netskope_api_v2

Netskope API v2 provides a powerful interface for managing and monitoring Netskope deployments. It enables users to retrieve alerts and events, manage URL lists, and control clients. With Netskope API v2, organizations can proactively respond to security threats, enforce web access policies, and efficiently administer their Netskope environment.

Category

Network Security

Pack

Netskope

Configuration parameters

• url — Server URL (required)
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• credentials — (required)
• first_fetch — First fetch timestamp
• max_fetch — Maximum incidents per fetch
• max_events_fetch — Maximum Netskope events per fetch. Max value is 200.
• max_dlp_incidents_fetch — Maximum Netskope DLP incidents per fetch. Max value is 200.
• fetch_events — Fetch Events
• fetch_dlp_incidents — Fetch DLP incidents
• event_types — Event types to fetch.
• alerts_query — Alerts Query
• events_query — Events Query
• incidentType — Incident type
• isFetch — Fetch incidents
• user_email — User Email
• incidentFetchInterval — Incidents Fetch Interval
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored XSOAR Incident
• close_netskope_incident — Close Mirrored Netskope Incident

Commands (13)

• get-mapping-fields — Returns the list of fields for an incident type.
• get-modified-remote-data — Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
• get-remote-data — Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
• netskope-alert-list — Get alerts generated by Netskope. You may choose what alerts to receive with the alert_type parameter. You must provide start_time and end_time, or insertion_start_time and insertion_end_time. (Note that if end_time or insertion_end_time aren't provided. the date time would be set as now.) You cannot provide a combination of the options mentioned above.
• netskope-client-list — Get information about Netskope SCIM users. The command provides a list of users who have been imported into the Netskope tenant through SCIM integration. Users imported through other methods, such as manual CSV import or manual creation, will not be included in the returned results.
• netskope-event-list — Get events extracted from SaaS traffic. You may choose what events to receive with the event_type parameter. You must provide start_time and end_time, or insertion_start_time and insertion_end_time. (Note that if end_time or insertion_end_time aren't provided, the date time would be set as now.) You cannot provide a combination of the options mentioned above.
• netskope-incident-dlp-list — Fetch DLP incidents by update time. The maximum recommended time range should be no more from 3 days.
• netskope-url-list-add — Update the URL list with the values provided. Note that this command appends the list.
• netskope-url-list-create — Create a new URL list.
• netskope-url-list-delete — Delete a URL list by the list ID.
• netskope-url-list-update — Update the URL list with the values provided. Note that this command overrides the list.
• netskope-url-lists-list — Get all URL lists or a specific URL list by specifying the list ID.
• update-remote-system — Updates the remote incident or detection with local incident or detection changes. This method is only used for debugging purposes and will not update the current incident or detection.