category: Analytics & SIEM
provider: Netskope
sectionorder:
- Connect
- Collect
commonfields:
  id: NetskopeEventCollector_v2
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API token
  hiddenusername: true
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: 'The maximum amount of events to retrieve PER EACH EVENT TYPE type. For more information about event types see the help section.'
  defaultvalue: '50000'
  display: Max events per fetch
  name: max_fetch
  section: Collect
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Events Fetch Interval
  additionalinfo: default fetch interval (This collector has an optimization feature that enables it to bring events as soon as possible if they exist).
  name: eventFetchInterval
  defaultvalue: "5"
  type: 19
  required: false
- display: Fetch Events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: 'true'
- display: Event Types To Fetch
  section: Collect
  name: event_types_to_fetch
  type: 16
  required: false
  additionalinfo: 'Event types to fetch. Default is all available types: Application, Alert, Page, Audit, Network, Incident.'
  defaultvalue: Application,Alert,Page,Audit,Network,Incident
  options:
  - Application
  - Alert
  - Page
  - Audit
  - Network
  - Incident
- display: Trust any certificate (not secure)
  section: Connect
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  section: Connect
  name: proxy
  type: 8
  required: false
description: Netskope Event Collector v2 integration.
display: Netskope Event Collector v2
name: NetskopeEventCollector_v2
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display the events.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The maximum number of alerts to return.
      name: limit
      defaultValue: 10
    - description: 'The start of the time window to fetch events for. Accepts a date (e.g. "2026-08-11T00:00:00Z"), a relative time (e.g. "3 days"), or a Unix epoch timestamp (e.g. 1786513755). If omitted, the command uses the instance''s last-run position.'
      name: start_time
    - description: 'The end of the time window to fetch events for. Accepts a date (e.g. "2026-08-12T00:00:00Z"), a relative time (e.g. "1 day"), or a Unix epoch timestamp (e.g. 1786600155). Only used when start_time is provided.'
      name: end_time
      defaultValue: now
    description: Returns events extracted from SaaS traffic and or logs. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    name: netskope-get-events
  dockerimage: demisto/auth-utils:1.0.0.10133006
  runonce: false
  script: '-'
  subtype: python3
  type: python
  isfetchevents: true
tests:
- No tests (auto formatted)
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
supportedModules:
- xsiam