Référence du connecteur Netskope Logs

info

Bêta

Cette fonctionnalité est en Bêta. Les administrateurs du Workspace peuvent contrôler l'accès à cette fonctionnalité à partir de la page Previews . Consultez Gérer les aperçus Databricks.

Cette page contient des informations de référence pour le connecteur Netskope Logs géré, y compris les tables source prises en charge et les schémas de table de destination.

Options du connecteur

Ce connecteur ne dispose d'aucune option de pipeline spécifique au connecteur.

Tables sources prises en charge

Le connecteur Netskope Logs prend en charge les tables sources suivantes, toutes sous le schéma source default. Chaque table prend en charge l'ingestion incrémentale. Le connecteur utilise le champ time comme champ curseur pour l'ingestion incrémentale.

Table source	Clé principale	Description	Mode de synchronisation	Champ du curseur
`audit`	`lw_id`	Événements de Logs d’audit administrateur pour votre tenant Netskope, tels que les changements de configuration et l’activité des rapports.	Incrémentiel	`time`
`application`	`lw_id`	Événements d'application relatifs à l'activité des utilisateurs sur les applications et sites web cloud, tels que les téléversements, les téléchargements et les connexions.	Incrémentiel	`time`
`incident`	`lw_id`	Événements d'incident pour l'activité des données et des fichiers qui déclenchent un incident Netskope.	Incrémentiel	`time`
`infrastructure`	`lw_id`	Événements d'infrastructure pour la santé et l'état de votre déploiement Netskope.	Incrémentiel	`time`
`network`	`lw_id`	Événements réseau pour le trafic que Netskope traite, tels que les connexions de pare-feu cloud.	Incrémentiel	`time`
`page`	`lw_id`	Événements de page pour les visites de sites web et d’applications web.	Incrémentiel	`time`
`alert_compromisedcredential`	`lw_id`	Alertes de compromission d'informations d'identification pour les informations d'identification d'utilisateur trouvées dans les fuites de données connues.	Incrémentiel	`time`
`alert_content`	`lw_id`	Alertes de contenu déclenchées lorsque l'activité correspond à une politique de contenu.	Incrémentiel	`time`
`alert_ctep`	`lw_id`	Prévention des exploits de menaces cloud (CTEP) et alertes de prévention des intrusions pour les menaces réseau.	Incrémentiel	`time`
`alert_device`	`lw_id`	Alertes d’appareil pour les événements d’appareil gérés.	Incrémentiel	`time`
`alert_dlp`	`lw_id`	Alertes de prévention des pertes de données (DLP) déclenchées lorsqu'une activité correspond à une politique DLP.	Incrémentiel	`time`
`alert_malsite`	`lw_id`	Alertes de sites web malveillants pour les visites de sites web malveillants connus.	Incrémentiel	`time`
`alert_malware`	`lw_id`	Alertes de logiciels malveillants pour les logiciels malveillants détectés.	Incrémentiel	`time`
`alert_policy`	`lw_id`	Alertes de politique déclenchées lorsque l'activité correspond à une politique de protection en temps réel.	Incrémentiel	`time`
`alert_quarantine`	`lw_id`	Mettre en quarantaine les alertes pour les fichiers que Netskope déplace en quarantaine.	Incrémentiel	`time`
`alert_remediation`	`lw_id`	Alertes de remédiation pour les actions de remédiation.	Incrémentiel	`time`
`alert_securityassessment`	`lw_id`	Alertes d'évaluation de la sécurité pour les résultats de la posture de sécurité du cloud.	Incrémentiel	`time`
`alert_uba`	`lw_id`	Alertes analytique du comportement des utilisateurs et des entités (UEBA) pour les activités utilisateur anormales.	Incrémentiel	`time`
`alert_watchlist`	`lw_id`	Alertes de liste de surveillance pour l'activité qui correspond à une liste de surveillance configurée.	Incrémentiel	`time`

