Netskope v2

LAST UPDATED: AUG 22, 2025

Overview

Netskope solutions, including Netskope Intelligent Security Service Edge (SSE) are built on the Netskope Security Cloud, providing unrivaled visibility and real-time data and threat protection when accessing cloud services, websites, and private apps from anywhere, on any device. This integration leverages Netskope REST API v2.

D3 SOAR is providing REST operations to function with Netskope v2.

Netskope v2 is available for use in:

D3 SOAR	V16.8+
Category	Network Security
Deployment Options	Option II, Option IV

Connection

To connect to Netskope v2 from D3 SOAR, follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The server URL of the Netskope instance.	https://*****.goskope.com
API Token	The API Token for authentication.	********

Configuring Netskope v2 to Work with D3 SOAR

Refer to REST API v2 Overview - Netskope Knowledge Portal for API tokens and token privileges. Only authenticated users can access this page.

Configuring D3 SOAR to Work with Netskope v2

Log in to D3 SOAR.
Find the Netskope v2 integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Netskope v2 in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Netskope v2.
1. Connection Name: The desired name for the connection.
2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): The description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure Permissions: Defines which users have access to the connection.
8. Active: The checkbox that enables the connection to be used when selected.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your Server URL.
  2. Input the API Token.
10. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
11. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

b. Click OK to close the alert window.

c. Click + Add to create and add the configured connection.

Commands

Netskope v2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Netskope v2 API, refer to the Netskope v2 API reference. Only authenticated users can view the API reference.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose the desired date and time format, then click on the Save button.

The selected time format will now be visible when configuring Date/Time command input parameters.

Add URLs to URL Lists

Adds URLs to the specified URL lists.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists to which the URLs are added. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`
URLs	Required	The URLs to be added. If the URL is already in the list, it will not be added again.	JSON `[ "www.test_new102.com" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URLs to URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Bad Request. Invalid host.

Error Sample Data

Add URLs to URL Lists failed.

Status Code: 400.

Message: Bad Request. Invalid host.

Apply Pending URL List Changes

Applies currently pending changes for URL lists.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Apply Pending URL List Changes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Apply Pending URL List Changes failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Fetch Event

Retrieves alerts or events from the Netskope platform matching the specified criteria.

Input

Input Parameter	Required/Optional	Description	Example
Start Time	Required	The start of the time range (UTC) for retrieving alerts or events.	2022-10-01 00:00
End Time	Required	The end of the time range (UTC) for retrieving alerts or events.	2022-10-06 00:00
Event Source	Required	Returns alerts or events based on the source. Available options are: Alerts Application Events Audit Events Infrastructure Events Network Events Page Events	Alerts
Alert Type	Optional	Filters results by alert type. This parameter only applies to Alerts. Available options are: Anomaly Compromised Credential Policy Legal Hold Malsite Malware DLP Security Assessment Watchlist Quarantine Remediation UBA By default, all alerts regardless of their type are returned.	DLP
Acknowledged	Optional	The option to return only alerts that have been acknowledged when set to True. This parameter only applies to Alerts. By default, all alerts regardless of their acknowledge status are returned.	True
Query	Optional	Filters results using a query. Refer to Skope IT Query Language for the syntax.	dstip in [31.*.., 182...*] and app ~ 'Erlang Solutions'
Number of Event(s) Fetched	Optional	The maximum number of most recent alerts or events to return. Valid integers are between 0 and 10000. By default, the value is 100. To return all matching alerts or events, enter 0.	10
Tolerance Scope	Optional	The tolerance scope (in minutes) for the query to fetch events between the specified start and end time to avoid event loss or fetch failure. The events will be fetched between {Start Time - Tolerance Scope, End Time}. The default value is 0.	0

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

Fetch Event commands require event field mapping. Field mapping plays a key role for data normalization within the event pipeline. Field mapping converts the original data fields from the different providers to standardized D3 fields as defined by the D3 Model. Refer to Field Mappings for details.

