Netskope Help

General

timestamp

Timestamp when the event/alert happened. Event timestamp in Unix epoch format.

Integer

1443811033

Y

Y

Y

General

_insertion_epoch_timestamp

Insertion timestamp

Integer

1485025255

Y

Y

Y

General

src_timezone

Source timezone. Shows the long format timezone designation.

String

America/Los_Angeles

Y

Y

Y

General

dst_timezone

Destination timezone

String

America/New_York

Y

Y

Y

General

type

Shows if it is an application event or a connection event. Application events are recorded to track user events inside a cloud app. Connection events shows the actual HTTP connection.

String

Value for Application Events: nspolicy

Value for Page Events: connection

Values for Alerts: nspolicy, connection, breach, anomaly, malsite

Y

Y

Y

General

access_method

Cloud app traffic can be steered to the Netskope cloud using different deployment methods such as Client (Netskope Client), Secure Forwarder etc. Administrators can also upload firewall and/or proxy logs for log analytics. This field shows the actual access method that triggered the event.

For log uploads this shows the actual log type such as PAN, Websense, etc.

String

Client, Secure Forwarder, API Connector, Proxy Chaining, Reverse Proxy

Y

Y

Y

General

traffic_type

Type of the traffic: CloudApp or Web. CloudApp indicates CASB and web indicates HTTP traffic. Web traffic is only captured for inline access method. It is currently not captured for Risk Insights.

String

CloudApp, Web

Y

Y

Y

General

action

Action taken on the event for the policy

String

useralert, Detection, bypass, block, alert, restrictToView, disableDownload, legalHold, expireLink, restrictAccess, delete, quarantine

Y

Y

Y

General

fromlogs

Shows if the event was generated from the Risk Insights log.

String

yes

Y

Y

Y

General

user_generated

Tells whether it is user generated page event

Boolean

yes, no

N

Y

Y

General

tunnel_id

Shows the Client installation ID. Only available for the Client steering configuration.

String

c5b07447-e86e-4722-b59e-81144

Y

Y

Y

General

request_id

Unique request ID for the event

Integer

1,590

Y

N

Y

General

transaction_id

Unique ID for a given request/response

String

1843244978932892112

Y

Y

Y

General

connection_id

Each connection has a unique ID. Shows the ID for the connection event.

LongInt

117073088998365

Y

Y

Y

General

conn_duration

Duration of the connection in milliseconds. Useful for querying long-lived sessions.

Integer

59000

Y

Y

Y

General

conn_starttime

Connection start time

Float

1480330369

N

Y

Y

General

conn_endtime

Connection end time

Float

1480330428

N

Y

Y

General

latency_min

Min latency for a connection in milliseconds

Integer

47

N

Y

Y

General

latency_max

Max latency for a connection in milliseconds

Integer

651

N

Y

Y

General

latency_total

Total latency from proxy to app in milliseconds

Integer

3797

N

Y

Y

General

req_cnt

Total number of HTTP requests (equal to number of transaction events for this page event) sent from client to server over one underlying TCP connection.

Integer

21

Y

Y

Y

General

resp_cnt

Total number of HTTP responses (equal to number of transaction events for this page event) from server to client

Integer

21

Y

Y

Y

General

http_transaction_count

HTTP transaction count

Integer

300

N

Y

Y

General

numbytes

Total number of bytes that were transmitted for the connection - numbytes = client_bytes + server_bytes

Integer

18177

Y

Y

Y

General

client_bytes

Total number of bytes uploaded from client to server

Integer

1093

Y

Y

Y

General

server_bytes

Total number of downloaded from server to client.

Integer

17084

Y

Y

Y

General

suppression_key

To limit the number of events. Example: Suppress block event for browse

String

2019-01-07_1135.zip

Y

N

Y

General

suppression_start_time

When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.

Integer

1443811033

Y

Y

Y

General

suppression_end_time

When events are suppressed (like collaboration apps), then the suppression end time will be set and only one event will be send with suppression start time and end time and count of occurrence.

Integer

1443811078

Y

Y

Y

General

count

Number of raw log lines/events sessionized or suppressed during the suppressed interval.

Integer

1

Y

Y

Y

General

bypass_traffic

Tells if traffic is bypassed by Netskope

Boolean

yes, no

N

Y

Y

General

ssl_decrypt_policy

Applicable to only bypass events. There are 2 ways to create rules for bypass:

The existing flag bypass_traffic only gives information that a flow has been bypassed, but does not tell exactly which policy was responsible for it. ssl_decrypt_policy field will provide this extra information. In addition, policy field will be also set for every Bypass event.