Table source	Clé principale	Description	Mode de synchronisation	Champ du curseur
`audit`	`lw_id`	Événements de Logs d’audit administrateur pour votre tenant Netskope, tels que les changements de configuration et l’activité des rapports.	Incrémentiel	`time`
`application`	`lw_id`	Événements d'application relatifs à l'activité des utilisateurs sur les applications et sites web cloud, tels que les téléversements, les téléchargements et les connexions.	Incrémentiel	`time`
`incident`	`lw_id`	Événements d'incident pour l'activité des données et des fichiers qui déclenchent un incident Netskope.	Incrémentiel	`time`
`infrastructure`	`lw_id`	Événements d'infrastructure pour la santé et l'état de votre déploiement Netskope.	Incrémentiel	`time`
`network`	`lw_id`	Événements réseau pour le trafic que Netskope traite, tels que les connexions de pare-feu cloud.	Incrémentiel	`time`
`page`	`lw_id`	Événements de page pour les visites de sites web et d’applications web.	Incrémentiel	`time`
`alert_compromisedcredential`	`lw_id`	Alertes de compromission d'informations d'identification pour les informations d'identification d'utilisateur trouvées dans les fuites de données connues.	Incrémentiel	`time`
`alert_content`	`lw_id`	Alertes de contenu déclenchées lorsque l'activité correspond à une politique de contenu.	Incrémentiel	`time`
`alert_ctep`	`lw_id`	Prévention des exploits de menaces cloud (CTEP) et alertes de prévention des intrusions pour les menaces réseau.	Incrémentiel	`time`
`alert_device`	`lw_id`	Alertes d’appareil pour les événements d’appareil gérés.	Incrémentiel	`time`
`alert_dlp`	`lw_id`	Alertes de prévention des pertes de données (DLP) déclenchées lorsqu'une activité correspond à une politique DLP.	Incrémentiel	`time`
`alert_malsite`	`lw_id`	Alertes de sites web malveillants pour les visites de sites web malveillants connus.	Incrémentiel	`time`
`alert_malware`	`lw_id`	Alertes de logiciels malveillants pour les logiciels malveillants détectés.	Incrémentiel	`time`
`alert_policy`	`lw_id`	Alertes de politique déclenchées lorsque l'activité correspond à une politique de protection en temps réel.	Incrémentiel	`time`
`alert_quarantine`	`lw_id`	Mettre en quarantaine les alertes pour les fichiers que Netskope déplace en quarantaine.	Incrémentiel	`time`
`alert_remediation`	`lw_id`	Alertes de remédiation pour les actions de remédiation.	Incrémentiel	`time`
`alert_securityassessment`	`lw_id`	Alertes d'évaluation de la sécurité pour les résultats de la posture de sécurité du cloud.	Incrémentiel	`time`
`alert_uba`	`lw_id`	Alertes analytique du comportement des utilisateurs et des entités (UEBA) pour les activités utilisateur anormales.	Incrémentiel	`time`
`alert_watchlist`	`lw_id`	Alertes de liste de surveillance pour l'activité qui correspond à une liste de surveillance configurée.	Incrémentiel	`time`

Le connecteur applique le clustering liquide à toutes les tables de destination sur la colonne time pour des queries efficaces par plages horaires.

Schémas de table de destination

`audit`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`audit_log_event`	`string`
`changed_ds`	`string`
`count`	`bigint`
`details`	`string`
`is_netskope_personnel`	`boolean`
`organization_unit`	`string`
`report_id`	`string`
`severity_level`	`bigint`
`supporting_data`	`string`
`timestamp`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`user`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`audit_log_event`	`string`
`changed_ds`	`string`
`count`	`bigint`
`details`	`string`
`is_netskope_personnel`	`boolean`
`organization_unit`	`string`
`report_id`	`string`
`severity_level`	`bigint`
`supporting_data`	`string`
`timestamp`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`user`	`string`

