Netskope

Netskope

This connector reads a Netskope Security Service Edge tenant through REST API v2: alerts and events (application, web page, network, incident, client status, endpoint DLP), the administrator audit log, user risk scores (UCI), Cloud Confidence Index lookups, URL lists, Private Access publishers and apps, and SCIM users and groups. It is read-only.

Setup

1. In the Netskope tenant open Settings > Tools > REST API v2 and create a new token (or use a service account under Settings > Administration > Administrators & Roles).
2. Add every endpoint the AI should use with Read privilege: /api/v2/events/datasearch/alert and the other /api/v2/events/datasearch/... types, /api/v2/events/data/audit, /api/v2/ubadatasvc/user/uci, /api/v2/services/cci/app, /api/v2/policy/urllist, /api/v2/infrastructure/publishers, /api/v2/steering/apps/private, /api/v2/scim/Users, /api/v2/scim/Groups. Set an expiry and copy the token into NETSKOPE_API_TOKEN. It is sent in the Netskope-Api-Token header.
3. NETSKOPE_TENANT is the host name of your tenant, e.g. example.goskope.com (EU tenants e.g. example.eu.goskope.com), without https:// or a path.
4. If the tenant uses an IP allowlist (Settings > Administration > IP Allowlist), add the outbound address of this AnythingMCP server. Install and run netskope_search_alerts to check the token.

Workflow

• Alerts: netskope_search_alerts with a time range (starttime, endtime in Unix seconds) and a query such as alert_type eq 'DLP' or severity eq 'high'; ask only for the fields you need. For counts use fields=count_total:count(_id) with groupbys (e.g. alert_name or user) and orderbys count_total desc.
• Events: netskope_search_events with event_type application, page, network, incident, clientstatus or epdlp, same parameters. Admin changes: netskope_list_audit_events.
• A user: netskope_get_user_risk_score (UCI, from_time in milliseconds), netskope_list_scim_users, netskope_list_scim_groups.
• An app: netskope_lookup_cloud_app needs the exact app name. Policies: netskope_list_url_lists, netskope_get_url_list. Private Access: netskope_list_publishers, netskope_list_private_apps.

Paging and limits: datasearch lists page with limit and offset; SCIM with startIndex (from 1) and count. Always set a time range on event searches: large tenants hold millions of events. Netskope rate-limits per endpoint (a few calls per second; 429 with Retry-After above that).

Errors: 401 or 403 means a wrong or expired token, or the endpoint was not added to the token with Read privilege. A datasearch call that fails reports status.execution FAILED with a message (e.g. an unknown field in query); this connector turns it into an error. A 404 on every call usually means a wrong NETSKOPE_TENANT.