Netskope Cloud Exchange (CE)

Hi,I have integrated a Syslog SIEM with the Cloud Exchange Log Shipper module, and everything is working fine. However, in the mapping file pushed to the SIEM, I’d like to include the User Group information from the alerts/events, and I can’t figure out how to do that.When I check the Mapping File Wizard to edit an existing mapping—or even when creating a new one—I can't find any “Netskope Field” that corresponds to the User Group attribute of the generated alerts/events. I need to send that attribute to the SIEM.Does anyone know how I can map it?Thanks in advance.Regards

Hellow, I'm experiencing the following issue: provisioning third-party users who use mcbook. Their accounts don't have email addresses and aren't part of the domain.I've tried everything but to no avail. Could someone tell me if this is possible?

Please let me know if there is another community thread for this issue, but I could not find one when searching.When I attempt to install CE v5.1.1, I get a failure for Docker and Podman because the installer cannot recognize the versions.  However, I have confirmed that these services are installed.  Do they need to exist in a specific file path in order for the installer to see them?

Hi All,While my team integrated Netskope with our SIEM, they struggled with understanding the properties and their usage. I’ve found out that Netskope Creating a tabular format view of all Alert and Event properties has been a game-changer for me and the community, especially for SIEM admins and IR analysts who are constantly looking at logs. By organizing the properties in a clear and structured manner, I can quickly identify key information, track changes, and make informed decisions. This approach not only improves efficiency but also ensures that important details are not overlooked.The impact of such a table is profound. It allows me to have a comprehensive overview of alerts and events, making it easier to spot patterns and correlations that might otherwise go unnoticed. This can lead to quicker response times and more effective problem-solving. Additionally, having all properties laid out in a tabular format aids in better communication among team members, as everyone has access

Can CIDR blocks be scraped and pushed to a Netskope URL list using the web scraper plugin for threat exchange? I have one setup to pull from the Proofpoint Emerging Threats IP block list (https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) but it seems to only push individual IPv4 addresses and ignores anything with a CIDR. 

Hello,We are ingesting Netskope logs via CE Log Shipper into Elastic. These are events and alerts. How can we ingest the Netskope client related events for users disabling/re-enabling the client? Advanced Analytics presents this information, so the logs exist. Can they be exported via CE Log Shipper?Thanks.

This blog series continues to explore a number of different workflows that those comfortable using basic scripting, or enablement tools like Postman, can employ to programmatically update and inform your inline policy actions. These are just some of the functions that the newest version of Cloud Exchange (CE), version 5.1, supports now and in the future. Look for it to hit the shelves at the end of this month (Oct. 2024). In case you missed it, we previously covered the general premise of our enhanced and net-new  integrations that map back to the Netskope risk exchange ecosystem, here. We also expanded on Making User-based Changes, be sure to check that out too. Combating Shadow ITNetskope has a unique ability to look deep into the packet (after we decrypt it) and see what is going on in between the user and the SaaS application they are using. In general it gives us the ability to put policy controls around which activities will be allowed with any given application. You can restrict

Dear Team,I am in the process of setting up Cloud Exchange, and the deployment has been successful, including access to the UI. However, I am encountering issues when attempting to add a tenant to the Cloud Exchange. The following errors appear in the logs:[CE_1045, CE_1044, CE_1126]I have reviewed the configuration and validated the tokens, but I am still unable to onboard the tenant.Could you please assist in troubleshooting this issue?Detailed Error: 09/10/2024 10:20:10 PM    CE_1045    error    Error occurred while validating v1 token, Exception occurred while parsing JSON response.Traceback (most recent call last):  File "/usr/local/lib/python3.9/site-packages/requests/models.py", line 971, in json    return complexjson.loads(self.text, **kwargs)  File "/usr/local/lib/python3.9/json/__init__.py", line 346, in loads    return _default_decoder.decode(s)  File "/usr/local/lib/python3.9/json/decoder.py", line 340, in decode    raise JSONDecodeError("Extra data", s, end)json.decoder.JS

When working with queues, you can send data in the message body.  A lot of questions come up while working with the map fields in CTO queues. In the below example, I am using the Notifier plugin but this same workflow is valid with all of the CTO plugins like ServiceNow, TEAMS, SLACK and others. I am not going to review how to setup the Notifier plugin but this link goes over it - https://docs.netskope.com/en/notifier-plugin-for-ticket-orchestrator/ Be sure to setup the Business Rules also.  Once you have the Notifier plugin up and running go to Alerts to review what information is coming in. We will use the key value pair to add information to the message we will send. Let’s grabActivity, Category, Policy, Request ID, Severity, and Site.   In the Que you are going to use you can add something like this to the message.  A Netskope Alert has been created with the following information:<br><br>    Activity: $activity<br>    Category: $category<br>    Policy: $poli

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

In Netskope we can integrate CrowdStrike in two ways: one way is Integration using Cloud exchange. and another way is integrating CS under Settings> Threat Protection> CS (EDR).So, what is difference between these two ways and which one is more effective? 

First of all, sorry if that sounds like a stupid question, but i did try to find a straight forward way online, and, all points to certain configurations via Cloud Exchange Plugins.Here is my szenario, it actually is fairly simple.I need to integrate a customers Netskope Environment (and no, I have no other details at this point as this is still exploratory) to a SIEM, the SIEM is not one of the big names. In most other cases, we have done Integrations either via an API that is available, via Storage Buckets, or, usually the most straight forward, via simple Syslog.Given this, aside from this link:  - are there other ways for Syslog integration? I found this one somewhere but i do not think this is still or ever was applicable? 2.1.1    Log in to the Netskope Admin Console:•    Open your web browser and navigate to the Netskope Admin Console.•    Enter your credentials to log in.2.1.2    Navigate to Settings:•    Once logged in, go to the Settings menu, usually found on the left sideba

HiI have deployed CE 5.0.1.  When ssh to CE, I can’t seem to “sudo su root”.  Likewise, can’t sudo reboot or shutdown.Anyway to perform reboot or shutdown beside asking esxi team to do it?thank

In the ever-evolving landscape of distributed computing, isolated security tool silos are no longer adequate.The combination of increasingly sophisticated cyberattacks and the shift of assets to a hybrid multi-cloud environment constitutes a significant challenge.Security and Risk Management (SRM) leaders seek to maximize the value of their current investments through the integration of security tools into a cohesive, scalable cybersecurity ecosystem.These leaders aim to enhance operational efficiency, alleviate the workload on their teams, and improve responsiveness to both security threats and business needs and opportunities.Netskope Cloud Exchange (CE) enables a collaborative ecosystem of tools and controls to secure a modern, distributed enterprise. It builds on a strategy of integrating composable, distributed security tools to achieve more effective collaboration between tools.Outcomes include enhanced capabilities like:Granular visibility into security events alerts and transac