Netskope

Visualize Netskope devices, users, and app instances, map Netskope users to employee entities, and monitor changes through queries and alerts.

Installation

Installation

info

You will need to generate an API V1 Token on Netskope for this integration. See their documentation for more information. You can also request the Token from your Netskope tenant admin.

Configuration in JupiterOne

To install the Netskope integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Netskope. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

• The Account Name used to identify the Netskope account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

• Description to assist in identifying the integration instance, if desired.

• Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

• Lastly, your Netskope API V1 Token.

Click Create once all values are provided to finalize the integration.

Next steps

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.

Authorization

Data Model

Entities

The following entities are created:

Resources	Entity _type	Entity _class
App Instance	netskope_app_instance	Application
Device	netskope_device	Device
Discovered App	netskope_discovered_app	Application
DLP Incident	netskope_dlp_incident	Incident
NPA Policy	netskope_npa_policy	AccessPolicy
NPA Policy Group	netskope_npa_policy_group	Group
OAuth App	netskope_oauth_app	Application, NHI
Private App	netskope_private_app	Application
Publisher	netskope_publisher	Gateway
Publisher Upgrade Profile	netskope_publisher_upgrade_profile	Configuration
Tenant	netskope_tenant	Account, Organization
URL List	netskope_url_list	Configuration
User	netskope_user	User
User Configuration	netskope_user_configuration	Configuration

Relationships

The following relationships are created:

Source Entity _type	Relationship _class	Target Entity _type
netskope_device	HAS	netskope_user
netskope_device	HAS	netskope_dlp_incident
netskope_npa_policy	PROTECTS	netskope_private_app
netskope_publisher	CONNECTS	netskope_private_app
netskope_publisher	USES	netskope_publisher_upgrade_profile
netskope_tenant	HAS	netskope_device
netskope_tenant	HAS	netskope_app_instance
netskope_tenant	HAS	netskope_private_app
netskope_tenant	HAS	netskope_publisher
netskope_tenant	HAS	netskope_npa_policy
netskope_tenant	HAS	netskope_npa_policy_group
netskope_tenant	HAS	netskope_url_list
netskope_tenant	HAS	netskope_discovered_app
netskope_tenant	HAS	netskope_oauth_app
netskope_user	HAS	netskope_user_configuration
netskope_user	HAS	netskope_dlp_incident

Types

Netskope App Instance

netskope_app_instance inherits from Application

Property	Type	Description	Specifications
app	string	Name of the application this is an instance of.
appId	string	Netskope application identifier.
instanceTags	array of strings	Tags applied to the instance (e.g. Sanctioned, Untagged).
lastModifiedOn	number	Epoch (ms) when the instance was last modified.
type	string	Instance type (e.g. Custom, Sanctioned).

---

Netskope Device

netskope_device inherits from Device

Property	Type	Description	Specifications
asn	string	Autonomous system number of the device connection.
asName	string	Autonomous system name of the device connection.
city	string	City geolocated from the connection.
clientConfig	string	Name of the client configuration applied to the device.
clientInstallTime	number	Epoch (seconds) when the Netskope client was installed.
clientVersion	string	Version of the installed Netskope client.
continent	string	Continent geolocated from the connection.
country	string	Country code geolocated from the connection.
deviceClassificationStatus	string	Netskope device classification status (e.g. Managed, Unmanaged).
isp	string	Internet service provider of the device connection.
lastConnectedFromPrivateIp	string	Private IP the device last connected from.
lastConnectedFromPublicIp	string	Public IP the device last connected from.
lastEvent	string	The device's most recent client event name.
lastEventActor	string	Actor that triggered the most recent client event.
lastEventNpaStatus	string	Netskope Private Access status reported with the most recent event.
lastEventOccurredOn	number	Epoch (ms) when the most recent client event occurred.
lastEventStatus	string	Status reported with the most recent client event.
latitude	number	Latitude geolocated from the connection.
longitude	number	Longitude geolocated from the connection.
managementId	string	Device management identifier reported by the client.
netskopePop	string	Netskope point of presence the device connected through.
organizationUnit	string	Organization unit of the device user.
os	string	Raw operating system value as reported by Netskope.
region	string	Region/state geolocated from the connection.
steeringConfig	string	Name of the steering configuration applied to the device.
userGroups	array of strings	Groups of the users associated with the device.
username	string	Primary username associated with the device.

---

Netskope Discovered App

netskope_discovered_app inherits from Application

Property	Type	Description	Specifications
appCategory	string	Netskope application category (e.g. Generative AI, Collaboration).
cci	number	Cloud Confidence Index score (0-100).
ccl	string	Cloud Confidence Level (poor, low, medium, high, excellent).
isGenAI	boolean	Whether the app is categorised as Generative AI by Netskope.
usesAI	boolean	Whether the app is an AI/GenAI application.

---

Netskope Dlp Incident

netskope_dlp_incident inherits from Incident

Property	Type	Description	Specifications
accessMethod	string	Access method used (e.g. Client, Clientless, CASB API).
activity	string	Activity that triggered the incident (e.g. Upload).
app	string	Application the incident occurred in.
appCategory	string	Category of the application the incident occurred in (e.g. Generative AI).
assignee	string	Assignee of the incident.
dlpPolicies	array of strings	DLP policy names that matched.
dlpProfiles	array of strings	DLP profile names that matched.
dlpRules	array of strings	DLP rule names that matched.
fileSize	number	Size of the object in bytes.
fileType	string	MIME/file type of the object involved.
incidentId	string	Netskope DLP incident identifier.
md5	string	MD5 hash of the object.
objectName	string	Name of the file/object involved in the incident.
objectType	string	Type of the object involved (e.g. File).
occurredOn	number	Epoch (ms) when the incident occurred.
sha256	string	SHA-256 hash of the object.
status	string	Incident status (e.g. new, in-progress, closed).
url	string	URL associated with the incident.