String

yes, no

N

Y

Y

General

dynamic_classification

URLs were categorized by NSURLC machine or not

String

yes, no

N

N

Y

General

dst_geoip_src

Source from where the location of Destination IP was derived

Integer

1

Y

Y

Y

General

src_geoip_src

Source from where the location of Source IP was derived

Integer

2

Y

Y

Y

General

modified

Timestamp corresponding to the modification time of the entity (file, etc.)

DateTime

2017-01-17T08:56:05

Y

Y

Y

Alert

alert

Indicates whether alert is generated or not.

Populated as yes for all alerts.

String

yes, no

Y

Y

Y

Alert

alert_name

Name of the alert

String

proximity, rare_event, risky_country, user_shared_credentials,

data_exfiltration, mlad

Y

Y

Y

Alert

alert_type

Type of the alert

String

Values for Alerts: watchlist, policy, DLP, Legal Hold, quarantine, Malware, malsite, anomaly, Compromised Credential, Security Assessment 

Values for App Events: policy, DLP, quarantine, Legal Hold, Malware, Security Assessment, Remediation

Y

Y

Y

Alert

acked

Whether user acknowledged the alert or not

Boolean

false, true

Y

Y

Y

Alert

severity

Severity used by watchlist and malware alerts

String

low, medium, high, unknown, null

Y

Y

Y

Alert

severity_id

Severity ID used by watchlist and malware alerts

Integer

1, 2, 3, null

Y

N

Y

Alert

policy_id

The Netskope internal ID for the policy created by an admin

Integer

1, 8

Y

N

Y

Alert

policy

Name of the policy configured by an admin

String

PCI Files in OneDrive

Y

Y

Y

Alert

profile_emails

List of profile emails per policy

String

["dlp_policy@netskope.com"]

Y

N

Y

Alert

justification_reason

Justification reason provided by user.

For following policies, justification events are raised. User is displayed a notification popup, user enters justification and can select to proceed or block:

String

Provided reason

Y

N

Y

Alert

justification_type

Type of justification provided by user when user bypasses the policy block

String

falsePositive, justification

Y

N

Y

Application

app

Specific cloud application used by the user (e.g. app = Dropbox).

String

Google Drive

Y

Y

Y

Application

appcategory

Application Category as designated by Netskope

String

Collaboration, Customer Relationship Management, Cloud Storage, IaaS/PaaS

Y

Y

Y

Application

ccl

Cloud Confidence Level. CCL measures the enterprise readiness of the cloud apps taking into consideration those apps security, auditability and business continuity.

Each app is assigned one of five cloud confidence levels: excellent, high, medium, low, or poor. Useful for querying if users are accessing a cloud app with a lower CCL.

String

excellent, high, medium, low, poor, unknown, not_defined

Y

Y

Y

Application

site

For traffic_type = CloudApp, site = app and for traffic_type = Web, it will be the second level domain name + top-level domain name. For example, in "www.cnn.com", it is "cnn.com".

String

cnn.com

Y

Y

Y

Application

url

URL of the application that the user visited as provided by the log or data plane traffic

String

www.evernote.com/shard/s2 31/notestore

Y

Y

Y

Application

page

The URL of the originating page

String

www.google.co.in/search?q=

railway

Y

Y

Y

Application

domain

Domain value. This will hold the host header value or SNI or extracted from absolute URI.

String

google.co.in

Y

Y

Y

Application

sessionid

Populated by Risk Insights

Integer

34014529

Y

Y

Y

Application

app_session_id

Unique App/Site Session ID for traffic_type = CloudApp and Web.

An app session starts when a user starts using a cloud app/site on and ends once they have been inactive for a certain period of time(15 mins). Use app_session_id to check all the user activities in a single app session. app_session_id is unique for a user, device, browser and domain.

String

1.42333E+14

Y

Y

Y

Application

referer

Referer URL of the application(with http) that the user visited as provided by the log or data plane traffic

String

https://portal.office.com/Admi nPortal/Home

Y

Y

Y

Application

managed_app

Whether or not the app in question is managed

Boolean

yes, no

Y

N

Y

Application

telemetry_app

Typically SaaS app web sites use web analytics code within the pages to gather analytic data.

