CCX Extensions for Netskope

About Us: CyberCX is Australia’s greatest force of cyber security experts. Our highly skilled professional services team operates a 24x7 on-shore security operations centre (SOC) servicing corporate and public sector organisations across Australia and New Zealand, specialising in Security Operations services leveraging Splunk. Description: The CCX Add-on for Netskope Extensions looks to provide additional field extraction and CIM compliance for Netskope log sources captured via the Add-on Netskope Add-on For Splunk. This Technical Add-on does not replace the public Splunk Add-on for Netskope (https://splunkbase.splunk.com/app/3808/) but works as an additonal extension to be deployed on Search Heads (only). Currently this add-on provides additional extraction and CIM compliance for sourcetypes: - netskope:alert - netskope:application - netskope:connection - netskope:incident - netskope:network - netskope:audit Fully compatible with Splunk Enterprise and Splunk Cloud, built by an Ops team for Ops teams. Features: - This TA currently supports logtypes tagged under the following CIM datamodels: Alerts, Authentication, Change, Inventory, Data Loss Prevention (DLP), Malware, Network Traffic, Network Session, and Web.