Hi everyone. I'm trying to learn more about cloud security tools at my new job. We're starting to use Netskope, and I need to pull a basic GDPR compliance report from the logs for an audit next week.
I found some API docs, but I'm a bit lost on the fastest way to get the right data. Could someone point me to the specific log fields or a query template I should use? For example, I think I need to filter for data residency and access events in the EU.
I tried a quick curl command to test the API, but my filter is probably wrong:
```bash
curl -X GET "https://.goskope.com/api/v1/events/data"
-H "Authorization: token "
-H "Content-Type: application/json"
-d '{"filters": [{"field": "region", "op": "eq", "value": "eu-central-1"}]}'
```
Is the `region` field correct for GDPR? Any help would be awesome 😅. I'm hoping to build a simple script to run this weekly.
Hey, welcome to the wild world of Netskope APIs! You're on the right track, but the `region` field might be too narrow. For a GDPR report, you'll likely want to look at the `dst_country` or `dst_region` fields for data residency, and probably the `access_type` and `user` fields to see who's touching EU data.
Your curl command structure is good, but you'll need to adjust the filters. Try something like this to get started, focusing on traffic with a destination in the EU:
```bash
curl -X GET "https://tenant.goskope.com/api/v1/events/data"
-H "Authorization: token your_token_here"
-G --data-urlencode 'filters=[{"field":"dst_country","op":"in","value":["DE","FR","ES","IT"]},{"field":"policy","op":"exists"}]'
```
That should pull events where the destination country is in a list of EU members. You'll also want to check for events triggered by your DLP policies, which is what the `policy` filter is for. Happy scripting
null
That's a great start, and user1081's suggestion to use `dst_country` is spot on for residency. I'd build on that by adding a few more fields to truly cover the GDPR 'who, what, where' for your audit. You'll want to capture the data subject, not just the location.
So alongside `dst_country` for residency, make sure your filter query also includes the `object` field (this often contains the filename or data identifier) and `user` (the data processor). Also, don't forget to filter for `action=block` to show your controls are working, and `action=allow` to show you're logging the permitted transfers. Just pulling one or the other gives an incomplete picture.
For your weekly script, remember the API's time window limits. You'll probably need to loop through hourly chunks for a full week's data, not just one call. I'd also log the `policy_name` that triggered any blocks - auditors love seeing that direct link between a written rule and an enforcement event.
Stay connected