> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Netskope

> Ingest SSE alerts, web/SaaS/ZTNA/network events, and users from Netskope

<Info>
  Netskope is currently in **beta**
</Info>

Wirespeed connects to your Netskope Security Cloud tenant with a REST API **v2** token. This is the SSE/SASE product (`*.goskope.com`), not Device Intelligence.

## Prerequisites

* A Netskope tenant hostname (for example `company.goskope.com` or `company.eu.goskope.com`)
* A REST API v2 token from a **Service Account** whose role has **View** on:
  * **Skope IT → Alerts**
  * **Skope IT → Application Events**
  * **Skope IT → Network Events**
  * **Skope IT → Page Events** (HTTP connection / page events)
  * **Administration → Users & Groups**
* If the tenant uses an IP allowlist (**Settings → Administration → IP Allowlist**), add Wirespeed egress IPs to the custom list

## Create a REST API v2 token

1. Log in to the Netskope tenant
2. Open **Settings → Administration → Administrators & Roles → Roles** and create a role with **View** on the functional areas listed above. Set every other permission to **None**
3. Open the **Administrators** tab, click **Service Account**, assign that role, and generate a REST API token
4. Copy the token when it is shown. It is not displayed again

On older tenants that still have **Settings → Tools → REST API v2 → New Token**, create a token there and add **Read** on:

* `/api/v2/events/dataexport/events/alert`
* `/api/v2/events/dataexport/events/application`
* `/api/v2/events/dataexport/events/page`
* `/api/v2/events/dataexport/events/network`
* `/api/v2/scim/Users`

instead of using a Service Account role.

## Add the integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Netskope**
2. Enter the **Tenant Hostname** (for example `company.eu.goskope.com`). A full tenant URL also works
3. Paste the REST API v2 token
4. Submit the integration

## What Wirespeed ingests

| Source             | Netskope API                                       | Purpose                                                                      |
| ------------------ | -------------------------------------------------- | ---------------------------------------------------------------------------- |
| Alerts             | `GET /api/v2/events/dataexport/events/alert`       | Detections (malware, DLP, policy, malsite, anomaly, and related alert types) |
| Application events | `GET /api/v2/events/dataexport/events/application` | SaaS / CASB activity logs                                                    |
| Page events        | `GET /api/v2/events/dataexport/events/page`        | Web proxy / HTTP connection logs                                             |
| Network events     | `GET /api/v2/events/dataexport/events/network`     | Network / firewall-style logs                                                |
| Users              | `GET /api/v2/scim/Users`                           | Directory sync                                                               |

<Info>On first sync, Wirespeed backfills about **24 hours**, then continues from where the previous pull left off.</Info>