TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM Syslog
ENVIRONMENT: Netskope
SUMMARY: Configuration Guide for ingesting Netskope Cloud Exchange syslog data in the CEF format.

• Vendor Information
• Before You Begin (very important, don't skip!)
• Device Configuration Checklist
• Validate that Netskope is Sending Data

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to setup a syslog collector and allow it to send traffic to SIEM.

Vendor Information

Before You Begin, confirm:

• You have a Netskope tenant with admin access.
• Netskope Cloud Exchange is deployed, with the Log Shipper module and the Netskope Tenant plugin already configured.
• If you plan to ingest BWAN events or WebTx: the corresponding Netskope plugins (BWAN plugin; AWS/Azure Log Streaming plugins) are configured.
• You have a Huntress syslog collector enabled and reachable from your Cloud Exchange host. To setup a new collector, follow the Huntress Managed SIEM Syslog Guide keeping these points in mind:
  • While setting up the Huntress agent to act as a collector, do not specify a vendor, instead use the "Syslog (local)" option. Failure to do so will cause the source to be incorrectly identified!
  • You’ve opened a Window Firewall rule on the collector (or whichever software firewall is in use)
  • You’ve set the Windows Firewall profile to Private or Domain (Defender Firewall ignores some rules on the Public profile)
  • The endpoint acting as collector has a dedicated, open port (no other software using the port)
  • You know the collector’s internal IP address, port, and protocol. 

Device Configuration Checklist

All of the following is done inside the Netskope Cloud Exchange UI.

You do not need a Splunk Instance. Huntress collector agents act as a Splunk instance!

Configure the Syslog plugin

Go to Settings > Plugin Store and add the Syslog (CLS) plugin, then set:

• Plugin configuration name: a label for this connection.
  Example: Huntress SIEM (this will be used later)
• Format: CEF. Select the Syslog Default Mapping. CEF is the only format that Huntress supports from Netskope!
• Syslog server: the Internal IP address (or FQDN) of the Huntress Agent configured to listen for syslog. (This replaces the Splunk server used in Netskope's own documentation.)
• Syslog Protocol: UDP or TCP. This must match how your Huntress collector is listening. Do NOT select TLS.
• Syslog Port: the port your collector is listening on (default UDP 514). This port cannot be shared, your syslog collector must be the ONLY thing using this port (on the collector endpoint).
• Syslog Certificate: leave empty (this is for unsupported TLS).
• Log source Identifier: a prefix added to every log line. Suggested: netskope
• Exclude Timestamp Field / Exclude Log Source Identifier Field:
  Leave as No, these don't apply to CEF.
• Click Save. The saved configuration appears under Log Shipper > Plugins.

Configure Log Shipper Business Rules

• Go to Log Shipper > Business Rules.
• The default rule forwards all alerts and events. This is a fine starting point.
• To forward only specific alert/event types, click Create New Rule, give it a name, add your filter conditions, and Save.

Configure Log Delivery

Go to Log Shipper > Log Delivery > Add Log Delivery Configuration.

Create a mapping for each data type you want in Huntress SIEM:

• Alerts / Events
  • Source: Netskope (CLS)
  • Destination: Syslog (CLS), the plugin saved in the previous step
  • Business Rule: the rule from the previous step

• WebTx (only if forwarding web transaction logs)
  • Source: Netskope WebTx (CLS)
  • Destination: Syslog (CLS)

• Cloud Exchange Logs (optional, Netskope's own operational logs)

• Source: Cloud Exchange Logs (CLS)
• Destination: Syslog (CLS)

  Click Save. Data now begins flowing from Netskope to your Huntress collector (can take up to 24 hours to appear, varies by amount of data being logged).

Validate that Netskope is Sending Data

1. Wait 30 minutes after you complete the setup for data to be ingested by Huntress.
2. Go back to Settings > Logging
3. Search with the filter message contains "ingested" to confirm Alerts/Events (and WebTx/Logs if configured) are being sent and ingested. If nothing appears here but data is being ingested (see step 4), the issue is on the Netskope side, not the Huntress collector. Here's a starter query:
   from logs | where event.provider=="Syslog-Netskope" | where message LIKE "*ingested*" 
4. To confirm Huntress is ingesting data, check SIEM > Source Management in the Huntress portal, looking at the Netskope row at the Last Activity column (last activity will be very recent if the source is active). New sources can take up to 24 hours to appear. See the main Syslog Guide for troubleshooting.