Overview
SPOG.AI integrates with Netskope to provide centralized monitoring of security incidents, alerts, user activity, and policies. Using the Netskope REST APIs and optional webhook notifications, the integration ingests both pulled data and real-time pushed events, correlates them with internal assets, and enriches the SPOG.AI CMDB. This strengthens security monitoring, compliance management, and incident response by enabling SPOG.AI to trigger incidents, alert on policy violations, and present dashboards that combine Netskope events with internal security telemetry. Access is granted through a Netskope API token that can be limited to only the endpoints required.
Key Features
| Capability | Description |
| Incident & Alert Monitoring | Ingests new and existing security incidents and alerts from Netskope. |
| User Activity Visibility | Captures user-level alerts, behavior, and login events. |
| Policy Monitoring | Retrieves policy definitions, changes, and enforcement status. |
| Configuration Visibility | Collects settings, rule states, and thresholds. |
| Real-Time Webhook Ingestion | Optionally receives events pushed from Netskope for real-time incident ingestion. |
| Asset Correlation & CMDB Enrichment | Matches Netskope alerts with internal asset identities and enriches the CMDB. |
| Alerting & Dashboards | Triggers incidents, alerts on policy violations, and combines Netskope events with internal security telemetry. |
How the Integration Works
SPOG.AI authenticates to Netskope using an API token and calls the Netskope REST API endpoints (v1 or v2) to retrieve incidents, alerts, user activity, and policy metadata. Optionally, Netskope can send webhook notifications, such as alerts and event changes, to SPOG.AI for real-time incident ingestion. SPOG.AI ingests both the pulled data and the pushed events, correlates them with internal assets, and enriches the CMDB. This data is then used to trigger incidents, alert on policy violations, and power dashboards that combine Netskope events with internal security telemetry.
Data Collected
| Category | Data Collected | Description |
| Incidents & Alerts | New and existing security incidents and alerts | Security events detected by Netskope. |
| User Activity | User-level alerts, behavior, login events | User behavior and activity records. |
| Policy Metadata | Policy definitions, changes, enforcement status | Policy details and their enforcement state. |
| Configuration Data | Settings, rule states, thresholds | Netskope configuration and rule information. |
| Webhook Events | Real-time events pushed from Netskope (for example event, severity, user, timestamp, description) | Events delivered as they occur when webhooks are enabled. |
| Correlation | Netskope alerts matched with internal asset identities | Links Netskope activity to assets in the CMDB. |
Prerequisites
Before configuring the integration, ensure the following prerequisites are met:
- Administrator (or equivalent) access to both SPOG.AI and the Netskope Admin Console.
- A Netskope subscription with REST API access enabled.
- Ability to generate API tokens in Netskope (v1 or v2).
- Optionally, ability to configure webhook / notification endpoints in Netskope.
- Outbound HTTPS (443) connectivity from SPOG.AI to the Netskope tenant API, using TLS 1.2 or later, and a SPOG.AI endpoint reachable by Netskope if using webhooks.
Configuration
1. Generate a Netskope API Token
Create a token that SPOG.AI will use to call the Netskope REST API. Administrator access to the Netskope Admin Console is required.
- In the Netskope Admin Console, go to Settings → Tools → REST API (v1 or v2).
- Click New Token (or Generate Token).
- Enter a name, for example SPOG Integration, and optionally set an expiration.
- Select the API endpoints this token can access, for example incidents, alerts, policy, and user, and set read or read/write access as needed. Grant only the minimum required.
- Create the token and store the key securely, as it may not be shown again.
2. Configure a Webhook (Optional / Recommended)
Configure a webhook if you want Netskope to push alerts to SPOG.AI for real-time incident ingestion. Skip this step to use the REST API only.
- In the Netskope Admin Console, navigate to Settings → Alerts / Notification Methods → Webhooks (the exact path may differ).
- Add a new webhook with the following details:
| Field | Value |
| Name | For example, SPOG Incident Webhook. |
| Webhook URL | The endpoint provided by SPOG.AI. |
| Content Type | application/json |
| Payload Template | A custom JSON template, for example including event, severity, user, timestamp, and description. |
- Test the webhook to confirm that SPOG.AI receives sample payloads.
- Where possible, restrict inbound webhooks to SPOG.AI’s IP on the Netskope side.
3. Allow Network Access
Ensure the network path between SPOG.AI and Netskope is open.
- Allow outbound HTTPS (port 443) from SPOG.AI to the Netskope API endpoints (tenant URLs).
- If your network uses firewalls or proxies, whitelist the Netskope API domains.
- If using webhooks, ensure SPOG.AI exposes an HTTPS endpoint that Netskope can reach, and allow inbound webhook traffic.
- Ensure TLS 1.2 or later is used for both API and webhook traffic.
4. Configure Netskope in SPOG.AI
- Log in to SPOG.AI.
- Navigate to Settings → Integrations → Add Integration.
- Select Netskope and click Configure.
- Enter the following configuration fields:
| Field | Description |
| Host / API Endpoint | The Netskope tenant API URL, for example https://tenantname.goskope.com. |
| API Key | The token generated in Netskope. |
| Webhook URL (Optional) | The SPOG.AI endpoint that receives webhook callbacks. |
- Click Save (or Test + Save) to enable the integration.
5. Validate the Integration In SPOG.AI
- Run Test Connection, or execute a small API query such as listing alerts.
- Confirm that SPOG.AI receives and parses payloads properly.
- If the webhook is enabled, send a test alert from Netskope and confirm that SPOG.AI receives the event.
Using the Netskope REST API
Validate the token manually, for example:
curl -H “Authorization: token {API_KEY}” https://tenantname.goskope.com/api/v2/alerts
Monitor for the following failures:
| Error | Meaning |
| 401 Unauthorized | The API token is invalid or expired. |
| 403 Forbidden | The token lacks the required scope. |
| 404 Not Found | The API endpoint is wrong. |
| Webhook delivery failures / retries | Netskope could not deliver events to SPOG.AI. Check the webhook URL and connectivity. |