Collect Netskope web proxy logs

Supported in:

Google SecOps SIEM

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google Security Operations Technical Support Service guidelines and the Google Security Operations Service Specific Terms.

This parser handles both CEF and non-CEF formatted Netskope web proxy logs. It extracts fields, performs data transformations (for example, converting timestamps or merging fields), maps them to the UDM, and adds Netskope-specific metadata. The parser uses conditional logic to handle different log formats and field availability, enriching the UDM with relevant network, security, and application details.

Before you begin

• Ensure that you have a Google Security Operations instance.
• Ensure that you have privileged access to Netskope.
• Ensure that you have a configured Log Shipper module.
• Ensure that you have a Google SecOps service account key (reach out to the Google SecOps team to get a service account with the following scopes: https://www.googleapis.com/auth/malachite-ingestion).

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Configure the Netskope Tenant in CE

1. Go to Settings > General.
2. Toggle the Log Shipper switch to ON
3. In Settings, go to Netskope Tenants.
4. If no tenants are configured, click Add Tenant.
5. Enter the following values:
   • Name: provide a memorable name for your tenant.
   • Tenant Name: enter the real name of your Netskope tenant.
   • V2 API Token: enter your Netskope API token.
   • Alert Filters: add the web proxy alerts you would like to ingest.
   • Initial Range: enter the amount of historical data you would like to ingest (in days).
   • Click Save.

Configure the Netskope CLS plugin

1. Go to Settings > Plugins.
2. Search for and select the Netskope (CLS) box to open the plugin creation page.
3. Enter the following details:
   • Configuration Name: enter a memorable name for this plugin.
   • Tenant: select the tenant you created in the previous step from the list.
   • Click Next.
   • Update the Event Type list as needed.
   • Initial Range: enter the amount of historical data you would like to ingest (in hours).
   • Click Save.

Configure a Google SecOps plugin in Netskope

1. Go to Settings > Plugins.
2. Search for and select the Chronicle (CLS) box to open the plugin creation page.
3. Enter the following details:
   • Configuration Name: enter a name for this plugin.
   • Mapping: leave the default selection.
   • Toggle ON When enabled logs will be transformed using the selected mapping file.
   • Click Next.
   • Region: select the region of your Google SecOps.
   • Custom Region URL: optional setting that is required only if Custom Region was selected in the previous step.
   • Service Account Key: enter the JSON key provided by Google SecOps.
   • Customer ID: enter the customer ID of your Google SecOps tenant.
   • Click Save.

Configure a Log Shipper Business Rule for Google SecOps

1. Go to Log Shipper > Business Rules.
2. By default, there is a business rule that filters all alerts and events.
3. If you want to filter out any specific type of alert, or event, click Create New Rule and configure a new business rule by adding the rule name and filter.
4. Click Save.

Configure Log Shipper SIEM Mappings for Google SecOps

1. Go to Log Shipper > SIEM Mappings
2. Click Add SIEM Mapping.
3. Enter the following details:
   • Source Configuration: select Netskope CLS plugin.
   • Destination Configuration: select the Google SecOps plugin.
   • Business Rule: select the rule you created earlier.
   • Click Save.

Validate pulling and workflow of Events and Alerts in Netskope

1. Go to Logging in Netskope Cloud Exchange.
2. Search for the pulled logs.
3. In Logging, search for ingested events & alerts with the filter message contains ingested.
4. The ingested logs will be filtered.

