netskope_api_v2

Netskope API v2 provides a powerful interface for managing and monitoring Netskope deployments. It enables users to retrieve alerts and events, manage URL lists, and control clients. With Netskope API v2, organizations can proactively respond to security threats, enforce web access policies, and efficiently administer their Netskope environment.

Network Security · Netskope

Configuration parameters

  • url — Server URL (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • credentials — (required)
  • first_fetch — First fetch timestamp
  • max_fetch — Maximum incidents per fetch
  • max_events_fetch — Maximum Netskope events per fetch. Max value is 200.
  • max_dlp_incidents_fetch — Maximum Netskope DLP incidents per fetch. Max value is 200.
  • fetch_events — Fetch Events
  • fetch_dlp_incidents — Fetch DLP incidents
  • event_types — Event types to fetch.
  • alerts_query — Alerts Query
  • events_query — Events Query
  • incidentType — Incident type
  • isFetch — Fetch incidents
  • user_email — User Email
  • incidentFetchInterval — Incidents Fetch Interval
  • mirror_direction — Incident Mirroring Direction
  • close_incident — Close Mirrored XSOAR Incident
  • close_netskope_incident — Close Mirrored Netskope Incident

Commands (13)

  • get-mapping-fields

    Returns the list of fields for an incident type.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.

  • get-remote-data

    Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

  • netskope-alert-list

    Get alerts generated by Netskope. You may choose what alerts to receive with the alert_type parameter. You must provide start_time and end_time, or insertion_start_time and insertion_end_time. (Note that if end_time or insertion_end_time aren't provided. the date time would be set as now.) You cannot provide a combination of the options mentioned above.

  • netskope-client-list

    Get information about Netskope SCIM users. The command provides a list of users who have been imported into the Netskope tenant through SCIM integration. Users imported through other methods, such as manual CSV import or manual creation, will not be included in the returned results.

  • netskope-event-list

    Get events extracted from SaaS traffic. You may choose what events to receive with the event_type parameter. You must provide start_time and end_time, or insertion_start_time and insertion_end_time. (Note that if end_time or insertion_end_time aren't provided, the date time would be set as now.) You cannot provide a combination of the options mentioned above.

  • netskope-incident-dlp-list

    Fetch DLP incidents by update time. The maximum recommended time range should be no more from 3 days.

  • netskope-url-list-add

    Update the URL list with the values provided. Note that this command appends the list.

  • netskope-url-list-create

    Create a new URL list.

  • netskope-url-list-delete

    Delete a URL list by the list ID.

  • netskope-url-list-update

    Update the URL list with the values provided. Note that this command overrides the list.

  • netskope-url-lists-list

    Get all URL lists or a specific URL list by specifying the list ID.

  • update-remote-system

    Updates the remote incident or detection with local incident or detection changes. This method is only used for debugging purposes and will not update the current incident or detection.