Sending Netskope AI SecOps Events to Microsoft Sentinel

Netskope AI SecOps can deliver Cases, User Risk, and AI Risk events to Microsoft Sentinel in near real time through Outbound Webhooks and the Azure Monitor Logs Ingestion API.

The AI SecOps connector is part of the Netskope Data connector (Netskopev2) solution in the Microsoft Sentinel Content Hub. With one click it deploys the Azure resources and the Microsoft Entra identity for you. This article walks through installing the connector, copying the generated values, configuring the webhook in Netskope AI SecOps, and querying the data.

What you will build

Prerequisites

• Workspace: read and write permissions on the Log Analytics workspace used by Microsoft Sentinel.
• Microsoft Entra: permission to create an app registration in Microsoft Entra ID. This typically needs the Application Developer role or higher.
• Microsoft Azure: permission to assign the Monitoring Metrics Publisher role on the data collection rule (DCR). This typically needs the Azure RBAC Owner or User Access Administrator role.
• Netskope AI SecOps admin console: a Netskope AI SecOps tenant with the Outbound Webhooks feature, and permission to configure an outbound event destination in your tenant's AI SecOps settings.

Values you will collect along the way

The connector page shows all of these values after deployment.

Step 1 — Deploy the connector in Microsoft Sentinel

1.1 Install the solution and open the connector

1. In Microsoft Sentinel, go to Content management > Content hub.
2. Search for Netskope and install (or update) the Netskope Data connector solution.
3. Go to Configuration > Data connectors and select Netskope AI SecOps.

1.2 Deploy the push connector resources

Click Deploy push connector resources. The connector then:

• Creates the NetskopeAISecOps_CL Log Analytics table.
• Creates a Data Collection Endpoint (DCE) and a Data Collection Rule (DCR).
• Creates a Microsoft Entra app registration, links the DCR to it, and sets the client secret.

When the deployment finishes, the status changes to Connected and the button changes to Revoke Access.

⚠️ Copy the values now, especially the client secret. The client secret is shown only once. Save it in a secret store before you leave or refresh the page. If you lose it, create a new secret on the app registration in Microsoft Entra ID (Certificates & secrets > New client secret) and copy the Value, not the Secret ID.

1.3 Copy the generated values

The connector page lists everything the Netskope webhook needs, in the same order as the webhook form in AI SecOps:

Note: The Token URL is generated for the Microsoft Entra authority of the Azure cloud your workspace is deployed in (commercial or Government), so copy it exactly as shown.

There is no shared or Netskope-provided client ID for this integration. The Client ID and Tenant ID belong to the app registration created in your own Entra tenant, so values copied from screenshots will not work in your environment.

Step 2 — Configure the webhook in AI SecOps

In your Netskope tenant, open AI SecOps → Configuration → Integrations → Outbound webhooks and create a webhook.

Connection tab

Events tab

Select the event types to deliver. All Cases, User Risk, and AI Risk types can share this single webhook — the table and parser handle every type.

Payload tab

Review & test tab

Step 3 — Test and verify

From Review & test, pick a real event type such as case.created and send a test. Prefer real event types over webhook.test: the synthetic test event carries no business fields and lands as a mostly empty row.

Allow a few minutes. Two timing behaviors are normal on a fresh setup: the first records into a new table take longer to appear, and DCR configuration changes take several minutes to reach the ingestion pipeline. Then query:

NetskopeAISecOps_CL

How the data is structured

Each webhook delivery is a JSON array. Each element is an envelope with delivery metadata at the top level and the actual event under data:

[

{

"id": "evt_...",

"timestamp": "2026-07-02T19:30:00Z",

"tenant_id": "1234",

"region": "us-west-2",

"api_version": "2026-08-01",

"type": "case.created",

"data": { "case_id": "case_01HXYZ", "severity": "high", "...": "..." }

}

]

The table stores the envelope in five typed columns and the event whole in Data:

Columns marked * stay dynamic. Reach inside them with dot notation: FileLineage.files[0].md5, DataConfidence.score, RiskIndicators.policy_alerts. Fields not present on a given event type are null — filter with isnotempty().

Troubleshooting

Maintenance

Client secret expiry. The client secret created by the connector expires on the date set at creation. Check the expiry in Microsoft Entra ID (App registrations > the app created by the connector > Certificates & secrets). Rotate it before it expires: create a new client secret, update the webhook's Client secret field in AI SecOps, verify a test delivery, then remove the old secret in Entra. An expired secret stops deliveries without any error visible on the Azure side.

Revoking access. To stop the integration, click Revoke Access on the connector page, and delete or disable the outbound webhook in AI SecOps.