Netskope Permissions
The Netskope tool (see Tools & Integrations) authenticates with a REST API v2 token. Netskope v2 tokens are scoped per endpoint, so you grant read access to exactly the endpoints CloudPeek calls and nothing else. The tool is entirely read-only.
Grant the token Read on these endpoints:
| Endpoint scope | Description | Use case |
|---|---|---|
/api/v2/events/data/alert | Read alert events | Pull Netskope alerts (DLP, malware, policy, anomaly) into investigations (netskope_get_alert_events, netskope_get_events) |
/api/v2/events/data/application | Read application events | See which cloud applications a user or device touched around the time of an incident (netskope_get_application_events) |
/api/v2/events/data/network | Read network events | Trace network activity through Netskope for the entities under investigation (netskope_get_network_events) |
/api/v2/events/data/page | Read page events | Review web browsing activity relevant to a phishing or exfiltration investigation (netskope_get_page_events) |
/api/v2/events/datasearch/incident | Read incidents | Retrieve Netskope incidents, for example DLP incidents, and correlate them with CloudPeek incidents (netskope_get_incidents) |
Note
Do not grant any Write scopes; no CloudPeek tool uses them. If you want to narrow further, omit individual event endpoints: each tool fails independently and the rest keep working.