UDM Mapping Table

Log Field	UDM Mapping	Logic
applicationType	security_result.detection_fields[].key: "applicationType" security_result.detection_fields[].value: applicationType	Directly mapped from the corresponding CEF field.
appcategory	security_result.category_details[]: appcategory	Directly mapped from the corresponding CEF field.
browser	security_result.detection_fields[].key: "browser" security_result.detection_fields[].value: browser	Directly mapped from the corresponding CEF field.
c-ip	principal.asset.ip[]: c-ip principal.ip[]: c-ip	Directly mapped from the corresponding JSON field.
cci	security_result.detection_fields[].key: "cci" security_result.detection_fields[].value: cci	Directly mapped from the corresponding CEF field.
ccl	security_result.confidence: Derived value security_result.confidence_details: ccl	security_result.confidence is derived based on the value of ccl: "excellent" or "high" maps to HIGH_CONFIDENCE, "medium" maps to MEDIUM_CONFIDENCE, "low" or "poor" maps to LOW_CONFIDENCE, and "unknown" or "not_defined" maps to UNKNOWN_CONFIDENCE. security_result.confidence_details is directly mapped from ccl.
clientBytes	network.sent_bytes: clientBytes	Directly mapped from the corresponding CEF field.
cs-access-method	additional.fields[].key: "accessMethod" additional.fields[].value.string_value: cs-access-method	Directly mapped from the corresponding JSON field.
cs-app	additional.fields[].key: "x-cs-app" additional.fields[].value.string_value: cs-app principal.application: cs-app	Directly mapped from the corresponding JSON field.
cs-app-activity	additional.fields[].key: "x-cs-app-activity" additional.fields[].value.string_value: cs-app-activity	Directly mapped from the corresponding JSON field.
cs-app-category	additional.fields[].key: "x-cs-app-category" additional.fields[].value.string_value: cs-app-category	Directly mapped from the corresponding JSON field.
cs-app-cci	additional.fields[].key: "x-cs-app-cci" additional.fields[].value.string_value: cs-app-cci	Directly mapped from the corresponding JSON field.
cs-app-ccl	additional.fields[].key: "x-cs-app-ccl" additional.fields[].value.string_value: cs-app-ccl	Directly mapped from the corresponding JSON field.
cs-app-from-user	additional.fields[].key: "x-cs-app-from-user" additional.fields[].value.string_value: cs-app-from-user principal.user.email_addresses[]: cs-app-from-user	Directly mapped from the corresponding JSON field.
cs-app-instance-id	additional.fields[].key: "x-cs-app-instance-id" additional.fields[].value.string_value: cs-app-instance-id	Directly mapped from the corresponding JSON field.
cs-app-object-name	additional.fields[].key: "x-cs-app-object-name" additional.fields[].value.string_value: cs-app-object-name	Directly mapped from the corresponding JSON field.
cs-app-object-type	additional.fields[].key: "x-cs-app-object-type" additional.fields[].value.string_value: cs-app-object-type	Directly mapped from the corresponding JSON field.
cs-app-suite	additional.fields[].key: "x-cs-app-suite" additional.fields[].value.string_value: cs-app-suite	Directly mapped from the corresponding JSON field.
cs-app-tags	additional.fields[].key: "x-cs-app-tags" additional.fields[].value.string_value: cs-app-tags	Directly mapped from the corresponding JSON field.
cs-bytes	network.sent_bytes: cs-bytes	Directly mapped from the corresponding JSON field.
cs-content-type	additional.fields[].key: "sc-content-type" additional.fields[].value.string_value: cs-content-type	Directly mapped from the corresponding JSON field.
cs-dns	target.asset.hostname[]: cs-dns target.hostname: cs-dns	Directly mapped from the corresponding JSON field.
cs-host	target.asset.hostname[]: cs-host target.hostname: cs-host	Directly mapped from the corresponding JSON field.
cs-method	network.http.method: cs-method	Directly mapped from the corresponding JSON field.
cs-referer	network.http.referral_url: cs-referer	Directly mapped from the corresponding JSON field.
cs-uri	additional.fields[].key: "cs-uri" additional.fields[].value.string_value: cs-uri	Directly mapped from the corresponding JSON field.
cs-uri-path	additional.fields[].key: "x-cs-uri-path" additional.fields[].value.string_value: cs-uri-path	Directly mapped from the corresponding JSON field.
cs-uri-port	additional.fields[].key: "cs-uri-port" additional.fields[].value.string_value: cs-uri-port	Directly mapped from the corresponding JSON field.
cs-uri-scheme	network.application_protocol: cs-uri-scheme	Directly mapped from the corresponding JSON field after converting to uppercase.
