Netskope v2

LAST UPDATED: 03/22/2024

Overview

Netskope solutions, including Netskope Intelligent Security Service Edge (SSE) are built on the Netskope Security Cloud, providing unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. This integration leverages Netskope REST API v2.

D3 SOAR is providing REST operations to function with Netskope v2.

Netskope v2 is available for use in:

D3 SOAR	V16.8+
Category	Network Security
Deployment Options	Option II, Option IV

Connection

To connect to Netskope v2 from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The server URL of the Netskope instance.	https://alliances.goskope.com
API Token	The API Token for authentication.	********

Configuring Netskope v2 to Work with D3 SOAR

Please refer to REST API v2 Overview - Netskope Knowledge Portal for API tokens and token privileges.

Configuring D3 SOAR to Work with Netskope v2

Log in to D3 SOAR.
Find the Netskope v2 integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Netskope v2 in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Netskope v2.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your Server URL.
  2. Input the API Token.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tick box. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.

a. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.

b. Click OK to close the alert window.

c. Click + Add to create and add the configured connection.

Commands

Netskope v2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Netskope v2 API, please refer to the Netskope v2 API reference.

READER NOTE

Certain permissions are required for each command. Please refer to the Configuring Netskope v2 to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Add URLs To URL Lists

Adds URL(s) to the specified URL List(s).

READER NOTE

The parameter URL List IDs is required to run this command.

Run the Get URL Lists command to obtain URL List IDs. URL List IDs can be found in the returned raw data at the path $.[*]id.

A duplicate URL will not cause the command to fail, but it will not be added to the list again.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL list(s) where the URL(s) are appended. URL List IDs can be obtained using the Get URL Lists command.	[ 1 ]
URLs	Required	The URL(s) that will be appended into the URL List. No duplicated URLs will be added if the URL is already in the list.	[ "www.test_*****2.com" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "results": [
        {
            "id": 1,
            "name": "test-******",
            "data": {
                "urls": [
                    "www.test_*****1.com",
                    "www.test_*****2.com"
                ],
                "type": "exact",
                "json_version": 2
            },
            "modify_by": "Alliances Token - Do not Change",
            "modify_time": "2023-09-13",
            "modify_type": "Edited",
            "pending": 1
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "URLListIDs": "1",
    "URLListNames": "test-******", 
    "Pending": "1"
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URLs To URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad Request. Invalid host.

Error Sample Data

Add URLs To URL Lists failed.

Status Code: 400.

Message: Bad Request. Invalid host.

Apply Pending URL List Changes

Applies currently pending changes for URL lists.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

[
    {
        "id": 1,
        "name": "test-******",
        "data": {
            "urls": [
                "www.test_*****1.com"
            ],
            "type": "exact",
            "json_version": 2
        },
        "modify_by": "Alliances Token - Do not Change",
        "modify_time": "2023-09-13T00:00:00.000Z",
        "modify_type": "Edited",
        "pending": 0
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "URLListIDs": "1", 
    "URLListNames": "test-******",
    "Pending": "0"
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Apply Pending URL List Changes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Apply Pending URL List Changes failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Fetch Event

Returns alert(s) or event(s) from the Netskope platform based on specified criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start time of the time range to fetch alerts or events in UTC time.	2022-10-01 00:00
End Time	Required	The end time of the time range to fetch alerts or events in UTC time.	2022-10-06 00:00
Event Source	Required	The source of events. The available event source types are Alerts and Events. For Events, the available options are Application Events, Audit Events, Infrastructure Events, Network Events (network), and Page Events.	Alerts
Alert Type	Optional	Filters alerts by Alerts types. The available Alert types are Anomaly, Compromised Credential, Policy, Legal Hold, Malsite, Malware, DLP, Security Assessment Watchlist, Quarantine, Remediation and UBA. If not specified, alerts of any type will be returned. Please note, this parameter only applies to Alerts.	DLP
Acknowledged	Optional	Filters alerts by acknowledged status. If not specified, alerts of any acknowledged status will be returned. Please note, this parameter only applies to Alerts.	True
Query	Optional	The advanced filter to retrieve alerts or events. Please refer to Skope IT Query Language - Netskope Knowledge Portal for Skope IT Query Language syntax.	dstip in [31.*.., 182...*] and app ~ 'Erlang Solutions'
Number of Event(s) Fetched	Optional	The maximum number of the most recent alerts or events to fetch. The valid input value is an integer between 0 and 10000. If not specified, the default value is 100. If you need all alerts or events that match the search conditions to be returned, please set the value to 0.	10
Tolerance Scope	Optional	The tolerance scope (in minutes) for the query to fetch events between the specified start and end time to avoid event loss or fetch failure. The events will be fetched between {Start Time - Tolerance Scope, End Time}. The default value is 0.	0

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

No Sample Data

Return Data

Indicates one of the possible command execution states: Successful, Successful with No Event Data, or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Fetch Event Field Mapping

Please note that Fetch Event commands require event field mapping. Field mapping plays a key role in the data normalization process part of the event pipeline. Field mapping converts the original data fields from the different providers to the D3 fields which are standardized by the D3 Model. Please refer to Event and Incident Intake Field Mapping for details.

