Previous

Next

Netskope Dashboard

Netskope Dashboard

Overview

Netskope provides solutions to protect data and defend against threats across cloud services, applications, and web traffic. It enables secure access to the internet and cloud environments through tools like Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA). Netskope’s transaction event logs provide detailed records of user web activity, including URLs accessed, HTTP call details, and certificate/SSL information, enabling granular visibility and forensic analysis of web traffic.

Use this integration to collect Netskope transaction event logs in Datadog, via an Amazon S3 bucket.

Setup

To set up the Netskope integration, you need to do three things:

1. Set up Netskope Log Streaming to send logs to an Amazon S3 bucket.
   Note: The Netskope Log Streaming integration currently only supports AWS.
2. Install Datadog CloudFormation Template to forward the logs from the S3 bucket to Datadog.
3. Set up your Amazon S3 bucket to send events to the Cloudformation Template

Install the Netskope Logs Forwarder

1. Set up Netskope Log Streaming to forward logs to an Amazon S3 bucket that you own, and make note of the bucket name.

Install the Datadog CloudFormation Template

1. In AWS, go to the CloudFormation page. Click on the Create Stack button, then click With new resources.

2. On the Create Stack page, use the following values:

   • Prepare Template: Choose an existing template
   • Template Source: Amazon S3 URL
   • Amazon S3 URL: https://saas-ints-serverless-cf-template-storage-us1-prod.s3.us-east-1.amazonaws.com/dd-netskope-cloudformation-template-1.0.0.yaml

3. If it is the first time installing this template, you may be asked to create AWS resouces:

   • DatadogNetskopeLogsLambda, the Lambda itself
   • DatadogNetskopeLogsLambdaExecutionRole, the role for running the Lambda
   • LambdaBasicExecutionPolicy, the policy for running the Lambda
   • S3ReadAccessPolicy, the policy to allow the Stack to read from your bucket
   • LambdaInvokePermission, permission to run the Lambda

4. On the Specify Details page, set the following parameters:

   • Stack Name: Enter a name of your choice
   • DdApiKey: Your Datadog API key
   • DdSite: Your Datadog site
   • BucketName: The name of the Amazon S3 bucket that Netskope Logs Streaming is forwarding your logs to

5. On the Configure Stack Options page, you may optionally set the follow paramters:

   • Add AWS tags (these are only tags for AWS infrastructure, and will not be sent to Datadog)
   • Provide an existing IAM role
   • Set the Stack Failure options

6. On the Review & Create page, review your options, and update them as needed. Then, click Submit to create the Stack.

7. In the Stack, find the Lambda that was created, and make note of the ARN for it.

Set up Amazon S3 bucket to send events to the Cloudformation Stack

1. In Amazon S3, find your bucket, and select the Properties tab.

2. Scroll down to Event Notifications and click on Create event notification

3. On the Create Event Notification page, set the following parameters:

   • Event Name: Enter a name of your choice
   • Prefix: Enter stream_1/, which is the prefix that Netskope Transactions logs use
   • Suffix: Leave blank
   • Event types: Select All object create events

4. Still on the Create Event Notification page, select the Lambda that the CloudFormation Stack created:

   • Enter DatadogNetskopeLogsLambda, or use the Lambda ARN from above

5. Press Save Changes to created the Event Notification.

Verification

1. In Amazon S3, ensure that Netskope is forwarding log files to the S3 bucket.
2. In AWS Lambda, check your Lambda function’s Monitor tab, and check the logs for each run for errors.
3. In Datadog’s Log Explorer, search for your Netskope logs with source:netskope.

Data Collected

Metrics

Netskope does not include any metrics.

Service Checks

Netskope does not include any service checks.

Events

Netskope does not include any events.

Troubleshooting

Need help? Contact Datadog support.