cs-user-agent	network.http.parsed_user_agent: Parsed user agent network.http.user_agent: cs-user-agent	network.http.parsed_user_agent is derived by parsing the cs-user-agent field using the "parseduseragent" filter.
cs-username	principal.user.userid: cs-username	Directly mapped from the corresponding JSON field.
date	metadata.event_timestamp.seconds: Epoch seconds from date and time fields metadata.event_timestamp.nanos: 0	The date and time are combined and converted to epoch seconds and nanoseconds. Nanoseconds are set to 0.
device	intermediary.hostname: device	Directly mapped from the corresponding CEF field.
dst	target.ip[]: dst	Directly mapped from the corresponding CEF field.
dst_country	target.location.country_or_region: dst_country	Directly mapped from the corresponding grokked field.
dst_ip	target.asset.ip[]: dst_ip target.ip[]: dst_ip	Directly mapped from the corresponding grokked field.
dst_location	target.location.city: dst_location	Directly mapped from the corresponding grokked field.
dst_region	target.location.state: dst_region	Directly mapped from the corresponding grokked field.
dst_zip	Not mapped	This field is not mapped to the UDM.
duser	target.user.email_addresses[]: duser target.user.user_display_name: duser	Directly mapped from the corresponding CEF field.
dvchost	about.hostname: dvchost target.asset.hostname[]: dvchost target.hostname: dvchost	Directly mapped from the corresponding CEF field.
event_timestamp	metadata.event_timestamp.seconds: event_timestamp	Directly mapped from the corresponding grokked field.
hostname	target.asset.hostname[]: hostname target.hostname: hostname	Directly mapped from the corresponding CEF field.
IncidentID	security_result.detection_fields[].key: "IncidentID" security_result.detection_fields[].value: IncidentID	Directly mapped from the corresponding CEF field.
intermediary	intermediary: intermediary	Directly mapped from the corresponding CEF field.
md5	target.file.md5: md5	Directly mapped from the corresponding CEF field.
message	Various UDM fields	The message field is parsed based on whether it contains "CEF". If it does, it's treated as a CEF log. Otherwise, it's parsed as either a space-delimited string or JSON. See the "Parsing Logic" section for details.
mime_type1	Not mapped	This field is not mapped to the UDM.
mime_type2	Not mapped	This field is not mapped to the UDM.
mwDetectionEngine	additional.fields[].key: "mwDetectionEngine" additional.fields[].value.string_value: mwDetectionEngine	Directly mapped from the corresponding CEF field.
mwType	metadata.description: mwType	Directly mapped from the corresponding CEF field.
os	principal.platform: Derived value	The platform is derived from the os field: "Windows" maps to WINDOWS, "MAC" maps to MAC, and "LINUX" maps to LINUX.
page	network.http.referral_url: page	Directly mapped from the corresponding CEF field.
port	Not mapped	This field is not mapped to the UDM.
referer	network.http.referral_url: referer	Directly mapped from the corresponding CEF field.
requestClientApplication	network.http.parsed_user_agent: Parsed user agent network.http.user_agent: requestClientApplication	network.http.parsed_user_agent is derived by parsing the requestClientApplication field using the "parseduseragent" filter.
request_method	network.http.method: request_method	Directly mapped from the corresponding grokked field.
request_protocol	Not mapped	This field is not mapped to the UDM.
rs-status	additional.fields[].key: "rs-status" additional.fields[].value.string_value: rs-status network.http.response_code: rs-status	Directly mapped from the corresponding JSON field.
s-ip	target.asset.ip[]: s-ip target.ip[]: s-ip	Directly mapped from the corresponding JSON field.
sc-bytes	network.received_bytes: sc-bytes	Directly mapped from the corresponding JSON field.
sc-content-type	additional.fields[].key: "sc-content-type" additional.fields[].value.string_value: sc-content-type	Directly mapped from the corresponding JSON field.
sc-status	network.http.response_code: sc-status	Directly mapped from the corresponding JSON field.
serverBytes	network.received_bytes: serverBytes	Directly mapped from the corresponding CEF field.
sha256	target.file.sha256: sha256	Directly mapped from the corresponding CEF field.
src	principal.ip[]: src	Directly mapped from the corresponding CEF field.
src_country	principal.location.country_or_region: src_country	Directly mapped from the corresponding grokked field.
