Learn

Overview This guide shows how to stream Netskope alerts and events into Microsoft Sentinel.The connector is called Netskope Alerts & Events Connector (via Blob Storage). Netskope publishes it. It ingests alerts and events logs from Netskope Log Streaming into Microsoft Sentinel via Azure Blob Storage, using the Microsoft Sentinel Codeless Connector Framework (CCF).The data flow does not push logs straight into Sentinel. Netskope Log Streaming writes logs to an Azure Blob Storage container. Sentinel then reads those blobs and writes the records into the Log Analytics table NetskopeAlertEvents_CL.This article is based on the connector's own deployment template (netskope_alert_events_log_streaming.json). UIs in Netskope and Azure change over time, so verify each screen against current documentation as you go.How it works (architecture)The pipeline has three stages.Netskope Log Streaming sends Alerts & Events logs to an Azure Blob Storage container. Azure infrastructure signals new

OverviewA continuation of Sending Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform.The first article set up the Codeless Connector for a single Netskope tenant. This post extends it. It sends alerts and events from several Netskope tenants into one Microsoft Sentinel workspace, and it labels each record so you can tell the tenants apart.If you have not read the single-tenant article, start there. The base ideas carry over: the Codeless Connector Framework, the RBACv3 service-account token, and the REST API index. Architecture Each Netskope tenant sends alerts and events to the same connector. The connector posts the data to one Data Collection Endpoint. A separate Data Collection Rule for each tenant adds a TenantSource value and writes the record to the shared tables. The result: all tenants share the same tables, and the TenantSource column tells you which tenant a row came from.This template supports up to five tenants.What is different from the single-t

Hear from our security engineers as we share how Netskope moved beyond blanket restrictions to a more adaptive, context-aware approach that lets us safely say “yes” to SaaS and GenAI. We’ll highlight real-world patterns of risky usage, common blind spots across managed and unmanaged apps, and the unique data exposure risks posed by GenAI assistants and copilots. Learn how to:Discover and continuously assess SaaS and GenAI usage across your environment Protect sensitive data with granular, inline, and context-aware controls Apply consistent policies to managed, unmanaged, and AI-powered applications Partner with business stakeholders to securely accelerate SaaS and GenAI initiativesFor more information, check out our blog post.    View past events in this series! Check out some customer questions below, or feel free to comment and continue the discussion!  Q: Can you share best practices for GenAI apps control in RTP policy structure given new app connectors and capabilities?A: Discover

 This document outlines the integration of Netskope Web Transaction Logs with Microsoft Sentinel on Azure US Government cloud using the Codeless Connector Framework (CCF). Separate templates are provided for comma-delimited and space-delimited blob data. This native integration provides near real-time visibility for effective threat hunting and incident management. To configure Netskope Log Streaming to send logs to your Blob storage please go through the article: https://docs.netskope.com/en/stream-logs-to-azure-blob ⚠️ Important: You can't restrict network access to your Azure Blob Storage account as per the official guidance from Microsoft.🏗️ Integration Architecture OverviewThe integration leverages several Azure services to ensure reliable and scalable log delivery: Netskope to Azure Storage Blob: Netskope pushes Web Transaction Logs into a customer-owned Azure Storage Blob Container (as gzipped CSV files). Event Grid Notification: Every time a new file (blob) is written, an auto

Anthropic’s Claude has gone from "the AI tool a few teams were experimenting with" to mission-critical infrastructure: Developers ship code with Claude Code. Analysts build entire workflows on Claude Projects. Platform teams run inference at scale through the Claude Platform. But here's the uncomfortable question: Do you have the same security governance over Claude that you have over Slack, Google Workspace, or Salesforce? If the answer is "not yet" — this post is for you.Netskope has built an integration with the Claude Compliance API, giving security and compliance teams visibility into Claude usage directly within the Netskope One Platform. This brings Claude Enterprise and Claude Platform activity under the same security umbrella as every other application in your stack.No new tools. No separate dashboards. The same console your team already uses. Let me walk you through what this looks like — and more importantly, why it matters.The Problem: AI Apps Are the New Shadow IT When

Author: Stevan PierceDate: May 8, 2026Modern security teams are stuck in an old debate.The business wants ChatGPT, Copilot, Cursor, Gemini, and the next AI assistant your CEO sees demoed at a conference. The security team sees prompts full of source code and customer PII heading to a third-party model, an MCP server nobody vetted suddenly connecting to your data lake, and an "AI Overviews" toggle that quietly turned a sanctioned search engine into a generative assistant overnight.The instinct is to block. Block the domain. Block the category. Send a stern email.It doesn't work. Blocking a sanctioned AI assistant doesn't make the data exfiltration risk go away.  It just pushes the user to a personal account on their phone, where you have zero visibility. And the embedded AI in apps you've already approved? You can't block that without breaking the app.At Netskope, we faced this exact problem in our own environment. As Customer Zero, our security team not only secures Netskope but also p

In this 2 minute Ask SME Anything video you’ll discover how data lineage provides a visual roadmap of your data’s journey—revealing exactly how it moves, mutates, and who touches it along the way.Hear from Product Marketing Director, Ankur Chadda, as he explains how pairing lineage with your DLP strategy creates a powerhouse toolkit that ensures no data movement goes unnoticed.  

