Collect logs for Netskope

Collection overview

Sumo Logic provides a collector agent which pulls logs from Netskope with API calls. You can configure the list of events and alerts to be collected, but by default all events and alerts are collected.

The events and alerts  are then forwarded to Sumo Logic’s HTTP endpoint in JSON format. The configuration from a yaml file, which is stored in home directory, is used. By default the collection starts from last 7 days, but this setting is also configurable.

The Netskope App has the following components:

• Application Usage: Insights into application usage; specifically by devices, users, users and traffic patterns.
• Security Alerts: Visibility into Netskope security alerts and violations and the ability to identify effects of a breach.  

Step 1: Add a Hosted Collector and HTTP Source

This section demonstrates how to add a hosted Sumo Logic collector and HTTP Logs and Metrics source, to collect events for Netskope

Step 2: Getting a token from the Netskope Portal

Netskope REST APIs use an auth token to make authorized calls to the API. This section demonstrates how to obtain a token from the Netskope user interface (UI).

To obtain a Netskope auth token, do the following:

1. Login to Netskope as the Tenant Admin.
2. Go to the API portion of the Netskope, Settings > Tools > Rest API.
3. Copy the existing token to your clipboard, or you can generate a new token and copy that token.

Step 3: Configuring a Sumo Logic Netskope collector

This section provides walkthrough instructions that demonstrate how to configure a Sumo Logic Netskope collector.

To create a Sumo Logic Netskope collector, do the following:

1. Login to a Linux machine.
2. Install the collector using the following command. 

pip install sumologic-netskope-collector

3. Create a configuration file netskope.yaml in the home directory and  the enter the SUMO_ENDPOINT and TOKEN as shown in the following example, replacing the <netskope domain> variable with your Netskope portal domain.

SumoLogic:
 SUMO_ENDPOINT: <SUMO LOGIC HTTP URL>

Netskope:
 TOKEN: <NETSKOPE API TOKEN>
 NETSKOPE_EVENT_ENDPOINT: <netskope domain>/api/v1/events
 NETSKOPE_ALERT_ENDPOINT: <netskope domain>/api/v1/alerts

5. Create a cron job  to run the collector every 5 minutes, (use the crontab -e option) and add the following line:

*/5 * * * *  /usr/bin/python -m sumonetskopecollector.netskope > /dev/null 2>&1

Sample log message

{
           "dstip": "74.125.239.150",
           "dst_location": "Mountain View",
           "app": "Google Gmail",
           "_insertion_epoch_timestamp": 1547391690,
           "site": "Google Gmail",
           "src_location": "Pomerol",
           "organization_unit": "",
           "object_type": "Mail",
           "id": 3764,
           "app_session_id": 4252577042,
           "category": "Webmail",
           "dst_region": "California",
           "userkey": "Tanja.Barton@kkrlogistics.com",
           "dst_country": "US",
           "src_zipcode": "33500",
           "ur_normalized": "tanja.barton@kkrlogistics.com",
           "type": "nspolicy",
           "object": "Welcome Novak Dimitrov",
           "srcip": "77.194.46.1",
           "dst_latitude": 37.405991,
           "timestamp": 1547400222,
           "src_region": "Gironde",
           "dst_longitude": -122.078514,
           "alert": "no",
           "to_user": "ns-india@microsoft.com, hrglobal@microsoft.com",
           "user": "Tanja.Barton@kkrlogistics.com",
           "from_user": "bloomberg@bloomberg.com",
           "device": "Windows PC",
           "org": "kkrlogistics.com",
           "src_country": "FR",
           "traffic_type": "CloudApp",
           "dst_zipcode": "N/A",
           "count": 2,
           "src_latitude": 44.9333,
           "url": "https://mail.google.com/",
           "page_id": 2641483218,
           "sv": "unknown",
           "ccl": "excellent",
           "cci": 92,
           "activity": "Send",
           "userip": "127.0.0.1",
           "src_longitude": -0.2,
           "_id": "5df996d5b66a9ea963e812ce",
           "os": "Windows 8",
           "browser": "Internet Explorer",
           "appcategory": "Webmail"
       }
   ]
}

Query sample

The following query sample was is from the Total Sessions panel of the Application Overview Dashboard.

_sourceCategory="netskope_events" "no" "nspolicy"
| json "_id", "alert", "type", "srcip", "dstip", "appcategory", "app", "os", "user", "device", 
"acked", "site", "timestamp", "ccl", "activity", "browser", "object", "object_type", "from_user", 
"to_user", "app_session_id" as alert_id, is_alert, type, src_ip, dest_ip, appcategory, app, os, 
user, device, acked, site, timestamp, ccl, activity, browser, object, object_type, from_user, 
to_user, app_session_id  nodrop
| where is_alert="no" and type="nspolicy"
| count by app_session_id
| count