Netskope Function uploads to Netskope_CL but workbook does not refer to the table

[anthonysomerset]

Describe the bug
Netskope Data Connector ingests to the Netskope_CL table, however the provided workbook is expecting data to exist in the following tables:

Netskope_Events_CL
Netskope_Alerts_CL
Netskope_WebTX_CL

as a result the workbook does not work

To Reproduce
Steps to reproduce the behavior:

1. Deploy Netskope connector from content hub and deploy all the neccesary resources
2. Allow data to be ingested
3. attempt to view workbook

Expected behavior
Workbook should work, either by updating it to refer to correct tables or update the connector function and/or parser to support the new tables

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: MacOS Ventura
• Browser: Chrome
• Version 116.0.5845.110 (Official Build) (arm64)

Additional context
Guessing that something is out of sync between the connector/parser and the workbook

[github-actions]

Thank you for submitting an Issue to the Azure Sentinel GitHub repo! You should expect an initial response to your Issue from the team within 5 business days. Note that this response may be delayed during holiday periods. For urgent, production-affecting issues please raise a support ticket via the Azure Portal.

[v-sudkharat]

Hi @anthonysomerset, thanks for flagging this issue, we will soon get back to you on this. Thanks!

[v-rbajaj]

Hi @anthonysomerset, we have reached out to concerned team for this issue, we will get back once there is an update.

[v-rbajaj]

Hi @anthonysomerset, we have reached out to concerned team for this issue, we will get back once there is an update.

[v-rbajaj]

Hi @anthonysomerset, we have reached out to concerned team for this issue, we will get back once there is an update.

[v-rbajaj]

Hi @anthonysomerset, we have reached out to concerned team for this issue, we will get back once there is an update.

[v-rbajaj]

Hi @anthonysomerset, we have reached out to concerned team for this issue, we will get back to you by 13 Oct 2023.

[rahul0216]

Hello @anthonysomerset, thank you for raising the issue.
This solution has been developed and maintained by Netskope.

Netskope uses Log Shipper to push logs to Microsoft Sentinel. In Log Shipper user have option to provide table name but they suggest default names like Netskope_Events_CL, Netskope_Alerts_CL, Netskope_WebTX_CL etc, so that provided workbook and playbook can function properly.
You can read the details here.

Looks like workbook is not yet updated to support Azure Functions app based connector ingested data.

[anthonysomerset]

so i don't have Log Shipper at all

I am going off the original instructions in Sentinel and this Repo - this suggests that the instructions are wrong or incomplete or out of date. This should be rectified depending on what the correct situation is

[anthonysomerset]

from what i can tell, log shipper/cloud exchange is NEW functionality relative to the azure function based solution

I think the right way forward is to deprecate the azure function approach in favour of linking to the Netskope documentation for Cloud Exchange/Log Shipper and the documentation updated to reflect that

[rahul0216]

Hi @anthonysomerset, hopefully you are unblocked.
Yes, looks like instructions are out of date which is causing the confusion. We will reach out to Netskope support to look into it.

In the meantime, if you are a Netskope customer, you can reach out to them as well for clarification and latest instructions.

[rahul0216]

Hi @elforb, I see you are original committer of Netskope Solution. Can you please have a look @anthonysomerset concerns?

[v-rbajaj]

Hi @elforb, can you please look into the above comment?

[v-rbajaj]

Hi @elforb, can you please look into the above comment, would really appreciate your response here.

[v-rbajaj]

Hi @anthonysomerset, thanks for raising this concern here. But since this solution is partner supported solution you would need to raise a ticket in Netskope support queue. Please raise this concern with them here - https://www.netskope.com/services#support