Configuring Netskope Connectors

Connectors allow Stellar Cyber to collect data from external sources and add it to the data lake. There can be any number of Netskope connectors active.

To add a Netskope connector in Stellar Cyber:

  1. Add the Netskope connector in Stellar Cyber.
  2. Test the connector.
  3. Verify Ingestion.

Adding the Netskope Connector

With the configuration information handy, you can add the Netskope connector:

  1. Log in to Stellar Cyber.

  2. Click System | Integration | Connectors. The Connector Overview appears.

  3. Click Create. The General tab of the Add Connector screen appears. The information on this tab cannot be changed after you add the connector.

  4. Choose Web Security from the Category drop-down.

  5. Choose Netskope from the Type drop-down.

  6. Enter a Name. This field is required, and does not accept multibyte characters.

  7. Choose a Tenant Name. The Interflow records created by this connector include this tenant name.

  8. Choose the device to run the connector on.

  9. Click Next. The Configuration tab appears.

  10. Select the version of Netskope API that you want the connector to use.  (Netskope is deprecating their v1 API in 2023). This selection must correspond to the version associated with the version of the API token. Use the information below as a guide for selecting your Netskope endpoints when you create the token:

    • V2: For this version, the following endpoints are supported for the API token:

      • /api/v2/events/data/alert (supports data types: policy, dlp, watchlist)

      • / api/v2/events/data/application (supports data type application only)

      Example token configuration:

    • V1: For this version, you do not need to manage endpoints. The token allows the API to do the needed work without that granularity. Connectors configured for V1 in a previous version are automatically migrated to v4.3.5 or later.

  11. Enter the Netskope Tenant Name.

  12. Enter the API Key that you copied earlier.

  13. Enter the Interval (min). This is how often Stellar Cyber collects the logs.

  14. Choose the Content Type you want to collect.

  15. Click Next. The final confirmation tab appears.

  16. Click Submit.

  17. If you are adding rather than editing a connector with the Collect function enabled and you specified for it to run on a Data Processor, a dialog box now prompts you to add the connector to the default data analyzer profile. Click OK to add it, or Cancel to leave it out of the default profile.

    • This prompt only occurs during the initial create connector process when Collect is enabled.

    • Certain connectors can be run on either a Sensor or a Data Processor, and some are best run on one versus the other. In any case where the connector is run on a Data Processor, that connector must be included in a data analyzer profile. If you leave it out of the default profile, you must add it to another profile. If you do not have privileges to configure Data Analyzer profiles, a dialog displays recommending you ask your administrator to add it for you.

    • The first time you add a Collect connector to a profile, it pulls data immediately and then not again until the scheduled interval has elapsed. If the connector configuration dialog did not offer an option to set a specific interval, and it is run every five minutes. Exceptions to this default, internal interval are the Proofpoint (pulls data every 1 hour) and Azure Event Hub (continuously pulls data) connectors. The intervals for each connector are listed in the Connector Types & Functions topic.

    The Connector Overview appears.

The new connector is immediately active.

Testing the Connector

When you add (or edit) a connector, we recommend that you run a test to validate the connectivity parameters you entered. (The test validates only the authentication / connectivity; it does not validate data flow).

  1. Click System | Integration | Connectors. The Connector Overview appears.

  2. Locate the connector that you added, or modified, or that you want to test.

  3. Click the Test at the right side of that row. The test runs immediately.

    Note that you may run only one test at a time.

Stellar Cyber conducts a basic connectivity test for the connector and reports a success or failure result. A successful test indicates that you entered all of the connector information correctly. To aid troubleshooting your connector, the dialog remains open until you explicitly close it by using the X button. If the test fails, you can select the  button from the same row to review and correct issues. Repeat the test as needed.

ClosedDisplay sample messages...

Success !

Failure with summary of issue:

Show More example detail:

 

Verifying Ingestion

To verify ingestion:

  1. Click Investigate | Threat Hunting. The Interflow Search tab appears.
  2. Change the Index to Syslog. The table immediately updates to show ingested Interflow records.