`application`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

`incident`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

`infrastructure`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

`network`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

`page`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`access_method`	`string`
`action`	`string`
`activity`	`string`
`app`	`string`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`device`	`string`
`domain`	`string`
`dstip`	`string`
`dstport`	`bigint`
`event_type`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

`alert_compromisedcredential`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_content`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_ctep`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_device`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_dlp`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_malsite`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_appsession_start`	`string`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_nshostname`	`string`
`_original_destip`	`string`
`_original_destport`	`bigint`
`_policy_category_id`	`array<bigint>`
`_policy_matched_categories_id`	`array<string>`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`access_method`	`string`
`acked`	`string`
`action`	`string`
`alert`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`appsuite`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`destination_profiles`	`array<string>`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`incident_id`	`bigint`
`ja3`	`string`
`ja3s`	`string`
`malicious`	`string`
`malsite_category`	`array<string>`
`malsite_country`	`string`
`malsite_id`	`string`
`malsite_ip_host`	`string`
`malsite_latitude`	`double`
`malsite_longitude`	`double`
`malsite_region`	`string`
`managed_app`	`string`
`netskope_pop`	`string`
`notify_template`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`page_site`	`string`
`policy`	`string`
`policy_id`	`string`
`port`	`string`
`protocol`	`string`
`referer`	`string`
`request_id`	`bigint`
`severity`	`string`
`severity_level`	`string`
`severity_level_id`	`bigint`
`site`	`string`
`src_country`	`string`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`tags`	`array<string>`
`telemetry_app`	`string`
`threat_match_field`	`string`
`threat_match_value`	`string`
`threat_source_id`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`
`web_universal_connector`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_appsession_start`	`string`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_nshostname`	`string`
`_original_destip`	`string`
`_original_destport`	`bigint`
`_policy_category_id`	`array<bigint>`
`_policy_matched_categories_id`	`array<string>`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`access_method`	`string`
`acked`	`string`
`action`	`string`
`alert`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`appsuite`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`destination_profiles`	`array<string>`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`incident_id`	`bigint`
`ja3`	`string`
`ja3s`	`string`
`malicious`	`string`
`malsite_category`	`array<string>`
`malsite_country`	`string`
`malsite_id`	`string`
`malsite_ip_host`	`string`
`malsite_latitude`	`double`
`malsite_longitude`	`double`
`malsite_region`	`string`
`managed_app`	`string`
`netskope_pop`	`string`
`notify_template`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`page_site`	`string`
`policy`	`string`
`policy_id`	`string`
`port`	`string`
`protocol`	`string`
`referer`	`string`
`request_id`	`bigint`
`severity`	`string`
`severity_level`	`string`
`severity_level_id`	`bigint`
`site`	`string`
`src_country`	`string`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`tags`	`array<string>`
`telemetry_app`	`string`
`threat_match_field`	`string`
`threat_match_value`	`string`
`threat_source_id`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`
`web_universal_connector`	`string`