When a SaaS app action or page is shown, there is subsequent traffic generated to tracking apps such as doubleclick.net, Optimizely, etc. These tracking apps are listed if applicable in the

Telemetry App field.

String

doubleclick, Amazon S3, google, Microsoft Office 365 Suite, Adswizz, fbcdn

Y

N

Y

Application

instance_id

Unique ID associated with an organization application instance

String

nammazone.com

Y

N

Y

Application

instance

Instance associated with an organization application instance

String

nammazone.com

Y

Y

Y

Application

instance_name

Instance name associated with an organization application instance

String

netskope.com

Y

N

Y

Application

instance_type

Instance type

String

VirtualPrivateCloud, Server, Image, Document, Managed

Instance, LoadBalancer

Y

N

Y

Application

object

Name of the object which is being acted on. It could be a filename, folder name, report name, document name, etc.

String

Resume.doc

Y

Y

Y

Application

object_id

Unique ID associated with an object

String

3214

Y

N

Y

Application

object_type

Type of the object which is being acted on. Object type could be a file, folder, report, document, message, etc.

String

File, User, Note

Y

N

Y

Application

from_object

Initial name of an object that has been renamed, copied or moved

String

test1

Y

N

Y

Application

to_object

Changed name of an object that has been renamed, copied, or moved

String

test2

Y

N

Y

Application

object_count

Displayed when the activity is Delete. Shows the number of objects being deleted

Integer

3

Y

N

Y

Application Specific

enterprise_id

EnterpriseID in case of Slack for Enterprise

String

E8D23NJ1H

Y

N

Y

Application Specific

enterprise

Enterprise name in case of Slack for Enterprise

String

Netskope enterprise

Y

N

Y

Application Specific

workspace_id

Workspace ID in case of Slack for Enterprise

String

TDFHG3CLF

Y

N

Y

Application Specific

workspace

Workspace name in case of Slack for Enterprise

String

Netskope workspace

Y

N

Y

Application Specific

team

Slack team name

String

Netskope team

Y

N

Y

Application Specific

channel

Channel of the user for slack and slack enterprise apps

String

channel1

Y

N

Y

Application Specific

sub_type

Workplace by Facebook post sub category (files, comments, status etc)

String

file, comment, post

Y

N

Y

Application Specific

violating_user

User who caused a vioaltion. Populated for Workplace by Facebook

String

example@netskope.com

Y

N

Y

Application Specific

violating_user_type

Category of the user who caused a violation. Populated for Workplace by Facebook.

String

Internal, External

Y

N

Y

Application Specific

logintype

Salesforce login type

String

Remote Access 2.0, Other Apex API, Remote Access Client

Y

N

Y

Application Specific

loginurl

Salesforce login URL

String

my.salesforce.com

Y

N

Y

Application Specific

new_value

New value for a given file for salesforce.com

String

2019-01-18 3:33:58

Y

N

Y

Application Specific

old_value

Old value for a given file for salesforce.com

String

2019-01-17 3:33:58

Y

N

Y

Application Specific

scopes

List of permissions for google apps

String

["https://www.googleapis.com

/auth/cloud-platform", "https://www.googleapis.com/ auth/userinfo.email"]

Y

N

Y

Application Specific

session_id

Session ID for Dropbox application

Integer

1.77573E+14

Y

N

Y

Application Specific

user_role

Roles such as admin, owner etc for Box

String

Admin, coadmin, user

Y

N

Y

Application Specific

role

Roles for Box

String

Editor, Previewer, Previewer Uploader, Uploader, Viewer, Viewer Uploader, Owner, Co- owner

Y

N

Y

Activity

activity

Description of the user performed activity

String

Download, Invite, Issue, Join, Login Attempt, Login Failed, Login Successful, Logout, Mark, Markup, Move, Upload, View, View All

Y

Y

Y

Activity

activity_type

Displayed when only admins can perform the activity in question

String

Admin

Y

N

Y

Activity

act_user

User doing an activity

String

user@netskope.com

Y

N

Y

Activity

activity_status

Displayed when the user is denied access while performing some activity

String

Access Denied

Y

N

Y

Activity

Url2Activity

Populated if the activity from the URL matches certain activities. This field applies to Risk Insights only.

String

Yes

Y

N

Y

Activity

ns_activity

Maps app activity to Netskope standard activity.

String

Download, Upload, view, unlock

Y

N

Y

Activity

audit_category

The subcategories in an application such as IAM, EC in AWS, login, token, file, etc., in case of Google.

