Netskope SkopeIT & Incidents — Analytics & Cloud Exchange

① Skope IT — Page Events vs Application Events vs Alerts

Skope IT is where you go to answer the question every L1 gets: “did this user do the thing?” You reach it at Skope IT > Events & Alerts, and the first thing that confuses people is that there are several tabs that look similar: Application Events, Page Events, Network Events, Endpoint Events, and Alerts. Picking the wrong tab is the difference between a five-minute answer and an afternoon of scrolling.

Think of a building with CCTV. A Page Event is the full CCTV reel: every page a user opened, summarised. An Application Event is the door-buzzer log: it only records meaningful actions on a recognised app — Priya opened Drive (page), but Priya uploaded a file to Drive (app event). An Alert is the alarm: it only rings when a rule was broken. That gives you a law you can lean on: there are always more Page Events than Application Events than Alerts.

The Application Events screen is where you will live. Its default columns are Time, Username, Application, Activity, Object, Site — but the gold is hidden under Customize Columns. Add the Alert group columns — DLP Profile Name, DLP Rule Name, Action, Incident ID — and a single row tells you exactly which rule fired, what happened to the upload, and which incident it became.

The four words people mix up

Tap each — these are the Skope IT terms that trip up every new analyst.

To investigate, you have the same controls across every tab: + Add Filter, Date Range, Query Mode (free-text NQL search), Save Filter, Add to Watchlist, and Export. Two controls that look alike but are not: Save Filter simply stores the current filter so you can re-run it on demand, while Add to Watchlist pins the filter or query string as a standing watchlist you monitor continuously. Build the query once, then Save Filter for ad-hoc reuse or Add to Watchlist for ongoing concerns — instead of re-typing it every shift.

② Working a DLP incident — assign, escalate, download the file

An Alert is a record that a rule fired. An incident is the case you work. You find it at Incidents > DLP, and it behaves like a hospital triage board: every incident has a Severity (Low / Medium / High / Critical), a Status (New → In Progress → Resolved, plus your own via Create Custom Status), and an Assignee.

Bulk-select incidents and you get Mark Status As, Assign, and Severity at the top. Open a single incident and the Object Details panel exposes the real actions: Encrypt, Restore, Block, Delete, Change File Permissions, Contact Users, Check Object History, Download Object, and View More. On the right, Initiate Workflow > Escalate to Manager emails the user’s manager for a verdict (reminder at 20 days, auto-expires to “No Response” at 30). Add Incident Notes (512 chars, up to 25) so the next shift sees your reasoning.

Here is the trap that catches every new analyst: Download Object is greyed out, or the file simply is not there. Netskope only keeps the actual violating file if you told it to before the event — via Forensics. It is not retroactive. The full prerequisite chain: Settings > Forensics > Edit → set Forensics Status to Enable → pick a Configuration (Forensic profile) → Edit Settings → enable Enable original file access → Save. Only then does the Object Details page of an incident in Incidents > DLP show a working Download Object icon that hands you the file into your forensic folder.

③ Advanced Analytics + getting the data out to your SIEM

Skope IT answers “what happened to this user?”. Advanced Analytics answers “what is the trend across everyone?”. It is built on Looker, with over 1,400 attributes across 10+ data collections, and you do not start from a blank canvas — the Netskope Library ships prebuilt persona dashboards (executive risk, DLP, threat, app usage) you can open, filter and clone.

Two daily-life uses for an L1. First, schedule a dashboard or report so the weekly DLP summary lands in your manager’s inbox automatically — no manual export every Monday. Second, drill from a widget into the underlying events, which drops you back into a filtered Skope IT view. Analytics is the map; Skope IT is the street view.

Getting Netskope data into your SOC

Your SOC does not live in the Netskope console — it lives in Splunk, Microsoft Sentinel, QRadar or a data lake. So the events and alerts have to be shipped there. The quick path is the per-screen EXPORT button (CSV, up to 500,000 rows from the incidents view). The grown-up path is Cloud Exchange — covered next — which streams events continuously instead of you exporting CSVs by hand.

{
  "timestamp": "2026-06-05T11:42:08+05:30",
  "alert_type": "DLP",
  "policy": "block-personal-cloud-upload",
  "dlp_rule": "client-PII-India",
  "user": "priya.nair@infosys.com",
  "srcip": "10.50.4.18",
  "app": "Microsoft OneDrive",
  "instance": "personal",
  "activity": "Upload",
  "action": "block",
  "incident_id": "INC-2026-118245",
  "severity": "High"
}

This is the shape your SIEM correlation rules key off — alert_type, action and severity drive the SOC playbook, and incident_id lets an analyst jump straight back to Incidents > DLP in the tenant. CLS ships these continuously; you do not babysit CSV exports.

④ Cloud Exchange — feeding your SIEM, SOAR and ticketing

Cloud Exchange (CE) is the switchboard between Netskope and the rest of your stack — and all four modules are free. Picture a hotel switchboard: each module is a different operator. The latest release, CE v6.0.0 (Oct 30 2025), is worth knowing for interviews: it added 200k EPM Log Shipper throughput, built-in GlusterFS HA (no external NFS), EDM and Custom File Classification beta modules, and a Retrohunt API that auto-retracts false-positive IOCs.

The four free Cloud Exchange modules

Tap each — know which one solves which SOC problem, because the cert and interviews ask exactly this.

For an L1, the mental model is one line: CTE shares IOCs, CLS ships logs, CRE shares risk scores, CTO opens tickets. A real SOC pattern: a Critical DLP alert in Netskope → CLS streams it to the SIEM for correlation → CTO auto-opens a ServiceNow ticket only for Critical severity → the analyst works it in Incidents > DLP and resolves both sides. Two advisories to keep on your radar: in-tenant EDR integration reaches end-of-life on Dec 1 2025, and the Illumio CTE plugin is deprecated around mid-2026.