`alert_malware`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_policy`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`TSS-scan`	`string`
`_appsession_start`	`string`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_client_timeout`	`bigint`
`_content_version`	`bigint`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_ns_protection_type`	`string`
`_nshostname`	`string`
`_nsp_dur_back`	`bigint`
`_nsp_dur_front`	`bigint`
`_nsp_retrans_back`	`bigint`
`_nsp_retrans_front`	`bigint`
`_nsp_rtt_back`	`bigint`
`_nsp_rtt_front`	`bigint`
`_original_destip`	`string`
`_original_destport`	`bigint`
`_partial_file`	`boolean`
`_policy_index`	`bigint`
`_policy_matched_categories_id`	`array<string>`
`_raw_event_inserted_at`	`bigint`
`_resource_name`	`string`
`_scan_source`	`string`
`_service_identifier`	`string`
`_session_begin`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`_tenant_max_file_size`	`bigint`
`access_method`	`string`
`acked`	`string`
`action`	`string`
`activity`	`string`
`alert`	`string`
`alert_name`	`string`
`alert_type`	`string`
`all_policy_matches`	`array<string>`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`appsuite`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`destination_profiles`	`array<string>`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`file_category`	`string`
`file_size`	`bigint`
`file_type`	`string`
`from_user`	`string`
`incident_id`	`bigint`
`instance_id`	`string`
`instance_tags`	`array<string>`
`ja3`	`string`
`ja3s`	`string`
`justification_reason`	`string`
`justification_type`	`string`
`local_sha256`	`string`
`malicious`	`string`
`malsite_category`	`array<string>`
`malware_id`	`string`
`malware_name`	`string`
`malware_severity`	`string`
`malware_type`	`string`
`managed_app`	`string`
`md5`	`string`
`netskope_pop`	`string`
`notify_template`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`page_site`	`string`
`parent_id`	`string`
`policy`	`string`
`policy_id`	`string`
`port`	`string`
`protection_string`	`string`
`protocol`	`string`
`referer`	`string`
`request_id`	`bigint`
`sanctioned_instance`	`string`
`severity`	`string`
`sha256`	`string`
`site`	`string`
`src_country`	`string`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`suppression_end_time`	`bigint`
`suppression_start_time`	`bigint`
`tags`	`array<string>`
`telemetry_app`	`string`
`threat_match_field`	`string`
`threat_match_value`	`string`
`threat_source_id`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`tss_mode`	`string`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`
`web_universal_connector`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`TSS-scan`	`string`
`_appsession_start`	`string`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_client_timeout`	`bigint`
`_content_version`	`bigint`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_ns_protection_type`	`string`
`_nshostname`	`string`
`_nsp_dur_back`	`bigint`
`_nsp_dur_front`	`bigint`
`_nsp_retrans_back`	`bigint`
`_nsp_retrans_front`	`bigint`
`_nsp_rtt_back`	`bigint`
`_nsp_rtt_front`	`bigint`
`_original_destip`	`string`
`_original_destport`	`bigint`
`_partial_file`	`boolean`
`_policy_index`	`bigint`
`_policy_matched_categories_id`	`array<string>`
`_raw_event_inserted_at`	`bigint`
`_resource_name`	`string`
`_scan_source`	`string`
`_service_identifier`	`string`
`_session_begin`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`_tenant_max_file_size`	`bigint`
`access_method`	`string`
`acked`	`string`
`action`	`string`
`activity`	`string`
`alert`	`string`
`alert_name`	`string`
`alert_type`	`string`
`all_policy_matches`	`array<string>`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`appsuite`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`destination_profiles`	`array<string>`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`file_category`	`string`
`file_size`	`bigint`
`file_type`	`string`
`from_user`	`string`
`incident_id`	`bigint`
`instance_id`	`string`
`instance_tags`	`array<string>`
`ja3`	`string`
`ja3s`	`string`
`justification_reason`	`string`
`justification_type`	`string`
`local_sha256`	`string`
`malicious`	`string`
`malsite_category`	`array<string>`
`malware_id`	`string`
`malware_name`	`string`
`malware_severity`	`string`
`malware_type`	`string`
`managed_app`	`string`
`md5`	`string`
`netskope_pop`	`string`
`notify_template`	`string`
`object`	`string`
`object_type`	`string`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`page_site`	`string`
`parent_id`	`string`
`policy`	`string`
`policy_id`	`string`
`port`	`string`
`protection_string`	`string`
`protocol`	`string`
`referer`	`string`
`request_id`	`bigint`
`sanctioned_instance`	`string`
`severity`	`string`
`sha256`	`string`
`site`	`string`
`src_country`	`string`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`suppression_end_time`	`bigint`
`suppression_start_time`	`bigint`
`tags`	`array<string>`
`telemetry_app`	`string`
`threat_match_field`	`string`
`threat_match_value`	`string`
`threat_source_id`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`tss_mode`	`string`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`
`web_universal_connector`	`string`

`alert_quarantine`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_remediation`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_securityassessment`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`alert_type`	`string`
`alert_name`	`string`
`app`	`string`
`severity`	`string`
`timestamp`	`bigint`
`type`	`string`
`user`	`string`