String

IAM, Lambda, S3, access, Compute Engine, Elasticloadbalancing, EC2, event_change, acl_change

Y

N

Y

Activity

audit_type

The sub category in audit according to SaaS / IaaS apps

String

download, edit, create, view, HeadBucket

Y

N

Y

User

userkey

User ID or email

String

user@netskope.com

Y

Y

Y

User

user_id

User email

String

user@netskope.com

Y

N

Y

User

user

User email

String

user@netskope.com

Y

Y

Y

User

user_name

Name of user

String

TestUser

Y

N

Y

User

ur_normalized

All lower case user email

String

user@netskope.com

Y

Y

Y

User

user_normalized

All lower case user email

String

user@netskope.com

N

N

Y

User

userip

IP address of User

String

xxx.xxx.xxx.xx

Y

Y

Y

User

useragent

Browser HTTP user agent header

String

Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0)

Gecko/20100101

Firefox/50.0

Y

Y

Y

User

user_category

Type of user in an enterprise - external / internal

String

Internal

Y

N

Y

User

organization_unit

Org Units for which the event correlates to. This ties to user information extracted from Active Directory using the Directory Importer/AD Connector application.

String

Maximum of 5 levels: "OU1/OU2/OU3/OU4/OU5"

Y

Y

Y

User

org

Search for events from a specific organization. Organization name is derived from the user ID.

String

sampleorganization.org

Y

Y

Y

User

os

Operating system of the host who generated the event.

String

Yosemite

Y

Y

Y

User

os_version

OS version of the host

String

Windows 7

Y

Y

Y

User

browser

Shows the actual browser from where the cloud app was accessed.

String

BlackBerry, Chrome, Firefox, iCab, Mobile, MSIE, Native, Opera, RockMelt, Safari, Skyfire, Tencent, Thunderbird

Y

Y

Y

User

browser_version

Browser version

String

50

Y

Y

Y

User

browser_session_id

Browser session ID. If there is an idle timeout of 15 minutes, it will timeout the session.

LongInt

75256867583232

Y

Y

Y

User

device

Device type from where the user accessed the cloud app. It could be Macintosh Windows device, iPad etc.

String

Android Device, iOS Device. iPad, iPhone, Linux Device, Mac Device, Windows Device, Other Device

Y

Y

Y

User

device_classification

Designation of device as determined by the Netskope Client as to whether the device is managed or not.

String

managed, not configured, unknown, unmanaged

Y

N

Y

User

hostname

Host name

String

example's Macbook Pro

Y

Y

Y

User

nsdeviceuid

Device identifiers on macOS and Windows

String

zndbgI=

Y

N

Y

User

managementID

Management ID

String

FFD2E8A

Y

N

Y

Source

srcip

IP address of source/user

String

xxx.xxx.xxx.xx

Y

Y

Y

Source

src_location

User's city as determined by the Maxmind or IP2Location Geodatabase

String

San Jose

Y

Y

Y

Source

src_region

Source state or region as determined by the Maxmind or IP2Location Geodatabase

String

California

Y

Y

Y

Source

src_latitude

Latitude of the user as determined by the Maxmind or IP2Location Geodatabase

Integer

[xx.xxxx]

Y

Y

Y

Source

src_longitude

Longitude of the user as determined by the Maxmind or IP2Location Geodatabase

Integer

[-xxx.xxx]

N

Y

N

Source

src_country

User's country's two-letter Country Code as determined by the Maxmind or IP2Location Geodatabase

String

US

Y

Y

Y

Source

src_zipcode

Source zip code as determined by the Maxmind or IP2Location Geodatabase

String

95134

Y

Y

Y

Destination

dstip

IP address where the destination app is hosted

String

xxx.xxx.xxx.xx

Y

Y

Y

Destination

dst_location

Application's city as determined by the Maxmind or IP2Location Geodatabase

String

Mountain View

Y

Y

Y

Destination

dst_region

Application's state or region as determined by the Maxmind or IP2Location Geodatabase

String

California

Y

Y

Y

Destination

dst_latitude

Latitude of the Application as determined by the Maxmind or IP2Location Geodatabase

Integer

[xx.xxxx]

Y

Y

Y

Destination

dst_longitude

Longitude of the Application as determined by the Maxmind or IP2Location Geodatabase

Integer

[-xxx.xxx]

N

Y

N

Destination

dst_country

Application's two-letter country code as determined by the Maxmind or IP2Location Geodatabase

