All Apps and Add-ons

Why are the Input Add On for Netskope limit events ingested to only alerts in?

saulverde
Path Finder

We are currently deploying the netspoke apps in our environment. We already have all of the events that are going to our casb indexed into splunk and we don't want to duplicate data.

We setup the Input Addon to only pull in Alert and Audit events. Netspoke seems to consider events "alerts" even if they don't trigger an alert in the netspoke administration console. Does anyone have experience with a query that we could use in the Input Addon to limit the Alert events to only the events that have triggered an alert in the CASB? Thanks guys.

0 Karma
1 Solution

saulverde
Path Finder

This was a mistake on our part. They were alerts but it was all of the alerts that had been stored up in Netspoke during our PoC, testing and implementation. We just got them all at once.

View solution in original post

0 Karma

saulverde
Path Finder

This was a mistake on our part. They were alerts but it was all of the alerts that had been stored up in Netspoke during our PoC, testing and implementation. We just got them all at once.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!