`alert_uba`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`__skip_cache`	`string`
`_activity`	`string`
`_api_conn`	`string`
`_category_id`	`string`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_meta`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_session_begin`	`bigint`
`_skip_geoip_lookup`	`string`
`_skip_ueba`	`boolean`
`access_method`	`string`
`acked`	`string`
`act_user`	`string`
`action`	`string`
`activity`	`string`
`activity_status`	`string`
`alert`	`string`
`alert_id`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_activity`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`device`	`string`
`event_detail`	`string`
`event_type`	`string`
`evt_src_chnl`	`string`
`file_id`	`string`
`file_path`	`string`
`file_type`	`string`
`instance`	`string`
`instance_id`	`string`
`logon_error`	`string`
`mime_type`	`string`
`object`	`string`
`object_id`	`string`
`object_type`	`string`
`organization_unit`	`string`
`orig_ty`	`string`
`os`	`string`
`other_categories`	`array<string>`
`parent_id`	`string`
`policy`	`string`
`policy_actions`	`array<string>`
`profile_id`	`string`
`raw_event`	`string`
`request_id`	`bigint`
`request_type`	`string`
`sanctioned_instance`	`string`
`scenario`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`sub_scenario`	`string`
`tags`	`array<string>`
`threshold`	`bigint`
`threshold_time`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`user`	`string`
`user_id`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`__skip_cache`	`string`
`_activity`	`string`
`_api_conn`	`string`
`_category_id`	`string`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_meta`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_insertion_epoch_timestamp`	`bigint`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_session_begin`	`bigint`
`_skip_geoip_lookup`	`string`
`_skip_ueba`	`boolean`
`access_method`	`string`
`acked`	`string`
`act_user`	`string`
`action`	`string`
`activity`	`string`
`activity_status`	`string`
`alert`	`string`
`alert_id`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_activity`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`browser`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`connection_id`	`bigint`
`count`	`bigint`
`device`	`string`
`event_detail`	`string`
`event_type`	`string`
`evt_src_chnl`	`string`
`file_id`	`string`
`file_path`	`string`
`file_type`	`string`
`instance`	`string`
`instance_id`	`string`
`logon_error`	`string`
`mime_type`	`string`
`object`	`string`
`object_id`	`string`
`object_type`	`string`
`organization_unit`	`string`
`orig_ty`	`string`
`os`	`string`
`other_categories`	`array<string>`
`parent_id`	`string`
`policy`	`string`
`policy_actions`	`array<string>`
`profile_id`	`string`
`raw_event`	`string`
`request_id`	`bigint`
`request_type`	`string`
`sanctioned_instance`	`string`
`scenario`	`string`
`severity`	`string`
`site`	`string`
`srcip`	`string`
`sub_scenario`	`string`
`tags`	`array<string>`
`threshold`	`bigint`
`threshold_time`	`bigint`
`timestamp`	`bigint`
`title`	`string`
`traffic_type`	`string`
`transaction_id`	`bigint`
`type`	`string`
`ur_normalized`	`string`
`user`	`string`
`user_id`	`string`
`userip`	`string`
`userkey`	`string`

