Netskope v2

LAST UPDATED: DECEMBER 10, 2025

Overview

Netskope solutions, including Netskope Intelligent Security Service Edge (SSE) are built on the Netskope Security Cloud, providing unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. This integration leverages Netskope REST API v2.

D3 SOAR is providing REST operations to function with Netskope v2.

Netskope v2 is available for use in:

D3 SOAR	V16.8+
Category	Network Security
Deployment Options	Option II, Option IV

Connection

To connect to Netskope v2 from D3 SOAR, follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The server URL of the Netskope instance.	https://*****.goskope.com
API Token	The API Token for authentication.	********

Configuring Netskope v2 to Work with D3 SOAR

Refer to REST API v2 Overview - Netskope Knowledge Portal for API tokens and token privileges. Only authenticated users can access this page.

Configuring D3 SOAR to Work with Netskope v2

Log in to D3 SOAR.
Find the Netskope v2 integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Netskope v2 in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Netskope v2.
1. Connection Name: The desired name for the connection.
2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): The description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure Permissions: Defines which users have access to the connection.
8. Active: The checkbox that enables the connection to be used when selected.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your Server URL.
  2. Input the API Token.
10. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

b. Click OK to close the alert window.

c. Click + Add to create and add the configured connection.

Commands

Netskope v2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Netskope v2 API, refer to the Netskope v2 API reference. Only authenticated users can view the API reference.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose the desired date and time format, then click on the Save button.

The selected time format will now be visible when configuring Date/Time command input parameters.

Add URLs to URL Lists

Adds one or more entries to an existing URL list. The list may be used as an allow list or a block list based on its associated category and policy. Supporting entry formats include URLs, domains, paths, or IP addresses.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists to which the URLs are added. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`
URLs	Required	The entries to be added. Each entry can be a full URL, domain, path, or IP address. If the URL is already in the list, it will not be added again.	JSON `[ "www.test_new102.com" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URLs to URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad Request. Invalid host.

Error Sample Data

Add URLs to URL Lists failed.

Status Code: 400.

Message: Bad Request. Invalid host.

Apply Pending URL List Changes

Applies currently pending changes for URL lists.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Apply Pending URL List Changes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Apply Pending URL List Changes failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Fetch Event

Retrieves alerts or events from the Netskope platform matching the specified criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start of the time range (UTC) for retrieving alerts or events.	2022-10-01 00:00
End Time	Required	The end of the time range (UTC) for retrieving alerts or events.	2022-10-06 00:00
Event Source	Required	Returns alerts or events based on the source. Available options are: Alerts Application Events Audit Events Infrastructure Events Network Events Page Events	Alerts
Alert Type	Optional	Filters results by alert type. This parameter only applies to Alerts. Available options are: Anomaly Compromised Credential Policy Legal Hold Malsite Malware DLP Security Assessment Watchlist Quarantine Remediation UBA By default, all alerts regardless of their type are returned.	DLP
Acknowledged	Optional	The option to return only alerts that have been acknowledged when set to True. This parameter only applies to Alerts. By default, all alerts regardless of their acknowledge status are returned.	True
Query	Optional	Filters results using a query. Refer to Skope IT Query Language for the syntax.	dstip in [31.*.., 182...*] and app ~ 'Erlang Solutions'
Number of Event(s) Fetched	Optional	The maximum number of most recent alerts or events to return. Valid integers are between 0 and 10000. By default, the value is 100. To return all matching alerts or events, enter 0.	10
Tolerance Scope	Optional	The tolerance scope (in minutes) for the query to fetch events between the specified start and end time to avoid event loss or fetch failure. The events will be fetched between {Start Time - Tolerance Scope, End Time}. The default value is 0.	0

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

See Field Mappings.

The Netskope v2 system integration includes pre-configured field mappings for the default event source.

The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data.

The Main Event JSON Path can be viewed by clicking on the Edit Main JSON Path button.

Main Event JSON Path: $.result
The result array contains the event objects. Within each event object, the key _id denotes the Unique Event Key field. As such, the full JSONPath expression to extract the Unique Event Key is $.result._id.
Event Source for Alert Event
The D3 system configures the field mappings which are specific to the alert-related events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. Because the alert field in the raw data for alert events consistently has the value yes, these events can be identified by the Search String: {$.alert}=yes. Click Edit Event Source to view the Search String.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Default Event Source (Main Event JSON Path: $.result)
Unique Event Key	._id
Event Type	.type
Start Time	.timestamp
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
DvcIPAddress	.userip
App	.app
EventCategory	.category
EventCount	.count
URL	.url
HostFQDN	.domain
Hostname	.hostname
SourceTime	.src_time
Severity	.severity \|\| $.severity_level
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
DestinationPort	.dstport
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceCountry	.src_country
DestinationCountry	.dst_country
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
SourceLocation	.src_location
DestinationLocation	.dst_location
Activity	.activity
EventID	._event_id
Event Mapping for Alert Event (Search String: {$.alert}=yes) The search string format is {jsonpath}=value. If the value of the alert key is yes in the event object under raw data, then the alert events will use the field mapping below.
Unique Event Key	._id
Alert type	.alert_type
Event Type	.type
Start Time	.timestamp
Alert Name	.alert_name
Event code	._event_id
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
App	.app
App Category	.appcategory
Event category	.category
EventCount	.count
URL	.url
Source Latitude	.src_latitude
Source Longitude	.src_longitude
Source Location	.src_location
Source Country	.src_country
Destination Latitude	.dst_latitude
Destination Longitude	.dst_longitude
Destination Location	.dst_location
Destination Country	.dst_country
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
Activity	.activity
Acknowledged	.acked
Correlation ID	._correlation_id

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to execute query, please try again.

Error Sample Data

Fetch Event failed.

Status Code: 500.

Message: Failed to execute query, please try again.

Get URL List

Retrieves configuration details for one or more URL lists by their IDs.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists to retrieve. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Get URL List failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Get URL Lists

Retrieves all configured URL lists in Netskope. A URL list can function as an allow list or a block list depending on their associated category and policy. Entries may include full URLs, domains, paths, or IP addresses.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Get URL Lists failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Remove URLs From URL Lists

Removes specified entries (URL, path, domain, or IP) from a URL list. The list may be used as an allow list or a block list depending on its associated category and policy.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists from which URLs are removed. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`
URLs	Required	The entries to be removed. Each entry can be a full URL, domain, path, or IP address.	JSON `[ "www.test_new102.com" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URLs From URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Remove URLs From URL Lists failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.