Overview:
Netskope is a cloud-based device which is added to the UI using an API call. This document will help you with the steps to ingest the Netskope with Seceon SIEM to have better visibility of threats happening in your environment.
Steps Of Integration
To add Netskope support, Follow the steps that are mentioned below.
On UI navigate to
>>Inside respective tenant >>Provisioning >> Add on devices >>Add on Configuration
You will get a list of cloud devices, select Netskope
Enter the name of the device
Enter the CCE IP
Refer REST API v1 Overview section as mentioned in https://docs.netskope.com/en/rest-api-v1-overview.html to generate the Token ID
Now enter the Tenant Name in Access ID/user name and generated Token ID in the password/Secret Key section
Now valid JSON Format in the last field, no need to put JSON ( only Add- {} )
Click on the Save button
Verification
Go to the System tab in the Logs/Flow Collection tab, and check the Netskope in the Device Name column.