| SamurAI [Local] Collector | SamurAI [Cloud] Collector |
|---|---|
 |
This guide describes the steps required to configure Netskope Secure Web Gateway to output its web traffic logs as Transaction Events and stream them to public cloud storage (Microsoft Azure Blob Storage or Amazon S3) for ingestion to the SamurAI platform via a Cloud Collector.
Netskope Secure Web Gateway logs are collected as Transaction Events — the per-transaction records of web and cloud application traffic processed by the gateway. These are delivered by:
- Configuring a Log Streaming stream in the Netskope tenant with Transaction Events as the source
- Netskope writing the event files to a customer owned cloud storage bucket / container
- The SamurAI Cloud Collector monitoring that storage for new files and pulling the data into the SamurAI platform
Prerequisites
Ensure that a Samurai Cloud Collector has been deployed via the SamurAI Portal for your chosen cloud provider (Microsoft Azure or Amazon Web Services).
Take note of the following as it will be required when configuring the Netskope destination:
- Microsoft Azure — the Storage account name and the Subscription it resides in
- Amazon Web Services — the S3 bucket name and the Region
If you are planning to reuse an already deployed Cloud Collector, this information can be found via:
- Navigate to the SamurAI Portal
- Click Telemetry and select Collectors from the main menu
- Click on the name of the desired Collector
- Note down the storage information presented
Storage naming requirement
This step is mandatory. The integration will not work if it is not followed.
The SamurAI platform identifies Netskope Transaction Events from the name of the storage location the data is written to. You must therefore create a dedicated Azure Blob Storage container or Amazon S3 bucket whose name ends with netskope-tx.
| Netskope data | Required name suffix | Example container / bucket name |
|---|---|---|
| Transaction Events | netskope-tx | contoso-netskope-tx |
Any name is permitted as long as it ends with netskope-tx exactly as shown — lowercase, hyphenated, with no trailing characters, path or file extension.
If the suffix does not match, the data will still be uploaded to your storage but the SamurAI platform will not be able to identify it as Netskope telemetry, and the events will not be analysed.
Configure Log Streaming in Netskope
Follow the vendor documentation guide to create the destination and stream the Transaction Events to the storage prepared above.
When following the vendor documentation, please perform the following adjustments:
Select the destination type that matches your deployed Cloud Collector:
- Azure Blob Storage — for a Microsoft Azure Cloud Collector
- Amazon S3 — for an AWS Cloud Collector
Ensure the Bucket / Container setting references the container or bucket created in Storage naming requirement — that is, a name ending in
netskope-tx.Ensure the destination is configured against the storage account / bucket that was created during the deployment of the Cloud Collector.
When creating the stream, select Transaction Events as the source and send it to the destination created above.
Ensure the storage retention period aligns with your storage policies, however we recommend a minimum of 7 days.
Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.