Skip to main content
Netskope is currently in beta
Wirespeed connects to your Netskope Security Cloud tenant with a REST API v2 token. This is the SSE/SASE product (*.goskope.com), not Device Intelligence.

​
Prerequisites

  • A Netskope tenant hostname (for example company.goskope.com or company.eu.goskope.com)
  • A REST API v2 token from a Service Account whose role has View on:
    • Skope IT → Alerts
    • Skope IT → Application Events
    • Skope IT → Network Events
    • Skope IT → Page Events (HTTP connection / page events)
    • Administration → Users & Groups
  • If the tenant uses an IP allowlist (Settings → Administration → IP Allowlist), add Wirespeed egress IPs to the custom list

​
Create a REST API v2 token

  1. Log in to the Netskope tenant
  2. Open Settings → Administration → Administrators & Roles → Roles and create a role with View on the functional areas listed above. Set every other permission to None
  3. Open the Administrators tab, click Service Account, assign that role, and generate a REST API token
  4. Copy the token when it is shown. It is not displayed again
On older tenants that still have Settings → Tools → REST API v2 → New Token, create a token there and add Read on:
  • /api/v2/events/dataexport/events/alert
  • /api/v2/events/dataexport/events/application
  • /api/v2/events/dataexport/events/page
  • /api/v2/events/dataexport/events/network
  • /api/v2/scim/Users
instead of using a Service Account role.

​
Add the integration in Wirespeed

  1. In Wirespeed, navigate to Integrations > Add Integration > Netskope
  2. Enter the Tenant Hostname (for example company.eu.goskope.com). A full tenant URL also works
  3. Paste the REST API v2 token
  4. Submit the integration

​
What Wirespeed ingests

On first sync, Wirespeed backfills about 24 hours, then continues from where the previous pull left off.