Netskope Tables

Tables

NetskopeAlertEvents

Stores Netskope alert events triggered by policy, DLP, malware, watchlist, and UBA rules, including user identity, application context, network details, geolocation, and risk information.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
DeviceClassificationIDsSerialized	string	Serialized list of device classification IDs assigned to the device.
NSHostname	string	Hostname of the Netskope appliance or tenant that processed the event.
Count	integer	Number of times this event or activity was observed within the aggregation window.
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserKey	string	Internal Netskope key uniquely identifying the user.
UserIP	string	IP address of the user's device at the time of the event.

NetskopeApplicationEvents

Records Netskope application-level events extracted from SaaS and cloud application traffic, capturing user activity, application details, policy actions, and connection metadata.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
OriginalDestIP	string	Original destination IP address before any proxy redirection or policy interception.
SkipGeoIPLookup	string	Indicates whether geolocation lookup was skipped for this event (e.g., `yes`, `no`).
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserKey	string	Internal Netskope key uniquely identifying the user.
UserIP	string	IP address of the user's device at the time of the event.
SourceZipcode	string	Postal code associated with the source IP address based on geolocation lookup.

NetskopeAuditEvents

Contains Netskope administrative and user audit log events, recording actions such as login attempts, configuration changes, and policy modifications with user and severity context.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
RecordType	string	Type of audit record (e.g., `admin_audit_logs`, `user_audit_logs`).
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserPrincipalName	string	User principal name (UPN) from the directory, typically the user's login email address.
SAMAccountName	string	SAM account name of the user from Active Directory.
OrganizationUnit	string	Organizational unit (OU) from the directory service associated with the user.
CCL	string	Cloud Confidence Level label for the event (e.g., `excellent`, `high`, `medium`, `low`, `poor`, `unknown`).

NetskopeInfrastructureEvents

Stores Netskope infrastructure and private access events, including tunnel, session, and flow data for network connections routed through Netskope Publishers and POPs.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
RecordType	string	Type of infrastructure record (e.g., `connection`, `tunnel`, `session`).
Subtype	string	Subtype providing additional classification of the infrastructure event (e.g., `start`, `end`, `update`).
Count	integer	Number of times this event or activity was observed within the aggregation window.
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserKey	string	Internal Netskope key uniquely identifying the user.
UserIP	string	IP address of the user's device at the time of the event.

NetskopeIntegrations

Integration summary table listing all Netskope tenant integration configurations, including creation and modification metadata.

Name	Type	Description
ID	integer	Auto-incremented primary key for the Netskope integration configuration record.
TenantName	string	Name of the Netskope tenant associated with this integration configuration.
CreatedDate	datetime	Timestamp indicating when the integration configuration was created.
ModifiedDate	datetime	Timestamp indicating when the integration configuration was last modified.
CreatedBy	string	Username or identifier of the user who created the integration configuration.
ModifiedBy	string	Username or identifier of the user who last modified the integration configuration.
IntegrationID	integer	Numeric identifier linking this record to the associated integration instance.
Name	string	Display name of the Netskope integration configuration.
IsEnabled	boolean	Indicates whether the integration configuration is currently active and enabled.

NetskopeNetworkEvents

Records Netskope network-level events for web and non-web traffic flows, capturing connection details, geolocation, policy actions, and tunnel information.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
InternalEventID	string	Internal Netskope identifier for the event, used for deduplication and tracking.
ServiceIdentifier	string	Identifier of the Netskope service or module that generated the event.
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserKey	string	Internal Netskope key uniquely identifying the user.
UserIP	string	IP address of the user's device at the time of the event.
StartTime	string	Human-readable timestamp indicating when the network session or flow started.

NetskopePageEvents

Stores Netskope page-level events representing individual web page visits, including HTTP transaction counts, byte transfers, browser details, and URL category classifications.

Name	Type	Description
ConfigID	integer	Unique identifier linking the record to a specific Netskope integration configuration.
EventID	string	Unique identifier of the event record as assigned by Netskope.
Timestamp	integer	Unix epoch timestamp (seconds) indicating when the event occurred.
InsertionTimestamp	integer	Unix epoch timestamp (seconds) indicating when the event was inserted into the Netskope datastore.
Type	string	Type of event or log record (e.g., `application`, `page`, `network`, `audit`, `alert`, `infrastructure`).
Count	integer	Number of times this event or activity was observed within the aggregation window.
User	string	Email address or identifier of the user associated with the event.
URNormalized	string	Normalized form of the user identifier, typically a lowercase email address.
UserKey	string	Internal Netskope key uniquely identifying the user.
UserIP	string	IP address of the user's device at the time of the event.
OrganizationUnit	string	Organizational unit (OU) from the directory service associated with the user.
Hostname	string	Hostname of the device from which the event originated.