How to Upload Logs to the Netskope Cloud

1. First, download log files from your supported vendor’s application.
   Note: If using an archive (such as .zip), you can only have one log file per archive, and it may not be binary.
2. In a web browser, go to the Netskope web console:
   • United States Datacenter: https://[TENANT].goskope.com/
   • European Union Datacenter: https://[TENANT].eu.goskope.com/
   • Frankfurt Datacenter: https://[TENANT].de.goskope.com/
   Note: [TENANT] = The tenant name in your environment
3. Log in to the Netskope web console.
   
4. Click Settings.
   
5. Click Risk Insights.
   
6. Click Upload.
   
7. Click Upload Logs.
   
8. Click Select File.
   
9. Use Windows Explorer to go to the log file downloaded in Step 1. Select the file and then click Open.
   
10. Using the Predefined list, locate the vendor for the log type you selected in the previous step.
    
    Note: For example, if using Cisco IronPort, you would use the cisco-wsa directory. If using Blue Coat logs, you would use the proxysg-http-main directory. For more information, reference Supported Log Formats.
11. Click Upload to upload the log for analysis.
    
    Note: After the logs are uploaded, it takes some time to parse the logs and show events in SkopeIT. The upload times vary based on log file sizes.

To successfully upload the logs over SFTP, Netskope requires a third-party SSH file transfer protocol (SFTP) client.

• Examples of an SFTP client include (but are not limited to):
  • PuTTY
  • WinSCP
  • Filezilla

1. First, download log files from your supported vendor’s application.
   Note: If using an archive (such as .zip), you can only have one log file per archive, and it may not be binary.
2. If you have previously imported the SSH private key into your SFTP client, go to Step 10. Otherwise, go to Step 3.
3. In a web browser, go to the Netskope web console:
   • United States Datacenter: https://[TENANT].goskope.com/
   • European Union Datacenter: https://[TENANT].eu.goskope.com/
   • Frankfurt Datacenter: https://[TENANT].de.goskope.com/
   Note: [TENANT] = The tenant name in your environment
4. Log in to the Netskope web console.
   
5. Click Settings.
   
6. Click Risk Insights.
   
7. Click Upload.
   
8. Click to Download the SSH Private Key.
   
9. Open the SFTP client and import the SSH private key.
   Note: If you are using WinSCP for SFTP, do not preserve the time for the log file.
10. In the SFTP client, login with the Username and Location that is provided from the Log Upload page (Step 8).
11. Go to /upload/.
    
12. Go to the directory for the device that is used for generating the log file (Step 1).
    
    Note:

    • The directory may differ from the example image.
    • For example, if using Cisco IronPort, you would use the cisco-wsa directory (cd cisco-wsa). If using Blue Coat logs, you would use the proxysg-http-main directory (cd proxysg-http-main). Reference Supported Log Formats for more information.
13. Upload the log files.
    Note: After the logs are uploaded, it takes some time to parse the logs and show events in SkopeIT. The upload times vary based on log file sizes.

To successfully upload the logs over SFTP, Netskope requires a third-party SSH file transfer protocol (SFTP) client.

• Examples of an SFTP client include (but are not limited to):
  • PuTTY
  • WinSCP
  • Filezilla

1. First, download log files from your supported vendor’s application.
   Note: If using an archive (such as .zip), you can only have one log file per archive, and it may not be binary.
2. In a web browser, go to the Netskope web console:
   • United States Datacenter: https://[TENANT].goskope.com/
   • European Union Datacenter: https://[TENANT].eu.goskope.com/
   • Frankfurt Datacenter: https://[TENANT].de.goskope.com/
   Note: [TENANT] = The tenant name in your environment
3. Log in to the Netskope web console.
   
4. Click Settings.
   
5. Click Risk Insights.
   
6. Click Upload.
   
7. Click to Download the SSH Private Key.
   
   Note:

   • You may change permissions of the private key file to restrict access. If permissions of the downloaded private key file must be changed, open Terminal, type chmod 600 [ENVIRONMENTVARIABLE]_sshkey.key and then press Enter.
   • [ENVIRONMENTVARIABLE] = A unique identifier in your environment
8. Open Terminal.
9. Using the Location and Username that is provided from the Log Upload page, type sftp -i /privatekey/[ENVIRONMENTVARIABLE]_sshkey.key [USERNAME]@upload-[TENANT].goskope.com and then press Enter.
   
   Note:

   • [ENVIRONMENTVARIABLE] = A unique identifier in your environment
   • [USERNAME] = The Log Upload page username (Step 7)
   • [TENANT] = The tenant name in your environment
10. Type cd upload and then press Enter.
    
11. Go to the directory for the device that is used for generating the log file in Step 1.
    
    Note:

    • The directory may differ from the example image.
    • For example, if using Cisco IronPort, you would use the cisco-wsa directory (cd cisco-wsa). If using Blue Coat logs, you would use the proxysg-http-main directory (cd proxysg-http-main). Reference Supported Log Formats for more information.
12. Type mput [SOURCEPATH] [FILENAME] and then press Enter to upload the log files.
    
    Note:

    • [SOURCEPATH] = Path to the log to upload
    • [FILENAME] = Filename of the log being uploaded
    • After the logs are uploaded, it takes some time to parse the logs and show events in SkopeIT. The upload times vary based on log file sizes.

Netskope supports the following log formats: