Data Source
Ingests Alerts and Events from Netskope Security Cloud via Netskope Log Streaming (NLS). Logs are delivered to Azure Blob Storage as gzip-compressed positional CSV, polled by the CCF Blob Storage connector into the custom table NetskopeAlertEvents_CL. The DCR stream declares 254 columns in fixed positional order. NLS must emit fields in the exact column sequence declared in Custom-NetskopeAlertEvents; a field-order mismatch silently shifts every column, making all downstream queries return wrong data.
Ingestion Mechanism
CCF Blob Storage connector (NetskopeAlertEventsConnector) with:
- Event Grid system topic and subscription triggers on Blob Created events
- Storage Queue (notification plus dead-letter) buffers blob pointers
- DCR with transformKql parses positional CSV; response.format csv with isGzipCompressed true required. JSON parsing of NLS CSV yields zero rows.
- Service Principal auth (appId 4f05ce56-95b6-4612-9d98-a45c8cc33f9f) with Storage Blob Data Reader and Storage Queue Data Contributor role assignments
Detection Surface Unlocked
Bundled Analytic Rules (3):
Netskope - High Severity Alert (NetskopeAlertEvents_Rule1.yaml): Queries NetskopeAlertEvents_CL for Alert == yes and Severity in (high, critical), aggregating by AlertName, AlertType, User, Userip, Hostname, SrcCountry. Maps Account, IP, Host entities. Covers DLP violations, malware, compromised credentials, and significant policy breaches. MITRE: T1078, T1567.
Netskope - Suspicious Application Activity (NetskopeAlertEvents_Rule2.yaml): Detects risky/low-CCL app usage, blocked actions, or sensitive activities (Upload, Share, Download, Post, Send) on non-excellent-CCL apps with EventCount greater than 5 threshold. Surfaces Shadow IT and data leakage via unsanctioned cloud apps. MITRE: T1567, T1102.
Netskope - DLP Incident Spike (NetskopeAlertEvents_Rule3.yaml): KQL logic unavailable; YAML diff truncated before Rule3 content.
Parser: NetskopeAlertEvents (.yaml) normalises key fields including alert_id, event_type, user, user_ip, application, severity, policy, action, device, location, and raw_json.
Workbook: Netskope Alerts and Events with sections for Overview, Alerts, Applications and Shadow IT, DLP Incidents, Malware and Threats, Policy Enforcement, Users, Advanced Analytics (User Risk Scoreboard, Heatmap), User Investigation drill-down, Devices and Network, and Geographic Distribution.
MITRE Coverage
| Technique | Tactic | Rule |
|---|---|---|
| T1078 (Valid Accounts) | Initial Access | Rule 1 |
| T1567 (Exfiltration Over Web Service) | Exfiltration | Rule 1, Rule 2 |
| T1102 (Web Service) | Command and Control | Rule 2 |
| T1530 (Data from Cloud Storage) | Collection | Connector scope |
Operational Notes
- Column order is critical: NLS field order must match the 254-column DCR stream declaration exactly. Silent column shifting produces no ingestion errors but corrupts all field values downstream.
- Format mismatch produces zero rows: Poller response.format must be csv with isGzipCompressed true; misconfiguration yields a silently empty table with no error surfaced.
- Epoch timestamp handling: DCR converts epoch seconds; if NLS emits milliseconds, divide by 1000 in the transform KQL or TimeGenerated will be wildly incorrect.
Affected Files
.script/tests/KqlvalidationsTests/CustomTables/NetskopeAlertEvents_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/NetskopeAlertEvents/Analytic Rules/NetskopeAlertEvents_Rule1.yaml
Solutions/NetskopeAlertEvents/Analytic Rules/NetskopeAlertEvents_Rule2.yaml
Solutions/NetskopeAlertEvents/Analytic Rules/NetskopeAlertEvents_Rule3.yaml
Solutions/NetskopeAlertEvents/Data Connectors/NetskopeAlertEvents_CCF/NetskopeAlertEvents_DCR.json
Solutions/NetskopeAlertEvents/Data Connectors/NetskopeAlertEvents_CCF/NetskopeAlertEvents_PollingConfig.json
Solutions/NetskopeAlertEvents/Data Connectors/NetskopeAlertEvents_CCF/NetskopeAlertEvents_Table.json
Solutions/NetskopeAlertEvents/Data Connectors/NetskopeAlertEvents_CCF/NetskopeAlertEvents_connectorDefinition.json
Solutions/NetskopeAlertEvents/Package/testParameters.json
Solutions/NetskopeAlertEvents/Parsers/NetskopeAlertEvents.yaml
Solutions/NetskopeAlertEvents/README.md
Solutions/NetskopeAlertEvents/Workbooks/Images/NetskopeAlertEventsOverviewBlack01.png
Solutions/NetskopeAlertEvents/Workbooks/Images/NetskopeAlertEventsOverviewBlack02.png
Solutions/NetskopeAlertEvents/Workbooks/Images/NetskopeAlertEventsOverviewWhite01.png
Solutions/NetskopeAlertEvents/Workbooks/Images/NetskopeAlertEventsOverviewWhite02.png
Solutions/NetskopeAlertEvents/Workbooks/NetskopeAlertEventsDashboard/NetskopeAlertEvents_Workbook.json
Workbooks/Images/Preview/NetskopeAlertEventsOverviewBlack01.png
Workbooks/Images/Preview/NetskopeAlertEventsOverviewBlack02.png
Workbooks/Images/Preview/NetskopeAlertEventsOverviewWhite01.png
Workbooks/Images/Preview/NetskopeAlertEventsOverviewWhite02.png
Workbooks/NetskopeAlertEvents_Workbook.json
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_NetskopeAlertEvents.json, createUiDefinition.json, mainTemplate.json)