String

US

Y

Y

Y

Destination

dst_zipcode

Application's zip code as determined by the Maxmind or IP2Location Geodatabase

String

94043

Y

Y

Y

Destination

dstport

Destination port

Integer

443, 80 (1-65535)

Y

Y

Y

Destination

dsthost

Destination host

String

mail.yahoo.com

Y

Y

Y

Introspection

retro_scan_name

Retro scan name

String

Retro_Scan_box_netskope.com_20181213_1616

Y

Y

Y

Introspection

scan_type

Generated during retroactive scan or new ongoing activity

String

Ongoing, ongoing, retroactive, Retroactive

Y

N

Y

File

file_id

Unique identifier of the file

String

0B3jELp0mSNw2dTZDNUhpUGpjUGgxQUY5OUZI

Y

N

Y

File

filename

Name of the file

String

PandasDFTests.py

Y

N

Y

File

title

Title of the file

String

PandasDFTests.py

Y

Y

Y

File

mime_type

MIME type of the file

String

application/pdf

Y

N

Y

File

data_type

Content type of upload/download

String

application/xml

Y

Y

Y

File

md5

md5 of the file

String

295a6f156624f73c31a9a670

d9a41914

Y

Y

Y

File

file_size

Size of the file in bytes

Integer

22854

Y

N

Y

File

file_type

File type

String

text/plain, application/pdf, etc.

Y

Y

Y

File

file_lang

Language of the file

String

SWEDISH

Y

Y

Y

File

path_id

Path ID of the file in the application

Integer

3.94218E+11

Y

N

Y

File

file_path

Path of the file in the application

String

/sample/file.pdf

Y

N

Y

File

owner

Owner of the file

String

example@netskope.com

Y

N

Y

File

original_file_path

If the file is moved, then keep original path of the file in this field

String

29208ee0-021e-4cb2-87b4-c9303880

Y

N

Y

File

from_user

Email address used to login to the SAAS app

String

example@netskope.com

Y

N

Y

File

from_user_category

Type of from_user

String

Internal, External

Y

N

Y

File

to_user

Used when a file is moved from user A to user B. Shows the email address of user B

String

example@netskope.com

Y

N

Y

File

to_user_category

Type of user to which move is done

String

Internal, External

Y

N

Y

File

shared_with

Array of emails with whom a document is shared with

String

[aaaa@netskope.com,nnnn@netskope.com,dddd@netskope.com]

Y

Y

Y

File

shared

If the file is shared or not

Boolean

true, false

Y

N

Y

File

shared_type

Shared Type

String

internal, external, private, enterprise

Y

N

Y

File

shared_domains

List of domains of users the document is shared with

String

[netskope.com, yahoo.com]

Y

N

Y

File

exposure

Exposure of a document

String

private, public, public_on_web, enterprise, external, internal, anyone_with_link

Y

Y

Y

File

attachment

File name

String

image001.png

Y

N

Y

File

encrypt_failure

Reason of failure while encrypting

String

Failed getting encryption Key

Y

N

Y

File

log_file_name

Log file name for Risk Insights

String

20190205T0917_0.csv.gz

Y

Y

Y

File

file_passwd_protected

Tells if the file is password protected

Boolean

TRUE

Y

N

Y

File

web_url

File preview URL

String

https://drive.google.com/open?id=1234

Y

N

Y

File

external_collaborator_count

Count of external collaborators on a file/folder. Supported for some apps.

Integer

4

Y

Y

Y

File

internal_collaborator_count

Count of internal collaborators on a file/folder. Supported for some apps.

Integer

3

Y

N

Y

File

total_collaborator_count

Count of collaborators on a file/folder. Supported for some apps.

Integer

7

Y

N

Y

DLP

dlp_incident_id

Incident ID associated with sub-file. In the case of main file, this is same as the parent incident ID.

