":"keep-alive","RateLimit-Reset":"1","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Remaining":"3","RateLimit-Limit":"4","X-XSS-Protection":"0","X-Netskope-trid":"c55eud9rrs13cva465e0","ETag":"W/\"fb-gOyyNlE56YFSbZ0LY8ru3P8DDJc\"","Content-Security-Policy":"default-src 'self';base-uri 'self'...

Patch URL list

Apply patches to a specified URL list in Netskope Security V2 using the list's ID and action parameters.

Endpoint

URL: api/v2/policy/urllist/{{id}}/{{action}}

Method: PATCH

Input

Argument Name	Type	Required	Description
path_parameters.id	number	Required	Parameters for the Patch URL list action
path_parameters.action	string	Required	Parameters for the Patch URL list action
name	string	Optional	Name of the resource
data	object	Optional	Response data
data.urls	array	Optional	Response data
data.type	string	Optional	Response data

Input Example

{"json_body":{"name":"test456795","data":{"urls":["www.test.com"],"type":"exact"}},"path_parameters":{"id":1,"action":"append"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	number	Unique identifier
name	string	Name of the resource
data	object	Response data
data.urls	array	Response data
data.type	string	Response data
data.json_version	number	Response data
modify_by	string	Output field: modify_by
modify_time	string	Time value
modify_type	string	Type of the resource
pending	number	Output field: pending

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 19 Dec 2022 19:01:30 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"251","Connection":"keep-alive","RateLimit-Remaining":"3","RateLimit-Limit":"4","X-RateLimit-Remaining-Second":"3","X-RateLimit-Limit-Second":"4","RateLimit-Reset":"1","X-Frame-Options":"SAMEORIGIN, DENY","Strict-Transport-Security":"max-age=15552000; includeSubDomains, max-age=31536000; includeSubDomains","X-Download-Options":"noopen","...

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	251
Content-Security-Policy	HTTP response header: Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Mon, 19 Dec 2022 18:47:03 GMT
ETag	An identifier for a specific version of a resource	W/"fb-Thj3LYA6FUMBol97au3SFvCPTKY"
Expect-CT	HTTP response header: Expect-CT	max-age=0
RateLimit-Limit	HTTP response header: RateLimit-Limit	4
RateLimit-Remaining	HTTP response header: RateLimit-Remaining	3
RateLimit-Reset	HTTP response header: RateLimit-Reset	1
Referrer-Policy	HTTP response header: Referrer-Policy	no-referrer
Server	Information about the software used by the origin server	nginx
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding
Via	HTTP response header: Via	kong/2.8.1.2-enterprise-edition
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-DNS-Prefetch-Control	HTTP response header: X-DNS-Prefetch-Control	off
X-Download-Options	HTTP response header: X-Download-Options	noopen
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN, DENY
X-Kong-Proxy-Latency	HTTP response header: X-Kong-Proxy-Latency	16
X-Kong-Upstream-Latency	HTTP response header: X-Kong-Upstream-Latency	2050
X-Netskope-trid	HTTP response header: X-Netskope-trid	c55eud9rrs13cva465e0
X-Permitted-Cross-Domain-Policies	HTTP response header: X-Permitted-Cross-Domain-Policies	none
X-RateLimit-Limit-Second	HTTP response header: X-RateLimit-Limit-Second	4
X-RateLimit-Remaining-Second	HTTP response header: X-RateLimit-Remaining-Second	3
X-XSS-Protection	HTTP response header: X-XSS-Protection	0