Netskope

Netskope is a SASE solution that provides data protection, and threat prevention across cloud apps, web traffic, and private applications. It helps organizations enforce policies, detect threats, and prevent data loss while ensuring compliance. For detailed information, refer to Netskope’s official documentation.

Integration Method: API
Tables: Detection Finding (2004), Network activity (4001)

This integration supports the following events.

This integration supports the following versions.

Prerequisites

• The user should have access to the Netskope console. 

• The user should have access to the DataBee console.

Configuration Overview

1. Create Role and API Token to fetch the data.

2. Create Netskope data feed in the DataBee console with the below parameter.

   DataBee Parameter	Netskope Parameter
   API Base URL (<instance>)	Instance URL
   Token	Token

Netskope Configuration

1. Login to the Netskope console. Extract the instance from the URL, it will be required for configuring the Data feed.
    

2. Clicking the Settings button, this will open the settings page in a new tab.
    

3. On the Settings page, click on the Administration from the navigation bar.
    

4. Then click on Administrators & Roles to open the Administrators & Roles Page.
    

5. On the Administrators & Roles page, click on Roles.

   

6. On the Roles tab, click New to create a new role.
    

7. On the New Role section

   1. Enter the Role Name and Role Short Description.

   2. Check Events and Analytics to enable fetching Alerts and Pages.

   3. Then click Save to create the role.

   

8. Click on the Administrators to navigate to the Administrators tab.
    

9. From the Administrators tab, click on Service Account to create a new Service Account Token.
    

10. To Create a Service Account Token

    1. Enter the Service Account Name.

    2. Select the Role that was created previously.

    3. Select the token expiration time, then click on Create.

    

11. Click on the Copy Token to copy the token to your clipboard.
     

    Note:

    Store the token in a secure location, as you will not be able to view it again.

DataBee Configuration

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.

   

2. Search for Netskope and click it as shown below.
    

3. Click on the API Ingest option for the collection method.
    

4. Enter feed contact information.

   

5. In the configuration page, confirm the following, then click on Submit.

   • Authorization Method: Bearer Token

   • API Base URL: This is the base URL that DataBee will interact with

     • Replace <instance> with your instance value.

   • Token: Paste the token generated earlier in the Netskope portal.

   • Event Types: Preselected for all the event types that integration pulls.
      

6. Click Submit & Deploy Production.
    

Troubleshooting Tips

• If you encounter an "Unauthorized" error, it may indicate that the authentication token has expired or malformed. In this case, regenerate the token to restore access. To prevent potential issues, consider pasting the token into a text editor to verify that there are no extra spaces or unexpected characters before reconfiguring the DataBee feed.