LongInt

146831431522000

Y

Y

Y

DLP

dlp_parent_id

Incident ID associated with main container (or non-container) file that was scanned

LongInt

146831431522000

Y

Y

Y

DLP

dlp_file

File/Object name extracted from the file/object

String

Credit Report.pdf

Y

N

Y

DLP

dlp_profile

DLP profile name

String

DLP-PCI

Y

Y

Y

DLP

dlp_rule

DLP rule that triggered

String

Name-Credit Card (CC)

Y

Y

Y

DLP

dlp_rule_count

Count of rule hits

Integer

5

Y

Y

Y

DLP

dlp_rule_severity

Severity of rule

String

Low, Medium, High, Critical

Y

Y

Y

DLP

dlp_fingerprint_classification

Fingerprint classification

String

Senstive Customer Information, PII

Y

N

Y

DLP

dlp_fingerprint_match

Fingerprint classification match file name

String

Top_100_Existing_Accounts_11_1_18.xlsx

Y

N

Y

DLP

dlp_fingerprint_score

Fingerprint classification score

Integer

0-100

Y

N

Y

DLP

dlp_rule_score

DLP rule score for weighted dictionaries

Integer

13

Y

N

Y

DLP

dlp_is_unique_count

True or false depending upon if rule is unique counted per rule data

Boolean

true, false

Y

Y

Y

DLP

dlp_unique_count

Integer value of number of unique matches seen per rule data. Only present if rule is uniquely counted.

Integer

10

Y

N

Y

Quarantine

quarantine_file_id

File ID of the quarantined file

String

435bd35a-e021-4a2c-bc41-ba281f91

Y

N

Y

Quarantine

quarantine_profile_id

Quarantine profile ID

Integer

2

Y

N

Y

Quarantine

quarantine_profile

Quarantine profile name of policy for quarantine action

String

Quarantine Data – OneDrive

Y

N

Y

Quarantine

quarantine_failure

Reason of failure

String

Quarantine failed; file transfer failure

Y

N

Y

Quarantine

quarantine_action_reason

Reason for the action taken for quarantine

String

Previously quarantined file still blocked because admin decision is pending

Y

N

Y

Quarantine

q_admin

Quarantine profile custodian email/name

String

example@netskope.com

Y

N

Y

Quarantine

q_app

Quarantine app name

String

Box

Y

N

Y

Quarantine

q_instance

Quarantine instance name

String

Box Production

Y

N

Y

Quarantine

q_original_filename

Original file name which got quarantined

String

Sensitive File

Y

N

Y

Quarantine

q_original_filepath

Original file path which got quarantined

String

All/Folder1/Folder2

Y

N

Y

Quarantine

q_original_shared

Original file shared user details

String

Private

Y

N

Y

Quarantine

q_original_version

Original version of file which got quarantined

String

1

Y

N

Y

Quarantine

quarantine_file_name

File name of the quarantine file

String

sensitivefile.txt

Y

N

Y

Legal Hold

legal_hold_profile_name

Legal hold profile name

String

Legal hold Test Profile

Y

N

Y

Legal Hold

lh_custodian_email

Custodian email of legal hold profile

String

example@netskope.com

Y

N

Y

Legal Hold

lh_custodian_name

Custodian name of legal hold profile

String

Kelly Oar

Y

N

Y

Legal Hold

lh_dest_app

Destination appname of legalhold action

String

Box

Y

N

Y

Legal Hold

lh_dest_instance

Destination instance of legal hold action

String

Box Production

Y

N

Y

Legal Hold

lh_fileid

File ID of legal hold file

String

3.97035E+11

Y

N

Y

Legal Hold

lh_filename

File name of legal hold file

String

Sensitive file_v1_2016-04-2707-00-15(UTC)

Y

N

Y

Legal Hold

lh_filepath

File path of legal hold file

String

All/Folder1/Folder2

Y

N

Y

Legal Hold

lh_original_filename

Original filename of legal hold file

String

Sensitive File

Y

N

Y

Legal Hold

lh_shared

Shared type of legal hold file

String

Internal

Y

N

Y

Legal Hold

lh_shared_with

User shared with the legal hold file

String

["example1@netskope.com", "example2@netskope.com"]

Y

N

Y

Legal Hold

lh_version

File version of original file

String

1

Y

N

Y

Anomaly

orig_ty

Event Type of original event

String

nspolicy, connection

N

Y

Y

Anomaly

last_timestamp

Last timestamp (timestamp in the first/older event). Applies to only proximity anomaly alert.

LongInt

1549296669

N

Y

Y

Anomaly

last_app

Last application (app in the first/older event). Applies to only proximity anomaly alert.

String

Facebook

N

Y

Y

Anomaly

last_device

Last device name (Device Name in the first/older event). Applies to only proximity anomaly alert.

String

Windows Device

N

Y

Y

Anomaly

last_country

Last location (Country). Applies to only proximity anomaly alert.

String

US

N

Y

Y

Anomaly

last_location

Last location (City). Applies to only proximity anomaly alert.