---

Netskope Npa Policy

netskope_npa_policy inherits from AccessPolicy

Property	Type	Description	Specifications
accessMethod	array of strings	Access methods the rule applies to (Client, Clientless).
action	string	Action taken when the rule matches (e.g. allow, block).
isEnabled	boolean	Whether the policy rule is enabled.
policyType	string	Policy type (e.g. private-app).
privateApps	array of strings	Names of the private apps referenced by the rule (a PROTECTS relationship is created for each ingested app).
users	array of strings	User or group identifiers the rule targets.
userType	string	Subject type the rule targets (e.g. user, group).

---

Netskope Npa Policy Group

netskope_npa_policy_group inherits from Group

Property	Type	Description	Specifications
createdBy	string	Identifier of the admin that created the group.
groupType	string	Group type identifier reported by Netskope.
isEditableDeletable	boolean	Whether the group can be edited or deleted (false for system-managed groups).

---

Netskope Oauth App

netskope_oauth_app inherits from Application, NHI

Property	Type	Description	Specifications
appDisplayName	string	Human-readable name of the OAuth application.
appId	string	Netskope identifier for the app. Mirrored on clientId to maximise the AIASM nhiAi enricher match surface.
clientId	string	OAuth client identifier of the application.
lastActivityOn	number	Epoch (ms) of the last observed activity.
scopes	array of strings	OAuth scopes granted to the application.
status	string	Status of the OAuth application.

---

Netskope Private App

netskope_private_app inherits from Application

Property	Type	Description	Specifications
appTags	array of strings	Tag names applied to the private app.
host	string	Reachability target of the app (FQDN, wildcard, IP, or subnet).
isClientlessAccess	boolean	Whether clientless (browser) access is enabled.
isReachable	boolean	Whether Netskope last reported the app as reachable via a publisher.
ports	array of strings	Transport:port pairs exposed by the app (e.g. tcp:80).
privateAppProtocol	string	Application-layer protocol (e.g. http, https).
protocols	array of strings	Transport protocols exposed by the app (e.g. tcp, udp).
publicHost	string	Public proxy host assigned for clientless access.
steeringConfigs	array of strings	Steering configurations the app is included in.

---

Netskope Publisher

netskope_publisher inherits from Gateway

Property	Type	Description	Specifications
appsCount	number	Number of private apps served by the publisher.
commonName	string	Common name presented by the publisher certificate.
connectedApps	array of strings	Names of the private apps the publisher serves.
ipAddress	string	IP address of the publisher host.
isLbrokerConnect	boolean	Whether the publisher connects via a local broker.
isRegistered	boolean	Whether the publisher has completed registration.
publisherStatus	string	Connection status (e.g. connected, disconnected, not registered).
version	string	Publisher software version.

---

Netskope Publisher Upgrade Profile

netskope_publisher_upgrade_profile inherits from Configuration

Property	Type	Description	Specifications
dockerTag	string	Docker image tag the profile upgrades publishers to.
externalId	number	Stable external identifier of the profile (referenced by publishers).
frequency	string	Cron expression describing the upgrade schedule.
isEnabled	boolean	Whether the upgrade profile is enabled.
nextUpdateOn	number	Epoch (ms) of the next scheduled upgrade.
numAssociatedPublisher	number	Number of publishers associated with the profile.
releaseType	string	Release channel the profile upgrades to (e.g. Latest).
timezone	string	Timezone the upgrade schedule is evaluated in.

---

Netskope Tenant

netskope_tenant inherits from Account, Organization

Property	Type	Description	Specifications
region	string	Region suffix of the tenant host (e.g. "eu" for a <tenant>.eu.goskope.com host).

---

Netskope Url List

netskope_url_list inherits from Configuration

Property	Type	Description	Specifications
isPending	boolean	Whether the list has pending (not yet applied) modifications.
listType	string	How entries are matched (e.g. exact, regex).
urlCount	number	Number of entries in the list.
urls	array of strings	URL/host/IP entries in the list.

---

Netskope User

netskope_user inherits from User

Property	Type	Description	Specifications
userAddedTime	number	Epoch (seconds) when the user was added in Netskope.
userSource	string	Source that provisioned the user (e.g. Manual, SCIM, IdP).

---

Netskope User Configuration

netskope_user_configuration inherits from Configuration

Property	Type	Description	Specifications
addonCheckerHost	string	Addon checker host for the client.
addonCheckerResponseCode	string	Expected addon checker response code.
addonManagerHost	string	Addon manager host for the client.
email	string	Email address the configuration belongs to.
orgName	string	Netskope organization name.
SFCheckerHost	string	Steering-forward checker host.
SFCheckerIP	string	Steering-forward checker IP.

---

Release Notes

Release Notes

• 2026-07-10 — Added API v2 support with new entity types including private applications, publishers, URL lists, network access policies and policy groups, discovered applications, and OAuth applications (disabled by default).
• 2026-04-08 — Improved OS name accuracy for Netskope client device entities, using human-readable names for Windows, macOS, Linux, iOS, Android, and ChromeOS devices.