src_ip	principal.asset.ip[]: src_ip principal.ip[]: src_ip	Directly mapped from the corresponding grokked field.
src_latitude	Not mapped	This field is not mapped to the UDM.
src_location	principal.location.city: src_location	Directly mapped from the corresponding grokked field.
src_longitude	Not mapped	This field is not mapped to the UDM.
src_region	principal.location.state: src_region	Directly mapped from the corresponding grokked field.
src_zip	Not mapped	This field is not mapped to the UDM.
suser	principal.user.user_display_name: suser	Directly mapped from the corresponding CEF field.
target_host	target.asset.hostname[]: target_host target.hostname: target_host	Directly mapped from the corresponding grokked field.
time	metadata.event_timestamp.seconds: Epoch seconds from date and time fields metadata.event_timestamp.nanos: 0	The date and time are combined and converted to epoch seconds and nanoseconds. Nanoseconds are set to 0.
timestamp	metadata.event_timestamp.seconds: timestamp	Directly mapped from the corresponding CEF field.
ts	metadata.event_timestamp.seconds: Epoch seconds from ts metadata.event_timestamp.nanos: 0	The timestamp is converted to epoch seconds and nanoseconds. Nanoseconds are set to 0.
url	target.url: url	Directly mapped from the corresponding CEF field.
user_agent	network.http.parsed_user_agent: Parsed user agent network.http.user_agent: user_agent	network.http.parsed_user_agent is derived by parsing the user_agent field using the "parseduseragent" filter.
user_ip	Not mapped	This field is not mapped to the UDM.
user_key	principal.user.email_addresses[]: user_key	Directly mapped from the corresponding grokked field.
version	Not mapped	This field is not mapped to the UDM.
x-c-browser	additional.fields[].key: "x-c-browser" additional.fields[].value.string_value: x-c-browser	Directly mapped from the corresponding JSON field.
x-c-browser-version	additional.fields[].key: "x-c-browser-version" additional.fields[].value.string_value: x-c-browser-version	Directly mapped from the corresponding JSON field.
x-c-country	principal.location.country_or_region: x-c-country	Directly mapped from the corresponding JSON field.
x-c-device	additional.fields[].key: "x-c-device" additional.fields[].value.string_value: x-c-device	Directly mapped from the corresponding JSON field.
x-c-latitude	principal.location.region_coordinates.latitude: x-c-latitude	Directly mapped from the corresponding JSON field.
x-c-local-time	security_result.detection_fields[].key: "x-c-local-time" security_result.detection_fields[].value: x-c-local-time	Directly mapped from the corresponding JSON field.
x-c-location	principal.location.name: x-c-location	Directly mapped from the corresponding JSON field.
x-c-longitude	principal.location.region_coordinates.longitude: x-c-longitude	Directly mapped from the corresponding JSON field.
x-c-os	principal.platform: Derived value	The platform is derived from the x-c-os field: "Windows" maps to WINDOWS, "MAC" maps to MAC, and "LINUX" maps to LINUX.
x-c-region	principal.location.state: x-c-region	Directly mapped from the corresponding JSON field.
x-c-zipcode	additional.fields[].key: "x-c-zipcode" additional.fields[].value.string_value: x-c-zipcode	Directly mapped from the corresponding JSON field.
x-category	additional.fields[].key: "x-category" additional.fields[].value.string_value: x-category	Directly mapped from the corresponding JSON field.
x-category-id	additional.fields[].key: "x-category-id" additional.fields[].value.string_value: x-category-id	Directly mapped from the corresponding JSON field.
x-cs-access-method	additional.fields[].key: "accessMethod" additional.fields[].value.string_value: x-cs-access-method	Directly mapped from the corresponding JSON field.
x-cs-app	principal.application: x-cs-app additional.fields[].key: "x-cs-app" additional.fields[].value.string_value: x-cs-app	Directly mapped from the corresponding JSON field.
x-cs-app-activity	additional.fields[].key: "x-cs-app-activity" additional.fields[].value.string_value: x-cs-app-activity	Directly mapped from the corresponding JSON field.
x-cs-app-category	additional.fields[].key: "x-cs-app-category" additional.fields[].value.string_value: x-cs-app-category	Directly mapped from the corresponding JSON field.
x-cs-app-cci	additional.fields[].key: "x-cs-app-cci" additional.fields[].value.string_value: x-cs-app-cci	Directly mapped from the corresponding JSON field.
