Why are the Input Add On for Netskope limit events ingested to only alerts in?

[saulverde]

We are currently deploying the netspoke apps in our environment. We already have all of the events that are going to our casb indexed into splunk and we don't want to duplicate data.

We setup the Input Addon to only pull in Alert and Audit events. Netspoke seems to consider events "alerts" even if they don't trigger an alert in the netspoke administration console. Does anyone have experience with a query that we could use in the Input Addon to limit the Alert events to only the events that have triggered an alert in the CASB? Thanks guys.

[saulverde · Accepted solution]

This was a mistake on our part. They were alerts but it was all of the alerts that had been stored up in Netspoke during our PoC, testing and implementation. We just got them all at once.