`alert_watchlist`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched`	`boolean`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_ingress_client_bytes`	`bigint`
`_ingress_server_bytes`	`bigint`
`_insertion_epoch_timestamp`	`bigint`
`_nshostname`	`string`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`access_method`	`string`
`acked`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`bypass_reason`	`string`
`bypass_traffic`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`client_bytes`	`bigint`
`conn_duration`	`bigint`
`conn_endtime`	`bigint`
`conn_starttime`	`bigint`
`connection_id`	`bigint`
`count`	`bigint`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`http_transaction_count`	`bigint`
`netskope_pop`	`string`
`numbytes`	`bigint`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`req_cnt`	`bigint`
`resp_cnt`	`bigint`
`resp_content_len`	`bigint`
`resp_content_type`	`string`
`server_bytes`	`bigint`
`severity`	`string`
`site`	`string`
`src_country`	`string`
`src_geoip_src`	`bigint`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`ssl_decrypt_policy`	`string`
`tags`	`array<string>`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`user_generated`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Champ	Type de données
`lw_id`	`string`
`time`	`timestamp`
`_category_id`	`string`
`_category_name`	`string`
`_category_tags`	`array<bigint>`
`_correlation_id`	`string`
`_creation_timestamp`	`bigint`
`_ef_received_at`	`bigint`
`_enriched`	`boolean`
`_enriched_all`	`boolean`
`_event_id`	`string`
`_forwarded_by`	`string`
`_gef_src_dp`	`string`
`_id`	`string`
`_ingress_client_bytes`	`bigint`
`_ingress_server_bytes`	`bigint`
`_insertion_epoch_timestamp`	`bigint`
`_nshostname`	`string`
`_raw_event_inserted_at`	`bigint`
`_service_identifier`	`string`
`_skip_geoip_lookup`	`string`
`_src_epoch_now`	`bigint`
`_src_gmt_offset`	`bigint`
`access_method`	`string`
`acked`	`string`
`alert_name`	`string`
`alert_type`	`string`
`app`	`string`
`app_session_id`	`bigint`
`app_tags`	`array<string>`
`appcategory`	`string`
`browser`	`string`
`browser_session_id`	`bigint`
`browser_version`	`string`
`bypass_reason`	`string`
`bypass_traffic`	`string`
`category`	`string`
`cci`	`bigint`
`ccl`	`string`
`client_bytes`	`bigint`
`conn_duration`	`bigint`
`conn_endtime`	`bigint`
`conn_starttime`	`bigint`
`connection_id`	`bigint`
`count`	`bigint`
`device`	`string`
`domain`	`string`
`dst_country`	`string`
`dst_latitude`	`double`
`dst_location`	`string`
`dst_longitude`	`double`
`dst_region`	`string`
`dst_timezone`	`string`
`dst_zipcode`	`string`
`dstip`	`string`
`dstport`	`bigint`
`http_transaction_count`	`bigint`
`netskope_pop`	`string`
`numbytes`	`bigint`
`organization_unit`	`string`
`os`	`string`
`os_family`	`string`
`os_version`	`string`
`other_categories`	`array<string>`
`page`	`string`
`policy`	`string`
`protocol`	`string`
`req_cnt`	`bigint`
`resp_cnt`	`bigint`
`resp_content_len`	`bigint`
`resp_content_type`	`string`
`server_bytes`	`bigint`
`severity`	`string`
`site`	`string`
`src_country`	`string`
`src_geoip_src`	`bigint`
`src_latitude`	`double`
`src_location`	`string`
`src_longitude`	`double`
`src_region`	`string`
`src_time`	`string`
`src_timezone`	`string`
`src_zipcode`	`string`
`srcip`	`string`
`ssl_decrypt_policy`	`string`
`tags`	`array<string>`
`timestamp`	`bigint`
`traffic_type`	`string`
`type`	`string`
`ur_normalized`	`string`
`url`	`string`
`user`	`string`
`user_generated`	`string`
`useragent`	`string`
`userip`	`string`
`userkey`	`string`

Autorisations de jeton d'API Netskope requises

Le rôle du jeton Netskope REST API v2 doit avoir un accès en lecture aux événements et aux alertes que vous souhaitez ingérer. Pour plus de détails, consultez Configurer l’authentification à Netskope.

Options du connecteur​

Tables sources prises en charge​

Schémas de table de destination​

audit​

application​

incident​

infrastructure​

network​

page​

alert_compromisedcredential​

alert_content​

alert_ctep​

alert_device​

alert_dlp​

alert_malsite​

alert_malware​

alert_policy​

alert_quarantine​

alert_remediation​

alert_securityassessment​

alert_uba​

alert_watchlist​

Autorisations de jeton d'API Netskope requises​