x-cs-app-from-user	additional.fields[].key: "x-cs-app-from-user" additional.fields[].value.string_value: x-cs-app-from-user	Directly mapped from the corresponding JSON field.
x-cs-app-object-id	additional.fields[].key: "x-cs-app-object-id" additional.fields[].value.string_value: x-cs-app-object-id	Directly mapped from the corresponding JSON field.
x-cs-app-object-name	additional.fields[].key: "x-cs-app-object-name" additional.fields[].value.string_value: x-cs-app-object-name	Directly mapped from the corresponding JSON field.
x-cs-app-object-type	additional.fields[].key: "x-cs-app-object-type" additional.fields[].value.string_value: x-cs-app-object-type	Directly mapped from the corresponding JSON field.
x-cs-app-suite	additional.fields[].key: "x-cs-app-suite" additional.fields[].value.string_value: x-cs-app-suite	Directly mapped from the corresponding JSON field.
x-cs-app-tags	additional.fields[].key: "x-cs-app-tags" additional.fields[].value.string_value: x-cs-app-tags	Directly mapped from the corresponding JSON field.
x-cs-app-to-user	additional.fields[].key: "x-cs-app-to-user" additional.fields[].value.string_value: x-cs-app-to-user	Directly mapped from the corresponding JSON field.
x-cs-dst-ip	security_result.detection_fields[].key: "x-cs-dst-ip" security_result.detection_fields[].value: x-cs-dst-ip target.asset.ip[]: x-cs-dst-ip target.ip[]: x-cs-dst-ip	Directly mapped from the corresponding JSON field.
x-cs-dst-port	security_result.detection_fields[].key: "x-cs-dst-port" security_result.detection_fields[].value: x-cs-dst-port target.port: x-cs-dst-port	Directly mapped from the corresponding JSON field.
x-cs-http-version	security_result.detection_fields[].key: "x-cs-http-version" security_result.detection_fields[].value: x-cs-http-version	Directly mapped from the corresponding JSON field.
x-cs-page-id	additional.fields[].key: "x-cs-page-id" additional.fields[].value.string_value: x-cs-page-id	Directly mapped from the corresponding JSON field.
x-cs-session-id	network.session_id: x-cs-session-id	Directly mapped from the corresponding JSON field.
x-cs-site	additional.fields[].key: "x-cs-site" additional.fields[].value.string_value: x-cs-site	Directly mapped from the corresponding JSON field.
x-cs-sni	network.tls.client.server_name: x-cs-sni	Directly mapped from the corresponding JSON field.
x-cs-src-ip	principal.asset.ip[]: x-cs-src-ip principal.ip[]: x-cs-src-ip security_result.detection_fields[].key: "x-cs-src-ip" security_result.detection_fields[].value: x-cs-src-ip	Directly mapped from the corresponding JSON field.
x-cs-src-ip-egress	principal.asset.ip[]: x-cs-src-ip-egress principal.ip[]: x-cs-src-ip-egress security_result.detection_fields[].key: "x-cs-src-ip-egress" security_result.detection_fields[].value: x-cs-src-ip-egress	Directly mapped from the corresponding JSON field.
x-cs-src-port	principal.port: x-cs-src-port security_result.detection_fields[].key: "x-cs-src-port" security_result.detection_fields[].value: x-cs-src-port	Directly mapped from the corresponding JSON field.
x-cs-ssl-cipher	network.tls.cipher: x-cs-ssl-cipher	Directly mapped from the corresponding JSON field.
x-cs-ssl-fronting-error	security_result.detection_fields[].key: "x-cs-ssl-fronting-error" security_result.detection_fields[].value: x-cs-ssl-fronting-error	Directly mapped from the corresponding JSON field.
x-cs-ssl-handshake-error	security_result.detection_fields[].key: "x-cs-ssl-handshake-error" security_result.detection_fields[].value: x-cs-ssl-handshake-error	Directly mapped from the corresponding JSON field.
x-cs-ssl-ja3	network.tls.client.ja3: x-cs-ssl-ja3	Directly mapped from the corresponding JSON field.
x-cs-ssl-version	network.tls.version: x-cs-ssl-version	Directly mapped from the corresponding JSON field.
x-cs-timestamp	metadata.event_timestamp.seconds: x-cs-timestamp	Directly mapped from the corresponding JSON field.
x-cs-traffic-type	additional.fields[].key: "trafficType" additional.fields[].value.string_value: x-cs-traffic-type	Directly mapped from the corresponding JSON field.
x-cs-tunnel-src-ip	security_result.detection_fields[].key: "x-cs-tunnel-src-ip" security_result.detection_fields[].value: x-cs-tunnel-src-ip	Directly mapped from the corresponding JSON field.
x-cs-uri-path	additional.fields[].key: "x-cs-uri-path" additional.fields[].value.string_value: x-cs-uri-path	Directly mapped from the corresponding JSON field.
x-cs-url	target.url: x-cs-url	Directly mapped from the corresponding JSON field.
