# Netskope Events Alert

This data pipeline extracts the Alert events from Netskope technology using the data export API.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FS7cIYLJaNL3HOAVPnacf%2F2025-05-16_16-12-36.png?alt=media&#x26;token=cd2925e4-2d1f-4710-88f4-b742a764657a" alt=""><figcaption></figcaption></figure>

This Pipeline integrates with Logs from the Netskope Platform using the [**HTTP Pull** Listener](https://docs.onum.com/the-workspace/listeners/listener-integrations/pull-data-from-http-endpoints), transforming it from JSON to CSV format.

## Listen

The Listener pulls events using the **Configure as YAML** option, using the following YAML:

```
withTemporalWindow: true
temporalWindow:
  duration: 5h
  offset: 5h
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: none
  request:
    method: GET
    url: "..."
    headers:
      - name: Accept
        value: application/json
      - name: Netskope-Api-Token
        value: "XXX"
  output:
    select: ".result"
    map: "."
    outputMode: element
```

{% hint style="info" %}
See the article dedicated to setting up Netskope API event alerts [here](https://docs.onum.com/marketplace/falcon-onum-marketplace/pulling-pipelines/netskope-events-alert).
{% endhint %}

## Transform Netskope data

### Parser

The parser extracts the individual fields coming from the Netskope JSON into more detailed fields, including status, data and index.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FrME4KsGHSD8S9Fc5SZVE%2Fdark-large%20(25).png?alt=media&#x26;token=82a4506e-5c2a-496d-ad20-f1237ba17ec7" alt=""><figcaption></figcaption></figure>

### Flat JSON

We need to flatten the incoming JSON into key-value pairs that can be sent on in the CSV.

<figure><img src="https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FCXTZU2gRE5zGJmJUv7Xf%2Fdark-large%20(26).png?alt=media&#x26;token=906154eb-60c9-4026-901c-7508879c6306" alt=""><figcaption></figcaption></figure>

### Message Builder

We use the [**Message Builder**](https://docs.onum.com/the-workspace/pipelines/actions/formatting/message-builder) Action to transform the fields to CSV format, using a comma as the delimiter.&#x20;

You can now send on your CSV containing OKTA logs to your preferred destination using a sink.