Event

Overview

Get a list of all or filtered events.

Configuration

Parameters

• Domain (netskopeDomain)

• Index (netskopeIndex) - The index parameter in the Netskope API for Data Export is used to:

  • Uniquely identify an export session.

  • Prevent multiple API consumers from overlapping their collections.

  • Allow incremental paging without losing events.

Secrets

• NetskopeApiToken refers to the API Token used to authenticate the connection to Netskope.

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Netskope API Alerts fields, or simply paste the desired YAML.

Configure as YAML

Alert

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: false
collectionPhase:
  paginationType: "cursor"
  cursorSelector: ".timestamp_hwm"
  initialRequest:
    method: GET
    url: "https://${parameters.domain}/api/v2/events/dataexport/events/alert?index=${parameters.netskopeIndex}&operation=${temporalWindow.from}"
    headers:
      - name: Accept
        value: application/json
      - name: Netskope-Api-Token
        value: "${secrets.netskopeApiToken}"
  nextRequest:
    method: GET
    url: "https://${parameters.domain}/api/v2/events/dataexport/events/alert?operation=next&index=${parameters.netskopeIndex}"
    headers:
      - name: Accept
        value: application/json
      - name: Netskope-Api-Token
        value: "${secrets.netskopeApiToken}"
  output:
    select: ".result"
    map: "."
    outputMode: element 

Application

Audit

Incident

Infrastructure

Network

Page

Manually Configure

Temporal Window

Toggle ON to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

• Duration - 5 minutes (5m) as default, adjust based on your needs.

• Offset - 5m

• Format - Epoch

Authentication Phase

OFF

Enumeration Phase

OFF

Collection Phase

• Pagination Type* - cursor

• Cursor Selector* - .timestamp_hwm

• Initial Request

  • Method* - GET

  • URL* - https://${parameters.domain}/api/v2/events/dataexport/events/INSERT NAME FROM YAML?index=${parameters.netskopeIndex}&operation=${temporalWindow.from}

  • Headers -

    • Name - Accept

    • Value - application/json

    • Name - Netskope-Api-Token

    • Value - ${secrets.netskopeApiToken}

  Next Request

  • Method* - GET

  • URL* - https://${parameters.domain}/api/v2/events/dataexport/events/INSERT NAME?operation=next&index=${parameters.netskopeIndex}

  • Headers -

    • Name - Accept

    • Value - application/json

    • Name - Netskope-Api-Token

    • Value - ${secrets.netskopeApiToken}

  • Body type* - there is no required body type because the parameters are included in the URL. However, these fields are mandatory, so select raw and enter the {} placeholder.

• Output

  • Select - .result

  • Map - .

  • Output Mode - element

Click Create labels to move on to the next step and define the required Labels if needed.