Netskope Logs

Panther supports pulling logs directly from Netskope

Overview

Panther has the ability to fetch Netskope logs by querying the Netskope REST API v2.

How to onboard Netskope logs to Panther

You'll start creating the Netskope source in Panther, generate an API token in Netskope, then return to Panther to finish log source creation.

Step 1: Start creating a Netskope source in Panther

1. In the left-side navigation bar of your Panther Console, click Configure > Log Sources.

2. Click Create New.

3. Search for “Netskope,” then click its tile.

4. In the slide-out panel, click Start Setup.

5. Enter a descriptive Name for the source, e.g., "My Netskope logs."

6. Click Setup.

Step 2: Create an API token in Netskope

1. In a separate web browser tab, open the Netskope Admin Console.

2. In the left-side navigation bar, click Settings.

3. In the left-side navigation bar of the Settings page, click Tools > REST API v2.

4. Click New Token.

5. In the popup modal, configure the following fields:

   • Token Name: Enter a descriptive name.

   • Expire In: Set an appropriate expiration period.

   • Scope: Click Add Endpoint and select the /api/v2/events/dataexport/events/audit scope.

6. Click Save.

7. In the confirmation modal, click Copy Token and store the value in a secure location, as you will need it in the next step.

Step 3: Finish creating the Netskope source in Panther

1. Navigate back to the Panther Console, to the Set Credentials page where you left off after completing Step 1.

2. In the Netskope Domain field, enter the domain name of your Netskope tenant (e.g., corp.goskope.com).

3. In the API Key field, paste the API token value you copied from the Netskope Admin console in Step 2.

4. Click Setup. You will be directed to a success screen:

   

   • You can optionally enable one or more Detection Packs.

   • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

     

Panther-managed detections

See Panther-managed rules for Netskope in the panther-analysis GitHub repository.

Supported log types

Netskope.Audit

Netskope.Audit logs represent activity within a Netskope instance. For more information, see Netskope's Logging documentation.

schema: Netskope.Audit
description: Audit logs from the Netskope Audit API
referenceURL: https://docs.netskope.com/en/rest-api-v2-overview-312207.html
fields:
  - name: timestamp
    required: true
    description: The timestamp of the audit log.
    isEventTime: true
    timeFormats:
      - unix
    type: timestamp
  - name: type
    required: true
    description: The type of the audit log.
    type: string
  - name: user
    required: true
    description: The user associated with the audit log.
    type: string
    indicators:
      - email
      - username
  - name: is_netskope_personnel
    required: false
    description: Indicates whether the user is Netskope personnel.
    type: boolean
  - name: severity_level
    required: false
    description: The severity level of the audit log.
    type: int
  - name: audit_log_event
    required: true
    description: The event description of the audit log.
    type: string
  - name: supporting_data
    required: true
    description: Supporting data associated with the audit log.
    type: json
  - name: organization_unit
    required: false
    description: The organization unit associated with the audit log.
    type: string
  - name: ur_normalized
    required: false
    description: The normalized user identifier.
    type: string
  - name: count
    required: false
    description: The count of the audit log.
    type: int
  - name: _insertion_epoch_timestamp
    description: The timestamp of the log insertion.
    type: int
  - name: _id
    required: true
    description: The ID of the audit log.
    type: string
  - name: details
    description: The audit log details.
    type: json
  - name: ccl
    required: false
    description: The Cloud confidence level of the audit log.
    type: string
  - name: sAMAccountName
    required: false
    description: Active Directory sAMAccountName for the audit log.
    type: string
  - name: userPrincipalName
    required: false
    description: Active Directory userPrincipalName for the audit log.
    type: string