To customize field mapping, click + Add Field and add the custom field of your choice. You can also remove built-in field mappings by clicking x. Please note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

The Netskope v2 integration in D3 SOAR has some pre-configured field mappings for the events and alerts, which correspond to the Default Event Source and Event Mapping for Alert Event mappings:

mappings:

Default Event Source
Configures the field mapping which are specific to the events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. The default event source has a “Main Event JSON Path” (i.e., $.result) that is used to extract a batch of events from the response raw data. Click Edit Event Source to view the “Main Event JSON Path”.
- Main Event JSON Path: $.result
  The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
  For example, the root node of a JSON Path is result. The child node denoting the Unique Event Key field would be _id. Putting it together, the JSON Path expression to extract the Unique Event Key is $.result._id.
Event Mapping for Alert Event

Configures the field mapping which are specific to the alert events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. As the data of the alert events have a character that the value of the alert field is yes, the alert events can be defined by the Search String: {$.alert}=yes. Click Edit Event Source to view the Search String.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Default Event Source (Main Event JSON Path: $.result)
Unique Event Key	._id
Event Type	.type
Start Time	.timestamp
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
DvcIPAddress	.userip
App	.app
EventCategory	.category
EventCount	.count
URL	.url
HostFQDN	.domain
Hostname	.hostname
SourceTime	.src_time
Severity	.severity \|\| $.severity_level
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
DestinationPort	.dstport
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceCountry	.src_country
DestinationCountry	.dst_country
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
SourceLocation	.src_location
DestinationLocation	.dst_location
Activity	.activity
EventID	._event_id
Event Mapping for Alert Event (Search String: {$.alert}=yes) The search string format is {jsonpath}=value. If the value of the alert key is yes in the event object under raw data, then the alert events will use the field mapping below.
Unique Event Key	._id
Alert type	.alert_type
Event Type	.type
Start Time	.timestamp
Alert Name	.alert_name
Event code	._event_id
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
App	.app
App Category	.appcategory
EventCount	.count
URL	.url
Source Latitude	.src_latitude
Source Longitude	.src_longitude
Source Location	.src_location
Source Country	.src_country
Destination Latitude	.dst_latitude
Destination Longitude	.dst_longitude
Destination Location	.dst_location
Destination Country	.dst_country
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
Activity	.activity
Acknowledged	.acked
Correlation ID	._correlation_id
Event category	.category

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to execute query, please try again.

Error Sample Data

Fetch Event failed.

Status Code: 500.

Message: Failed to execute query, please try again.

Get URL List

Retrieves the configuration of the given URL list by URL ID(s).

READER NOTE

The parameter URL List IDs is required to run this command.

Run the Get URL Lists command to obtain URL List IDs. URL List IDs can be found in the returned raw data at the path $.[*]id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The ID(s) of the URL list(s) to obtain configuration information. URL List IDs can be obtained using the Get URL Lists command.	[ 1 ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "results": [
        {
            "id": 1,
            "name": "te***1",
            "data": {
                "urls": [
                    "www.t***.com",
                    "www.te*****-***.com"
                ],
                "type": "exact",
                "json_version": 2
            },
            "modify_by": "New V2 Token",
            "modify_time": "2023-08-07T11:16:04.000Z",
            "modify_type": "Edited",
            "pending": 0
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "URLListIDs": "1", 
    "URLListNames": "te***1",
    "Pending": "0"
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Get URL List failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Get URL Lists

Returns an array of URL list objects containing ID, name, URLs, type, modify type, modify by, modify time, and pending information.

Input

N/A

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

[
    {
        "id": 1,
        "name": "te***1",
        "data": {
            "urls": [
                "www.t***.com",
                "www.te*****-***.com"
            ],
            "type": "exact",
            "json_version": 2
        },
        "modify_by": "New V2 Token",
        "modify_time": "2023-08-07T11:16:04.000Z",
        "modify_type": "Edited",
        "pending": 0
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "URLListIDs": "1", 
    "URLListNames": "te***1",
    "Pending": "0"
}

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Get URL Lists failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Remove URLs From URL Lists

Removes URL(s) from the specified URL List(s).

READER NOTE

The parameter URL List IDs is required to run this command.

Run the Get URL Lists command to obtain URL List IDs. URL List IDs can be found in the returned raw data at the path $.[*]id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The ID of the URL list(s) from which the URL(s) will be removed. URL List IDs can be obtained using the Get URL Lists command.	[ 1 ]
URLs	Required	The URL(s) to be removed from the URL List.	[ "www.test_*****2.com" ]

Output

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "results": [
        {
            "id": 1,
            "name": "test-******",
            "data": {
                "urls": [
                    "www.test_*****1.com"
                ],
                "type": "exact",
                "json_version": 2
            },
            "modify_by": "Alliances Token - Do not Change",
            "modify_time": "2023-09-13T18:06:41.000Z",
            "modify_type": "Edited",
            "pending": 1
        }
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "URLListIDs": "1", 
    "URLListNames": "test**",
    "Pending": "0"
}

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration

The API returned an error message

No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URLs From URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Remove URLs From URL Lists failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.