- 19 Mar 2025
- 2 Minutes to read
- Print
- DarkLight
- PDF
Netskope
- Updated on 19 Mar 2025
- 2 Minutes to read
- Print
- DarkLight
- PDF
Netskope Security Cloud provides threat protection for cloud services, websites, and private applications.
Types of Assets Fetched
This adapter fetches the following types of assets:
Devices
Users
Application Extensions
User Extensions
SaaS Applications
Parameters
Netskope Domain (required) - The hostname of the Netskope server.
API Token (required) - Specify your account API key or an API token you have created.
Verify SSL - Select whether to verify the SSL certificate offered by the host supplied in Netskope Domain. For more details, see SSL Trust & CA Settings.
HTTPS Proxy (optional) - A proxy to use when connecting to Netskope Domain.
To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.
Advanced Settings
Note:
Advanced settings can either apply to all connections for this adapter, or to a specific connection. Refer to Advanced Configuration for Adapters.
Fetch mobile devices (required, default: True) - Choose whether to fetch mobile devices in addition to standard devices.
Fetch users from alerts less than X hours old (required, default: 0) - Set a number of hours to fetch alerts triggered by users created in the number of hours defined in the field. Note that the default value for this field is 0. If you do not enter a value in this field no users are fetched.
Fetch user UCI scores - Select this option to fetch user UCI scores. This setting only works when using the V2 API. Note that the API key must have read access to the
/api/v2/incidents/uba/getuci
API endpoint.Fetch the last seen date from events - By default (when this option is not selected) Axonius fetches the last seen date for this adapter from the 'last_event/timestamp' field. When you select this option it populates the Last Seen field with the latest event brought by the
/api/v1/events
endpoint withaccess_method
equalsaccess_method eq Client
andtype
equalsapplication
Do not ingest duplicates - Select this option so that the adapter will ignore assets with the same NS Device UID if any were ingested previously during the same fetch.
Use API V2 - Select this option to fetch data using the API V2.
Note:
To be able to fetch devices from API V2, you need to generate an API key with access to specific API endpoints. For more information, see Required Permissions below.
A PDEM license is required in order to use the ADEM endpoints in API V2. If you do not have this license, you can continue using API V1 to fetch device data.
Due to the structure of the API V2 endpoints, the device data is fetched in a time window. The adapter uses the "Ignore devices that have not been seen by the source in the last X hours" setting to define this window. If the setting is not configured it uses a default window of 10 days.
Ignore SaaS Applications Repository and parse all applications (Only for accounts with SaaS Management capabilities) - Select this option to ignore the SaaS Applications Repository and parse all apps found by the Netskope adapter.
Required Permissions
If using API V2, the following permissions are required:
Devices:
Recommended: /events/datasearch/clientstatus
If you have a PDEM license, the following API endpoints are optional (the above endpoint is still recommended):
/api/v2/adem/userlist
/api/v2/adem/users/device/getlist
/api/v2/adem/users/device/getdetails
Users and SaaS Apps/User Extensions (at least one of the below listed endpoints are recommended for more complete data):
events/dataexport/events/alert
events/dataexport/events/application
events/dataexport/events/audit
events/dataexport/events/connection
events/dataexport/events/incident
events/dataexport/events/infrastructure
events/dataexport/events/network
events/dataexport/events/page
events/dataexport/events/endpoint