Netskope

Connect Qevlar to Netskope to investigate alerts with cloud-traffic context across SaaS, IaaS, and web. This page lists the API permissions Qevlar requires and how to grant them.

Overview

Qevlar authenticates to Netskope with a REST API v2 token sent as a bearer token — no user sign-in per request. Access is governed by the endpoint privileges granted to the token. The connector is read-only.

The API base is your Netskope tenant URL.

Connection details

Enter these values when configuring the connector in Qevlar:

Required permissions

Create a REST API v2 token with read access to the events data-search endpoints. Read on /api/v2/events/datasearch/alert is required, to retrieve Netskope alerts. Read on /api/v2/events/datasearch/network and /page is recommended, for richer network and page event context. No write privileges are required.

Setup

1. Open REST API v2 tokens. In the Netskope console, go to Settings → Tools → REST API v2.
2. Create a token. Add a new token and grant read access to the /api/v2/events/datasearch/ endpoints — at minimum alert (required), plus network and page (recommended).
3. Record the token. Copy it immediately — it is shown only once.
4. Get the tenant URL. Use your Netskope tenant URL.
5. Configure the connector. In Qevlar, add the Netskope connector and enter the connection details above.

Verify the connection

After saving, Qevlar runs a health check that reads one alert event. If it fails, check, in order:

1. The token has read access to the events data-search endpoints.
2. The token is valid and has not been revoked.
3. The Tenant URL is correct.

API reference

Auth header: Authorization: Bearer <token>.