x-cs-userip	security_result.detection_fields[].key: "x-cs-userip" security_result.detection_fields[].value: x-cs-userip	Directly mapped from the corresponding JSON field.
x-other-category	security_result.category_details[]: x-other-category	Directly mapped from the corresponding JSON field.
x-other-category-id	security_result.detection_fields[].key: "x-other-category-id" security_result.detection_fields[].value: x-other-category-id	Directly mapped from the corresponding JSON field.
x-policy-action	security_result.action: Derived value security_result.action_details: x-policy-action	security_result.action is derived by converting x-policy-action to uppercase. If the uppercase value is "ALLOW" or "BLOCK", it's used directly. Otherwise, it's not mapped. security_result.action_details is directly mapped from x-policy-action.
x-policy-dst-host	security_result.detection_fields[].key: "x-policy-dst-host" security_result.detection_fields[].value: x-policy-dst-host	Directly mapped from the corresponding JSON field.
x-policy-dst-host-source	security_result.detection_fields[].key: "x-policy-dst-host-source" security_result.detection_fields[].value: x-policy-dst-host-source	Directly mapped from the corresponding JSON field.
x-policy-dst-ip	security_result.detection_fields[].key: "x-policy-dst-ip" security_result.detection_fields[].value: x-policy-dst-ip	Directly mapped from the corresponding JSON field.
x-policy-name	security_result.rule_name: x-policy-name	Directly mapped from the corresponding JSON field.
x-policy-src-ip	security_result.detection_fields[].key: "x-policy-src-ip" security_result.detection_fields[].value: x-policy-src-ip	Directly mapped from the corresponding JSON field.
x-r-cert-enddate	network.tls.server.certificate.not_after.seconds: Epoch seconds from x-r-cert-enddate	The date is converted to epoch seconds.
x-r-cert-expired	additional.fields[].key: "x-r-cert-expired" additional.fields[].value.string_value: x-r-cert-expired	Directly mapped from the corresponding JSON field.
x-r-cert-incomplete-chain	additional.fields[].key: "x-r-cert-incomplete-chain" additional.fields[].value.string_value: x-r-cert-incomplete-chain	Directly mapped from the corresponding JSON field.
x-r-cert-issuer-cn	network.tls.server.certificate.issuer: x-r-cert-issuer-cn	Directly mapped from the corresponding JSON field.
x-r-cert-mismatch	additional.fields[].key: "x-r-cert-mismatch" additional.fields[].value.string_value: x-r-cert-mismatch	Directly mapped from the corresponding JSON field.
x-r-cert-revoked	additional.fields[].key: "x-r-cert-revoked" additional.fields[].value.string_value: x-r-cert-revoked	Directly mapped from the corresponding JSON field.
x-r-cert-self-signed	additional.fields[].key: "x-r-cert-self-signed" additional.fields[].value.string_value: x-r-cert-self-signed	Directly mapped from the corresponding JSON field.
x-r-cert-startdate	network.tls.server.certificate.not_before.seconds: Epoch seconds from x-r-cert-startdate	The date is converted to epoch seconds.
x-r-cert-subject-cn	network.tls.server.certificate.subject: x-r-cert-subject-cn	Directly mapped from the corresponding JSON field.
x-r-cert-untrusted-root	additional.fields[].key: "x-r-cert-untrusted-root" additional.fields[].value.string_value: x-r-cert-untrusted-root	Directly mapped from the corresponding JSON field.
x-r-cert-valid	additional.fields[].key: "x-r-cert-valid" additional.fields[].value.string_value: x-r-cert-valid	Directly mapped from the corresponding JSON field.
x-request-id	additional.fields[].key: "requestId" additional.fields[].value.string_value: x-request-id	Directly mapped from the corresponding JSON field.
x-rs-file-category	additional.fields[].key: "x-rs-file-category" additional.fields[].value.string_value: x-rs-file-category	Directly mapped from the corresponding JSON field.
x-rs-file-type	additional.fields[].key: "x-rs-file-type" additional.fields[].value.string_value: x-rs-file-type	Directly mapped from the corresponding JSON field.
x-s-country	target.location.country_or_region: x-s-country	Directly mapped from the corresponding JSON field.
x-s-dp-name	additional.fields[].key: "x-s-dp-name" additional.fields[].value.string_value: x-s-dp-name	Directly mapped from the corresponding JSON field.
x-s-latitude	target.location.region_coordinates.latitude: x-s-latitude	Directly mapped from the corresponding JSON field.
x-s-location	target.location.name: x-s-location	Directly mapped from the corresponding JSON field.
x-s-longitude	target.location.region_coordinates.longitude: x-s-longitude	Directly mapped from the corresponding JSON field.
