Netskope Deprecated

Cloud access security broker that enables to find, understand, and secure cloud apps. Deprecated. Use Netskope (API v1) instead.

Network Security · Netskope

Details

ID	`Netskope`
Provider	Netskope
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Use the Netskope integration to manage your Netskope events and alerts.

This integration was integrated and tested with Netskope v51.

Prerequisites

You need to obtain the following Netskope information.

Netskope tenant URL
Tenant API token

Configure the Netskope Integration on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Netskope.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- URL of Netskope Tenant: for example, https://tenant.goskope.com
- Tenant API Token: paste the token that you copied.
- Do not validate server certificate (unsecure)
- Use system proxy settings
Click Test to validate the URLs and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Get Netskope events: netskope-events
Get Netskope alerts: netskope-alerts

1. Get Netskope events: netskope-events

Retrieve events from your Netskope environment.

Command Example

!netskope-events type=application timeperiod=Last24Hours

Input

Input Parameter	Description
query	Filter query, for example, foo@test.com
timeperiod	Query time period (for example, last 60 minutes, last 24 hours)
starttime	Query start time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g., 31-12-1999T11:59:59Z)
endtime	Query end time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g., 31-12-1999T11:59:59Z)
type	Event type Application Page Audit
limit	Maximum number of events returned (useful for pagination in combination with skip) Must be an integer less than 5,000.
skip	Skip over specific events (useful for pagination in combination with limit)

Context Output

Path	Description
Netskope.Events.App	Application name
Netskope.Events.Timestamp	Event timestamp
Netskope.Events.Activity	Event activity
Netskope.Events.Object	Document/object from the event
Netskope.Events.hostname	Device hostname
Netskope.Events.AppCategory	Netskope application category (for example, Cloud Storage, Webmail, and so on)
Netskope.Events.device_classification	Device classification (for example, managed vs. unmanaged)
Netskope.Events.User	User
Netskope.Events.from_user	Login IDs for cloud applications
Netskope.Events.to_user	Destination user IDs
Netskope.Events.SourceIP	Source IP
Netskope.Events.AccessMethod	Access method (for example, client, reverse proxy, Secure Forwarder, and so on)
Netskope.Events.url	URL
Netskope.Events.ID	Event ID

Raw Output

{  
   "AccessMethod":"API Connector",
   "Activity":"HeadBucket",
   "App":"Amazon Web Services",
   "AppCategory":"IaaS/PaaS",
   "DeviceClassification":null,
   "FromUser":null,
   "Hostname":null,
   "ID":"1382a493090c36ba14bfc2bc",
   "Object":"nstrail",
   "SourceIP":"8.36.116.16",
   "Timestamp":"Mon May 21 2018 13:26:30 GMT+0300 (IDT)",
   "ToUser":null,
   "URL":null,
   "User":"assumed-role/ctaudit/AssumeRoleSession1"
}

2. Get Netskope alerts: netskope-alerts

Retrieve alerts from your Netskope environment.

Command Example

!netskope-alerts type=Malware timeperiod=Last60Days

Input

Input Parameter	Description
type	Alert type
timeperiod	Query time period (for example, last 60 minutes, last 24 hours)
starttime	Query start time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g., 31-12-1999T11:59:59Z)
endtime	Query end time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g., 31-12-1999T11:59:59Z)
query	Valid event query described in the query language document

Context Output

Path	Description
Netskope.Alerts.App	Application name
Netskope.Alerts.Timestamp	Alert timestamp
Netskope.Alerts.Policy	Name of policy triggered
Netskope.Alerts.DLPFile	Name of DLP file that triggered
Netskope.Alerts.Hostname	Hostname
Netskope.Alerts.ID	Alert ID

Raw Output

{  
   "App":"Microsoft Office 365 OneDrive for Business",
   "DLPFile":null,
   "DLPProfile":null,
   "Hostname":"Ashutosh’s MacBook Pro",
   "ID":"f95e5638432f538365d5b256",
   "Policy":null,
   "Timestamp":"Mon May 21 2018 13:29:34 GMT+0300 (IDT)"
}

Configuration parameters

url — URL of Netskope Tenant (e.g. https://tenant.goskope.com) (required)
token — Tenant API Token (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
firstFetch — Timeframe for initial fetch
maxFetch — Maximum number of events to fetch per fetch

