Ctrlk
ProductBook a demoOpen app
linkedinyoutube
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Netskope

Connect Netskope to Radiant Security to forward alerts and events for AI triage.

Netskope is a security service edge (SSE) platform that protects users and data accessing cloud services, websites, and private applications against web threats, data exfiltration, and risky cloud activity. Connecting Netskope forwards alerts and events to Radiant Security through the Netskope REST API v2. Radiant uses the alerts and events for AI triage, giving analysts cloud and web activity context alongside other security telemetry.

At the end of this configuration, you provide Radiant Security with the following values:

  • Tenant URL

  • API token

Prerequisites

Generate an API token in Netskope

1

Enable the REST API

Sign in to the Netskope console with an admin account. Navigate to Settings > Tools > REST API v2. If the REST API toggle is off, click the Pencil button, enable the toggle, and click Save.

2

Create the token

Click New Token. Enter RadiantConnector as the Token Name and select 12 Months under Expire In.

If you set an expiration on the token, update the token value in the Radiant Security connector before it expires to prevent disruptions in data collection.

3

Grant endpoint access

Click Add Endpoint and select the following API endpoints:

  • All entries that start with /api/v2/events/dataexport/events

  • All entries that start with /api/v2/events/dataexport/alerts

  • /api/v2/incidents/uba/getuci

  • /api/v2/incidents/dlpincidents

  • /api/v2/events/data/alert

Under Privilege, select Read.

4

Copy the token

Click Save and copy the token shown in the popup. This is the only opportunity to copy the token. Store it securely.

Add the data connector in Radiant Security

  1. Sign in to Radiant Security.

  2. From the navigation menu, select Settings > Data Connectors and click + Add Connector.

  3. Search for and select Netskope API v2, then click Data Feeds.

  4. Under Select your data feeds, select Netskope API v2 and click Credentials.

  5. Under Credential Name, enter a descriptive name (e.g., Netskope Token).

  6. In the Tenant URL field, enter the URL you use to access the Netskope console (for example, https://companyName.goskope.com).

  7. In the API Token field, paste the token you generated in Netskope.

  8. Click Add Connector to save the configuration.

Verify ingestion

After Netskope begins forwarding, confirm alerts and events are reaching Radiant.

  1. In Radiant, navigate to Log Management.

  2. Filter by rs_connectorType:"netskope_api_v2".

  3. Confirm recent alerts and events appear.

Allow several minutes for alerts and events to be parsed, indexed, and available for search.

PreviousLinux Server LogsNextExecute Response Actions with Netskope

Last updated

Was this helpful?