In this special edition of our Inside Netskope series, our internal leadership team will share our Fusion Team Framework. Hear how we integrated security architects into IT delivery cadences to resolve decision-right friction at Netskope, and the Metrics/Artifacts that validated our shift.Our CIO and CISO will cover: The Fusion Team Framework: An analysis of the shared charter and decision-rights model used to align CIO and CISO priorities Architectural Integration: A look at embedding security architects directly into IT delivery cadences to eliminate deployment friction Operational Metrics: A review of real-world data, including UAR cycle-time compression and SLA compliance for JML (Joiner/Mover/Leaver) processes Governance Artifacts: A deep dive into orphaned account remediation rates and the technical documentation powering the shift from theory to practice For more information, check out this article.    View past events in this series!

Objective: Develop a comprehensive guide for configuring SAML-based Single Sign-On (SSO) between PingFederate and the Netskope Admin Console.Overview: This documentation will outline the methodology for enabling secure administrative access to Netskope using PingFederate as the Identity Provider (IdP).Prerequisites: Netskope Tenant: Local administrator privileges are required to modify SAML settings within the Netskope console. PingFederate: Administrative access to the PingFederate environment to configure the Service Provider (SP) connection. Workflow:Step 1 - Click on Application button in the top barStep 2 - Once the application page loads, click on SP Connections.Step 3 - In the SP Connections, Click on Create Connection. A SP (Service Provider) Connection is a configuration set that allows PingFederate (acting as the Identity Provider or IdP) to securely communicate and share identity data with an external application or service.Step 4 - Select Do not use a template for this co

Objective: Develop a comprehensive configuration guide for SCIM provisioning between PingFederate and Netskope.Scope: This guide will detail the end-to-end process for automating user provisioning via the SCIM protocol.Prerequisites: Netskope: Administrative access to the local tenant is required to configure SCIM settings. PingFederate: Administrative privileges within the PingFederate environment to manage application integration. Workflow:Step 1 - Login to your PingFederate Application using your login credentials.Step 2 - If it's your first time login then you will be asked to reset your password. Else, continue to the next step.Step 3 - Once you login successfully, you will see the home screen. In the home screen, you will find all the required actions items. Step 4 - Now, before enabling the SCIM integration, we need a service account for the PingFederate application to communicate with the netskope tenant. Login to your tenant which needs to be integrated for SSO / SCIM. URL w

We have two major releases to announce for our ServiceNow ecosystem — the brand-new Netskope CMDB Integration app, now available on the ServiceNow Store, and version 3.0 of the Netskope SecOps (SIR) app, which brings significant new capabilities to security operations workflows.Whether you're an IT operations team looking to bridge your CMDB with Netskope's Zero Trust visibility, or a SOC team wanting richer incident response automation — there's something here for everyone. PART 1 — NEW APP Introducing the Netskope CMDB Integration AppThe Netskope CMDB Integration app is a first-of-its-kind release that connects Netskope's Security Service Edge (SSE) platform directly to ServiceNow's Configuration Management Database. This app is purpose-built for IT and security operations teams who want Netskope's asset, policy, and access data living natively within their ServiceNow CMDB — no custom scripts, no middleware, no manual exports.  1.  Private App Bidirectional SyncThe CMDB app supports

Hear from our security engineers as they demonstrate how CE's three integration pillars of Cloud Threat Exchange (CTE), Cloud Ticket Orchestrator (CTO), and Cloud Risk Exchange (CRE) connect Netskope to the tools we already rely on, turning isolated signals into coordinated, automated action.Learn how to: Automatically ingest curated threat feeds and STIX-formatted IOCs from Feedly's AI-powered intelligence engine and any TAXII-compliant source Bidirectionally share email-borne threat indicators from Mimecast and endpoint-detected IOCs from CrowdStrike Falcon Propagate AWS infrastructure threat findings from GuardDuty and supply chain risk signals from GitHub directly into Netskope's threat intelligence pipeline Feed Mimecast email threat signals into Netskope's User Confidence Index (UCI), dynamically adjusting cloud access policies For more information, check out our blog post.    View past events in this series! Check out some customer questions below, or feel free to comment

This is a demo covering how Netskope provides full visibility, control, and protection for genAI app usage. Learn more.

 This is a demo of the Netskope One Agentic Broker, which provides unified visibility and real-time protection for the autonomous AI ecosystem by decoding and securing Model Context Protocol (MCP) traffic between AI agents and data sources. Learn more about Netskope One Agentic Broker.

 Netskope One AI Guardrails provides real-time content moderation for every interaction, securing the enterprise against emerging AI-specific threats including prompt injection and jailbreak attempts, and unsafe use. Learn more.Netskope One AI Gateway secures the API traffic fueling your AI-powered applications. By centralizing authentication, traffic management, and content inspection between private apps and LLMs, we ensure autonomous agentic data flows remain governed and secure. Learn more.