Commands (2)

netskope-alerts
Gets a list of alerts
netskope-events
Gets a list of events

Source

Netskope.js Netskope.yml Netskope_description.md

Download History Raw

commonfields:
  id: Netskope
  version: -1
name: Netskope
display: Netskope (Deprecated)
category: Network Security
provider: Netskope
description: Cloud access security broker that enables to find, understand, and secure cloud apps. Deprecated. Use Netskope (API v1) instead.
configuration:
- display: URL of Netskope Tenant (e.g. https://tenant.goskope.com)
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: Tenant API Token
  name: token
  defaultvalue: ""
  type: 4
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Timeframe for initial fetch
  name: firstFetch
  defaultvalue: Last60Minutes
  type: 15
  options:
  - Last60Minutes
  - Last24Hours
  - Last7Days
  - Last30Days
  - Last60Days
  - Last90Days
  required: false
- display: Maximum number of events to fetch per fetch
  name: maxFetch
  defaultvalue: "50"
  type: 0
  required: false
script:
  script: ''
  type: javascript
  commands:
  - name: netskope-events
    arguments:
    - name: query
      description: filter query (e.g. user eq user1@domain.com)
    - name: timeperiod
      auto: PREDEFINED
      predefined:
      - Last60Minutes
      - Last24Hours
      - Last7Days
      - Last30Days
      - Last60Days
      - Last90Days
      description: TimePeriod
    - name: starttime
      description: 'Query start time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g. 31-12-1999T11:59:59Z)'
    - name: endtime
      description: 'Query end time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g. 31-12-1999T11:59:59Z)'
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - application
      - page
      - audit
      description: Type of Event (e.g Application, Page, Audit)
    - name: limit
      description: Limit the number of events returned (useful for pagination in combination with skip). Positive integer less than 5000.
    - name: skip
      description: Skip over some of the events (useful for pagination in combination with limit)
    outputs:
    - contextPath: Netskope.Events.App
      description: Name of Application
      type: string
    - contextPath: Netskope.Events.Timestamp
      description: Timestamp of event
      type: string
    - contextPath: Netskope.Events.Activity
      description: Activity of event
      type: string
    - contextPath: Netskope.Events.Object
      description: Document/object from event
      type: string
    - contextPath: Netskope.Events.hostname
      description: Hostname of device
      type: string
    - contextPath: Netskope.Events.AppCategory
      description: Netskope application category (e.g. Cloud Storage, Webmail, etc)
      type: string
    - contextPath: Netskope.Events.device_classification
      description: Device classification (e.g. managed vs unmanaged)
      type: string
    - contextPath: Netskope.Events.User
      description: User
      type: string
    - contextPath: Netskope.Events.from_user
      description: Login IDs for cloud apps
      type: string
    - contextPath: Netskope.Events.to_user
      description: Destination user IDs
      type: string
    - contextPath: Netskope.Events.SourceIP
      description: Source IP
      type: string
    - contextPath: Netskope.Events.AccessMethod
      description: Access method (e.g. client, reverse proxy, Secure Forwarder, etc)
      type: string
    - contextPath: Netskope.Events.url
      description: URL
      type: string
    - contextPath: Netskope.Events.ID
      description: Event ID
      type: string
    description: Gets a list of events
  - name: netskope-alerts
    arguments:
    - name: type
      required: true
      auto: PREDEFINED
      predefined:
      - anomaly
      - Compromised Credential
      - DLP
      - Legal Hold
      - malsite
      - Malware
      - policy
      - quarantine
      - Remediation
      - watchlist
      description: Type of alert
    - name: timeperiod
      auto: PREDEFINED
      predefined:
      - Last60Minutes
      - Last24Hours
      - Last7Days
      - Last30Days
      - Last60Days
      - Last90Days
      description: Time period (e.g. Last 60 minutes, Last 24 hours, etc.)
    - name: starttime
      description: 'Query start time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g., 31-12-1999T11:59:59Z)'
    - name: endtime
      description: 'Query end time: timestamp or dd-mm-yyyyTHH:MM:SSZ (e.g. 31-12-1999T11:59:59Z)'
    - name: query
      description: Valid event query described in the query language document
    outputs:
    - contextPath: Netskope.Alerts.App
      description: Name of Application
      type: string
    - contextPath: Netskope.Alerts.Timestamp
      description: Timestamp of event
      type: string
    - contextPath: Netskope.Alerts.Policy
      description: Name of Policy Triggered
      type: string
    - contextPath: Netskope.Alerts.DLPFile
      description: Name of DLP File that triggered
      type: string
    - contextPath: Netskope.Alerts.Hostname
      description: Hostname
      type: string
    - contextPath: Netskope.Alerts.ID
      description: Alert ID
      type: string
    description: Gets a list of alerts
  isfetch: true
tests:
- No Test - deprecated
fromversion: 5.0.0
deprecated: true