String

Chicago

N

Y

Y

Anomaly

last_region

Applies to only proximity anomaly alert.

String

Pennsylvania

N

Y

Y

Anomaly

download_app

Applicable to only data exfiltration. Download App (App in the download event).

String

Google Gmail

N

N

Y

Anomaly

shared_credential_user

Applicable to only shared credentials.

User with whom the credentials are shared with.

String

Michael Sam

N

N

Y

Anomaly

threshold_time

Applicable to: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type. Threshold Time

LongInt

Default time (86400 Seconds)

N

N

Y

Anomaly

bin_timestamp

Applicable to only: Shared Credentials, Data Exfiltration, Bulk Anomaly types( Bulk Upload/Download/Delete) and Failed Login Anomaly type.

Bin TimeStamp (is a window used that is used for certain types of anomalies - for breaking into several windows per day/hour).

LongInt

1549411200

N

N

Y

Anomaly

threshold

Threshold (Count at which the anomaly should trigger). Applicable to Bulk Anomaly types( Bulk Upload/ Download/ Delete) and Failed Login Anomaly type

Integer

205

N

Y

Y

Anomaly, MLAD

event_type

Anomaly type

String

App Events: Info, error Alerts: proximity, rare_event, risky_country, user_shared_credentials, data_exfiltration, bulk_upload, bulk_download, mlad

Y

Y

Y

Anomaly, MLAD

profile_id

Anomaly profile ID

String

NS_101 which means proximity alert

NS_103, NS_102, NS_307, NS_306, NS_304, NS_303, NS_305, NS_301, NS_403, NS_401

Y

Y

Y

Anomoly, MLAD

risk_level_id

This field is set by both role-based access (RBA) and MLAD

Integer

1,2,0

N

Y

Y

Anomoly, MLAD

risk_level

Corresponding field to risk_level_id. Name

String

low, med, high

Y

Y

Y

Malsite

malicious

Only exists if some HTTP transaction belonging to the page event resulted in a malsite alert.

Boolean

TRUE

Y

Y

Y

Malsite

malsite_active

Since how many days malsite is Active

Integer

2

N

N

Y

Malsite

malsite_as_number

Malsite ASN Number

String

AS35838 CCANet Limited

N

N

Y

Malsite

malsite_confidence

Malsite confidence score

Integer

100

N

N

Y

Malsite

malsite_consecutive

How many times that malsite is seen

Integer

1

N

N

Y

Malsite

malsite_category

Category of malsite [ Phishing / Botnet / Malicous URL, etc. ]

String

["Malcious Site"]

Y

N

Y

Malsite

malsite_country

Malsite country

String

US

N

N

Y

Malsite

malsite_region

Region of the malsite URL/IP/Domain

String

Texas

N

N

Y

Malsite

malsite_city

Malsite city

String

Los Angeles

N

N

Y

Malsite

malsite_dns_server

DNS server of the malsite URL/Domain/IP

String

xxx.xxx.com

N

N

Y

Malsite

malsite_first_seen

Malsite first seen timestamp

Integer

1485302400

N

N

Y

Malsite

malsite_hostility

Malsite hostility score

Integer

5

N

N

Y

Malsite

malsite_ip_host

Malsite IP

String

xxx.xxx.x.xxx

N

N

Y

Malsite

malsite_isp

Malsite ISP info

String

CCANET Limited

N

N

Y

Malsite

malsite_longitude

Longitude plot of the Malsite URL/IP/Domain

Float

x.xxxx

N

N

Y

Malsite

malsite_latitude

Latitude plot of the Malsite URL/IP/Domain

Float

xx.xxx

N

N

Y

Malsite

malsite_last_seen

Malsite last seen timestamp

Integer

1486339200

N

N

Y

Malsite

malsite_reputation

Reputation score of Malsite IP/Domain/URL

Float

7.4

N

N

Y

Malsite

malsite_id

Malicious Site ID - Hash of threat match value

String

9228edb31a922c392ba3746

N

N

Y

Malsite

severity_level_id

If the Severity Level ID is 1, it means that URL / IP /Domain is detected from Internal threat feed and if Severity Level ID is 2, then it means the detection happened based on the OEM DB Malsite Category.

Integer

0, 1, 2, 3

N

N

Y

Malsite

severity_level

Severity level of the Malsite ( High / Med / Low)

String

low, medium, high

N

N

Y

Malsite

threat_match_field

Threat match field, either from domain or URL or IP.

