Netskope Logs

Panther supports pulling logs directly from Netskope

Overview

Panther has the ability to fetch Netskope logs by querying the Netskope REST API v2.

How to onboard Netskope logs to Panther

You'll start creating the Netskope source in Panther, generate an API token in Netskope, then return to Panther to finish log source creation.

Step 1: Start creating a Netskope source in Panther

1. In the left-side navigation bar of your Panther Console, click Configure > Log Sources.

2. Click Create New.

3. Search for “Netskope,” then click its tile.

4. In the slide-out panel, click Start Setup.

5. Enter a descriptive Name for the source, e.g., "My Netskope logs."

6. Click Setup.

Step 2: Create API credentials in Netskope

1. In a separate web browser tab, open the Netskope Admin Console.

2. In the left-side navigation bar, click Settings.

3. In the left-side navigation bar of the Settings page, click Tools > REST API v2.

4. Click New Token.

5. In the popup modal, configure the following fields:

   • Token Name: Enter a descriptive name.

   • Expire In: Set an appropriate expiration period.

   • Scope: Click Add Endpoint and select the /api/v2/events/data/audit scope.

6. Click Save.

7. In the confirmation modal, click Copy Token and store the value in a secure location, as you will need it in the next step.

Step 3: Finish creating the Netskope source in Panther

1. Navigate back to the Panther Console, to the Set Credentials page where you left off after completing Step 1.

2. In the Netskope Domain field, enter the domain name of your Netskope tenant (e.g., corp.goskope.com).

3. In the API Key field, paste the API token value you copied from the Netskope Admin console in Step 2.

4. Click Setup. You will be directed to a success screen:

   

   • You can optionally enable one or more Detection Packs.

   • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

     

Panther-managed detections

See Panther-managed rules for Netskope in the panther-analysis GitHub repository.

Supported log types

Netskope.Audit

Netskope.Audit logs represent activity within a Netskope instance. For more information, see Netskope's Logging documentation.

schema: Netskope.Audit
description: Audit logs from the Netskope Audit API
referenceURL: https://docs.netskope.com/en/rest-api-v2-overview-312207.html
fields:
    - name: timestamp
      required: true
      description: The timestamp of the audit log.
      type: timestamp
      timeFormats:
        - unix
      isEventTime: true
    - name: type
      required: true
      description: The type of the audit log.
      type: string
    - name: user
      required: true
      description: The user associated with the audit log.
      type: string
      indicators:
        - email
        - username
    - name: is_netskope_personnel
      description: Indicates whether the user is Netskope personnel.
      type: boolean
    - name: severity_level
      description: The severity level of the audit log.
      type: int
    - name: audit_log_event
      required: true
      description: The event description of the audit log.
      type: string
    - name: supporting_data
      required: true
      description: Supporting data associated with the audit log.
      type: json
    - name: organization_unit
      description: The organization unit associated with the audit log.
      type: string
    - name: ur_normalized
      description: The normalized user identifier.
      type: string
    - name: count
      description: The count of the audit log.
      type: int
    - name: _insertion_epoch_timestamp
      required: true
      description: The timestamp of the log insertion.
      type: int
    - name: _id
      required: true
      description: The ID of the audit log.
      type: string