x-s-region	target.location.state: x-s-region	Directly mapped from the corresponding JSON field.
x-s-zipcode	additional.fields[].key: "x-s-zipcode" additional.fields[].value.string_value: x-s-zipcode	Directly mapped from the corresponding JSON field.
x-sr-ssl-cipher	security_result.detection_fields[].key: "x-sr-ssl-cipher" security_result.detection_fields[].value: x-sr-ssl-cipher	Directly mapped from the corresponding JSON field.
x-sr-ssl-client-certificate-error	security_result.detection_fields[].key: "x-sr-ssl-client-certificate-error" security_result.detection_fields[].value: x-sr-ssl-client-certificate-error	Directly mapped from the corresponding JSON field.
x-sr-ssl-engine-action	security_result.detection_fields[].key: "x-sr-ssl-engine-action" security_result.detection_fields[].value: x-sr-ssl-engine-action	Directly mapped from the corresponding JSON field.
x-sr-ssl-engine-action-reason	security_result.detection_fields[].key: "x-sr-ssl-engine-action-reason" security_result.detection_fields[].value: x-sr-ssl-engine-action-reason	Directly mapped from the corresponding JSON field.
x-sr-ssl-handshake-error	security_result.detection_fields[].key: "x-sr-ssl-handshake-error" security_result.detection_fields[].value: x-sr-ssl-handshake-error	Directly mapped from the corresponding JSON field.
x-sr-ssl-ja3s	network.tls.server.ja3s: x-sr-ssl-ja3s	Directly mapped from the corresponding JSON field.
x-sr-ssl-malformed-ssl	security_result.detection_fields[].key: "x-sr-ssl-malformed-ssl" security_result.detection_fields[].value: x-sr-ssl-malformed-ssl	Directly mapped from the corresponding JSON field.
x-sr-ssl-version	security_result.detection_fields[].key: "x-sr-ssl-version" security_result.detection_fields[].value: x-sr-ssl-version	Directly mapped from the corresponding JSON field.
x-s-custom-signing-ca-error	security_result.detection_fields[].key: "x-s-custom-signing-ca-error" security_result.detection_fields[].value: x-s-custom-signing-ca-error	Directly mapped from the corresponding JSON field.
x-ssl-bypass	security_result.detection_fields[].key: "SSL BYPASS" security_result.detection_fields[].value: x-ssl-bypass or x-ssl-bypass-reason	If x-ssl-bypass is "Yes" and x-ssl-bypass-reason is present, the value of x-ssl-bypass-reason is used. Otherwise, the value of x-ssl-bypass is used.
x-ssl-policy-action	security_result.detection_fields[].key: "x-ssl-policy-action" security_result.detection_fields[].value: x-ssl-policy-action	Directly mapped from the corresponding JSON field.
x-ssl-policy-categories	security_result.category_details[]: x-ssl-policy-categories	Directly mapped from the corresponding JSON field.
x-ssl-policy-dst-host	security_result.detection_fields[].key: "x-ssl-policy-dst-host" security_result.detection_fields[].value: x-ssl-policy-dst-host	Directly mapped from the corresponding JSON field.
x-ssl-policy-dst-host-source	security_result.detection_fields[].key: "x-ssl-policy-dst-host-source" security_result.detection_fields[].value: x-ssl-policy-dst-host-source	Directly mapped from the corresponding JSON field.
x-ssl-policy-dst-ip	security_result.detection_fields[].key: "x-ssl-policy-dst-ip" security_result.detection_fields[].value: x-ssl-policy-dst-ip	Directly mapped from the corresponding JSON field.
x-ssl-policy-name	security_result.rule_name: x-ssl-policy-name	Directly mapped from the corresponding JSON field.
x-ssl-policy-src-ip	security_result.detection_fields[].key: "x-ssl-policy-src-ip" security_result.detection_fields[].value: x-ssl-policy-src-ip	Directly mapped from the corresponding JSON field.
x-sr-dst-ip	security_result.detection_fields[].key: "x-sr-dst-ip" security_result.detection_fields[].value: x-sr-dst-ip	Directly mapped from the corresponding JSON field.
x-sr-dst-port	security_result.detection_fields[].key: "x-sr-dst-port" security_result.detection_fields[].value: x-sr-dst-port	Directly mapped from the corresponding JSON field.
x-type	additional.fields[].key: "xType" additional.fields[].value.string_value: x-type	Directly mapped from the corresponding JSON field.
x-transaction-id	additional.fields[].key: "transactionId" additional.fields[].value.string_value: x-transaction-id	Directly mapped from the corresponding JSON field.
N/A	metadata.vendor_name: "Netskope"	Hardcoded value in the parser.
N/A	metadata.product_name: "Netskope Webproxy"	Set to "Netskope Webproxy" if not already present.
N/A	metadata.log_type: "NETSKOPE_WEBPROXY"	Hardcoded value in the parser.