String

domain, url, ip

Y

N

Y

Malsite

threat_source_id

Threat source id: 1 - NetskopeThreatIntel, 2 - OEM DB

Integer

1,2

Y

N

Y

Malware

scan_time

Time when the scan is done

LongInt

1474308875

Y

N

Y

Malware

malware_id

md5 hash of the malware name as provided by the scan engine

String

Any md5 hash string (as hexadecimal string)

Y

N

Y

Malware

malware_type

What type (virus, etc) of a threat is this?

String

Adware, Dialer, Malicious App, Spam, Phishing, Spyware, Virus, Heuristic, No Detection, Encrypted/Unscannable, Trojan, Error, Misleading Application

Y

N

Y

Malware

detection_type

Same as malware type. Duplicate.

String

virus, trojan

Y

N

Y

Malware

malware_severity

How severe is the threat posed by this malware

String

high, medium, low

Y

N

Y

Malware

malware_name

What is the detection name for this threat

String

Gen.Ransom.Encrypted.File.ns

Y

N

Y

Malware

detection_engine

Customer exposed detection engine name

String

Netskope AV, Netskope Threat Intel, Netskope Advanced Heursitics, Netskope Advanced Sandbox

Y

N

Y

Malware

tss_mode

Malware scanning mode, specifies whether it's Real-time Protection or API Data Protection

String

Introspection, Inline

Y

N

Y

Malware

malware_profile

tss_profile: profile which user has selected. Data comes from WebUI. Its a json structure.

String

Default Malware Scan

Y

N

Y

Malware

zip_password

Zip the malacious file and put pwd to it and send it back to caller

String

netskope

Y

N

Y

Malware

local_md5

md5 hash of file generated by the Malware engine

String

3b30d5c68bfe

Y

N

Y

Malware

local_sha256

sha256 hash of file generated by the Malware engine

String

3b30d5c68bfe

Y

N

Y

Malware

local_sha1

sha1 hash of file generated by the Malware engine

String

3b30d5c68bfe

Y

N

Y

Compromised Credentials

breach_id

Breach ID for compromised credentials

String

95e2e98ac17cf08de4b82f94 356dc51e

N

N

Y

Compromised Credentials

breach_date

Breach date for compromised credentials

Integer

1524700800

N

N

Y

Compromised Credentials

breach_score

Breach score for compromised credentials

Integer

30, 100

N

N

Y

Compromised Credentials

breach_target_references

Breach target references for compromised credentials

String

forbes.com

N

N

Y

Compromised Credentials

breach_media_references

Media references of breach

String

http://news.something.com/8301- 1009_3-57618945-83/syrian- electronic-army-hacks-forbes-steals-user-data/

N

N

Y

IaaS CSA

sa_profile_name

CSA profile name

String

PCI-DSS v3.2.1 (Azure)

Y

N

Y

IaaS CSA

sa_profile_id

CSA profile ID

Integer

-2002000

Y

N

Y

IaaS CSA

sa_rule_id

CSA rule ID

Integer

-2002041

Y

N

Y

IaaS CSA

sa_rule_name

CSA rule name

String

PCI-AZR | 5.1 Ensure that the endpoint protection for all Virtual Machines is installed

Y

N

Y

IaaS CSA

sa_rule_severity

Rule severity

String

Critical, High, Medium, Low

Y

N

Y

IaaS CSA

account_id

Account ID (usually is account number as provided by the cloud provider)

String

a776ab3b-0d9d-401e-a31d-2f478a4c

Y

N

Y

IaaS CSA

account_name

Account name - in case of AWS this is the instance name set by user. For others, account name is provided by the cloud provider.

String

iaas-azure-dev

Y

N

Y

IaaS CSA

iaas_asset_tags

List of tags associated with the asset for which alert is raised. Each tag is a key/value pair

Array of dictionary objects (name/value pairs)

[{"name": "major environment", "value": "test"}, {"name": "owner", "value": "abc" }]

Y

N

Y

IaaS CSA

run_id

Run ID

Integer

15

Y

N

N

IaaS CSA

region_id

Region ID (as provided by the cloud provider)

String

eastus2

Y

N

Y

IaaS CSA

region_name

Region Name (as provided by the cloud provider)

String

East US 2

Y

N

Y

IaaS CSA

resource_category

Category of resource as defined in DOM

String

Compute

Y

N

Y