To add a custom field, click on the + Add Field button. Users can also remove built-in field mappings by clicking x. Note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

The Netskope v2 integration in D3 SOAR has some pre-configured field mappings for events and alerts, which correspond to the Default Event Source and Event Mapping for Alert Event mappings:

Default Event Source
Configures the field mapping which are specific to the events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. The default event source has a “Main Event JSON Path” (i.e., $.result) that is used to extract a batch of events from the response raw data. Click Edit Main JSON Path to view the “Main Event JSON Path”.
- Main Event JSON Path: $.result
  The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
  For example, the root node of a JSON Path is result. The child node denoting the Unique Event Key field would be _id. Putting it together, the JSON Path expression to extract the Unique Event Key is $.result._id.
Event Mapping for Alert Event

Configures the field mapping which are specific to the alert events. If a source field in the field mapping is not found, the corresponding field mapping will be ignored. As the data of the alert events have a character that the value of the alert field is yes, the alert events can be defined by the Search String: {$.alert}=yes. Click Edit Event Source to view the Search String.

The pre-configured field mappings are detailed below:

Field Name	Source Field
Default Event Source (Main Event JSON Path: $.result)
Unique Event Key	._id
Event Type	.type
Start Time	.timestamp
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
DvcIPAddress	.userip
App	.app
EventCategory	.category
EventCount	.count
URL	.url
HostFQDN	.domain
Hostname	.hostname
SourceTime	.src_time
Severity	.severity \|\| $.severity_level
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
DestinationPort	.dstport
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceCountry	.src_country
DestinationCountry	.dst_country
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
SourceLocation	.src_location
DestinationLocation	.dst_location
Activity	.activity
EventID	._event_id
Event Mapping for Alert Event (Search String: {$.alert}=yes) The search string format is {jsonpath}=value. If the value of the alert key is yes in the event object under raw data, then the alert events will use the field mapping below.
Unique Event Key	._id
Alert type	.alert_type
Event Type	.type
Start Time	.timestamp
Alert Name	.alert_name
Event code	._event_id
Username	.user
SourceIPAddress	.srcip
DestinationIPAddress	.dstip
App	.app
App Category	.appcategory
Event category	.category
EventCount	.count
URL	.url
Source Latitude	.src_latitude
Source Longitude	.src_longitude
Source Location	.src_location
Source Country	.src_country
Destination Latitude	.dst_latitude
Destination Longitude	.dst_longitude
Destination Location	.dst_location
Destination Country	.dst_country
Operating system	.os
FileHashMD5	.md5
Filesize	.file_size
object	.object
ObjectCategory	.object_type
CloudConfidenceLevel	.ccl
CloudConfidenceIndex	.cci
SourceRegion	.src_region
DestinationRegion	.dst_region
EpochTimestamp	._insertion_epoch_timestamp
Browser	.browser
Activity	.activity
Acknowledged	.acked
Correlation ID	._correlation_id

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Fetch Event failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to execute query, please try again.

Error Sample Data

Fetch Event failed.

Status Code: 500.

Message: Failed to execute query, please try again.

Get URL List

Retrieves configuration details for one or more URL lists by their IDs.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists to retrieve. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL List failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Get URL List failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Get URL Lists

Returns an array of URL list objects containing ID, name, URLs, type, modify type, modify by, modify time, and pending information.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Get URL Lists failed.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.

Remove URLs From URL Lists

Removes one or more URLs from the specified URL lists.

READER NOTE

URL List IDs is a required parameter to run this command.

Run the Get URL Lists command to obtain the URL List IDs. URL List IDs can be found in the raw data at $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URL List IDs	Required	The IDs of the URL lists to from which URLs are removed. URL List IDs can be obtained using the Get URL Lists command.	JSON `[ ***** ]`
URLs	Required	The URLs to remove.	JSON `[ "www.test_new102.com" ]`

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URLs From URL Lists failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: No URL List found with ID 10000.

Error Sample Data

Remove URLs From URL Lists failed.

Status Code: 400.

Message: No URL List found with ID 10000.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Netskope v2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Unauthorized. Please check D3Error object in RawData for more details.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 401.

Message: Unauthorized. Please check D3Error object in RawData for more details.