Changes

2024-06-04

• Added Grok to handle unparsed logs.
• Mapped "url" to "target.url".
• Mapped "appSessionId" to "network.session_id".
• Mapped "page" to "network.http.referral_url".
• Mapped "appcategory" to "security_result.category_details".
• Mapped "clientBytes" to "network.sent_bytes".
• Mapped "serverBytes" to "network.received_bytes".
• Mapped "ccl" to "security_result.confidence_details".
• Mapped "IncidentID", "applicationType", "browser", and "cci" to "security_result.detection_fields".

2024-04-22

• Mapped "x-cs-app-ccl","x-cs-app-instance-id","x-cs-app-tags" ,"x-cs-app-instance-name" ,"x-cs-app-instance-tag", "x-cs-app-to-user","x-cs-app-object-id" and "x-cs-app-from-user" to "additional.fields".

2024-02-26

• Changed mapping of "cs-bytes" from "network.received_bytes" to "network.sent_bytes".
• Changed mapping of "sc-bytes" from "network.sent_bytes" to "network.received_bytes".
• Mapped "x-cs-app-object-name" to "additional.fields".
• Mapped "x-cs-app-from-user" to "principal.user.email_addresses".

2023-12-22

• If "cs-dns" value is "null", changed "cs-host" mapping from "principal.hostname" to "target.hostname".
• Changed "cs-dns" mapping from "principal.hostname" to "target.hostname".
• If "sc-status" value is "null", mapped "rs-status" to "network.http.response_code".
• Mapped "x-cs-app" to "principal.application".
• Mapped "x-cs-src-ip-egress" to "principal.ip".

2023-12-08

• Added on_error check to parse the failing logs.
• Set "metadata.vendor_name" to "Netskope" and "metadata.product_name" to "Netskope Webproxy".
• Added conditional check for "src_region", "src_country", "src_location", "dst_region", "dst_country", "dst_location" before mapping.

2023-10-09

• Mapped "dvchost" to "target.hostname" if "target.hostname" is not present.
• Added a null check prior mapping "requestClientApplication".

2023-09-12

• Mapped "x-cs-dst-ip" to "target.ip".
• Mapped "x-cs-src-ip" to "principal.ip".
• Mapped "x-cs-src-port" to "principal.port".
• Mapped "x-cs-dst-port" to "target.port".
• Added on_error check for date filter.
• Added conditional checks before mapping "metadata.event_type".

2023-08-28

• Mapped "cs-uri" to "additional.fields".
• Mapped "cs-uri-port" to "additional.fields".
• Mapped "x-s-zipcode" to "additional.fields".
• Mapped "x-c-zipcode" to "additional.fields".
• Mapped "x-cs-site" to "additional.fields".
• Mapped "x-category" to "additional.fields".
• Mapped "x-sr-ssl-version" to "security_result.detection_fields".
• Mapped "x-sr-ssl-cipher" to "security_result.detection_fields".
• Mapped "x-cs-src-ip-egress" to "security_result.detection_fields".
• Mapped "x-cs-userip" to "security_result.detection_fields".
• Mapped "x-cs-url" to "target.url".
• Mapped "x-cs-uri-path" to "additional.fields".
• Mapped "x-cs-app-cci" to "additional.fields".
• Mapped "x-cs-app-object-type" to "additional.fields".
• Mapped "x-rs-file-type" to "additional.fields".
• Mapped "x-rs-file-category" to "additional.fields".

2023-08-17

• Added support for new JSON type log format.

2023-06-22

• Added support for new SYSLOG+JSON type log format.

2023-05-30

• Mapped "duser" to "target.user.email_addresses".
• Mapped "requestClientApplication" to "network.http.parsed_user_agent".

2023-02-03

• Mapped "Domain" to "principal.administrative_domain".

2023-01-09

• Added conditional checks for mapping different event_type based on required parameters present.
• Parsed different formats of "rt".

2022-04-06

• Enhancement-Added mappings for new fields
• md5, mwDetectionEngine, mwProfile, mwType mapped to udm.