Netskope Secure Web Gateway

SamurAI [Local] Collector	SamurAI [Cloud] Collector

This guide describes the steps required to configure Netskope Secure Web Gateway to output its web traffic logs as Transaction Events and stream them to public cloud storage (Microsoft Azure Blob Storage or Amazon S3) for ingestion to the SamurAI platform via a Cloud Collector.

Netskope Secure Web Gateway logs are collected as Transaction Events — the per-transaction records of web and cloud application traffic processed by the gateway. These are delivered by:

Configuring a Log Streaming stream in the Netskope tenant with Transaction Events as the source
Netskope writing the event files to a customer owned cloud storage bucket / container
The SamurAI Cloud Collector monitoring that storage for new files and pulling the data into the SamurAI platform

Prerequisites

Ensure that a Samurai Cloud Collector has been deployed via the SamurAI Portal for your chosen cloud provider (Microsoft Azure or Amazon Web Services).

Guide available here

The storage account / S3 bucket created via the Cloud Collector should reside in a region close to your Netskope tenant Point of Presence (PoP). For ingesting telemetry from multiple regions you need to create additional Cloud Collector(s) for each region.

Take note of the following as it will be required when configuring the Netskope destination:

Microsoft Azure — the Storage account name and the Subscription it resides in
Amazon Web Services — the S3 bucket name and the Region

If you are planning to reuse an already deployed Cloud Collector, this information can be found via:

Navigate to the SamurAI Portal
Click Telemetry and select Collectors from the main menu
Click on the name of the desired Collector
Note down the storage information presented

Storage naming requirement

This step is mandatory. The integration will not work if it is not followed.

The SamurAI platform identifies Netskope Transaction Events from the name of the storage location the data is written to. You must therefore create a dedicated Azure Blob Storage container or Amazon S3 bucket whose name ends with netskope-tx.

Netskope data	Required name suffix	Example container / bucket name
Transaction Events	`netskope-tx`	`contoso-netskope-tx`

Any name is permitted as long as it ends with netskope-tx exactly as shown — lowercase, hyphenated, with no trailing characters, path or file extension.

If the suffix does not match, the data will still be uploaded to your storage but the SamurAI platform will not be able to identify it as Netskope telemetry, and the events will not be analysed.

Configure Log Streaming in Netskope

Follow the vendor documentation guide to create the destination and stream the Transaction Events to the storage prepared above.

Configuring Destinations

When following the vendor documentation, please perform the following adjustments:

Select the destination type that matches your deployed Cloud Collector:
- Azure Blob Storage — for a Microsoft Azure Cloud Collector
- Amazon S3 — for an AWS Cloud Collector
Ensure the Bucket / Container setting references the container or bucket created in Storage naming requirement — that is, a name ending in netskope-tx.
Ensure the destination is configured against the storage account / bucket that was created during the deployment of the Cloud Collector.
When creating the stream, select Transaction Events as the source and send it to the destination created above.
Ensure the storage retention period aligns with your storage policies, however we recommend a minimum of 7 days.

Netskope requires the storage bucket / container to exist and be active before the destination can be created. Netskope also requires its Management Plane and Log Streaming IP ranges to be permitted on your cloud storage — refer to the vendor documentation for the current IP list.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.