From 86e7f11227f34e2b69f123785393a76afb13a3c5 Mon Sep 17 00:00:00 2001 From: Guillaume BOURGEOIS Date: Sun, 12 Jul 2026 00:37:10 +0200 Subject: [PATCH] feat(netskope): new Netskope SASE/CASB integration Netskope REST API v2, 6 commands: list/get URL lists, replace URL list (block list), deploy URL lists, list users. API-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) --- integrations/netskope/manifest.yaml | 75 +++++++++++++++++++ .../netskope/scripts/deploy_url_lists.py | 44 +++++++++++ integrations/netskope/scripts/get_url_list.py | 47 ++++++++++++ .../netskope/scripts/list_url_lists.py | 43 +++++++++++ integrations/netskope/scripts/list_users.py | 44 +++++++++++ .../netskope/scripts/replace_url_list.py | 58 ++++++++++++++ .../netskope/scripts/test_connection.py | 44 +++++++++++ 7 files changed, 355 insertions(+) create mode 100644 integrations/netskope/manifest.yaml create mode 100644 integrations/netskope/scripts/deploy_url_lists.py create mode 100644 integrations/netskope/scripts/get_url_list.py create mode 100644 integrations/netskope/scripts/list_url_lists.py create mode 100644 integrations/netskope/scripts/list_users.py create mode 100644 integrations/netskope/scripts/replace_url_list.py create mode 100644 integrations/netskope/scripts/test_connection.py diff --git a/integrations/netskope/manifest.yaml b/integrations/netskope/manifest.yaml new file mode 100644 index 0000000..70c36e0 --- /dev/null +++ b/integrations/netskope/manifest.yaml @@ -0,0 +1,75 @@ +id: netskope +name: Netskope +version: 1.0.0 +description: "Netskope (SASE/CASB REST API v2) — web/cloud containment: list and read URL lists, replace a URL list (block list) and deploy it, and list enrolled users/clients. API-token authentication; stdlib-only, no extra Python dependencies." +changelog: "1.0.0 — Initial release: list/get URL lists, replace URL list, deploy URL lists, list users." +category: network + +# Per-instance configuration. The token is sent as the 'Netskope-Api-Token' header. +config_schema: + properties: + base_url: + type: string + description: "Netskope tenant URL (e.g. https://yourtenant.goskope.com)" + api_token: + type: string + description: "Netskope API v2 token" + x-soar-sensitive: true + required: + - base_url + - api_token + +commands: + - id: list_url_lists + name: netskope-list-url-lists + description: "List URL lists." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + - id: get_url_list + name: netskope-get-url-list + description: "Get a single URL list by ID." + risk: read + inputs_schema: + properties: + list_id: { type: string, description: "URL list ID" } + required: [list_id] + outputs_schema: { properties: {} } + - id: replace_url_list + name: netskope-replace-url-list + description: "Replace the URLs of a URL list (e.g. update a block list)." + inputs_schema: + properties: + list_id: { type: string, description: "URL list ID" } + name: { type: string, description: "URL list name" } + urls: { type: string, description: "Comma-separated URLs/domains that become the list" } + list_type: { type: string, description: "exact or regex (default exact)" } + required: [list_id, name, urls] + outputs_schema: { properties: {} } + - id: deploy_url_lists + name: netskope-deploy-url-lists + description: "Deploy pending URL-list changes so they take effect." + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } + - id: list_users + name: netskope-list-users + description: "List enrolled users (SCIM)." + risk: read + inputs_schema: + properties: + limit: { type: number, description: "Max users (default 50)" } + required: [] + outputs_schema: { properties: {} } + + - id: test_connection + name: netskope-test-connection + description: "Verify connectivity and the API token (used by the Test button)." + risk: read + inputs_schema: + properties: {} + required: [] + outputs_schema: { properties: {} } diff --git a/integrations/netskope/scripts/deploy_url_lists.py b/integrations/netskope/scripts/deploy_url_lists.py new file mode 100644 index 0000000..715d2af --- /dev/null +++ b/integrations/netskope/scripts/deploy_url_lists.py @@ -0,0 +1,44 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + result = request("POST", "/api/v2/policy/urllist/deploy", cfg, body={}) + return result if result else {"ok": True} + + +_run(main) diff --git a/integrations/netskope/scripts/get_url_list.py b/integrations/netskope/scripts/get_url_list.py new file mode 100644 index 0000000..cd3ac08 --- /dev/null +++ b/integrations/netskope/scripts/get_url_list.py @@ -0,0 +1,47 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + list_id = inputs.get("list_id") + if not list_id: + raise Exception("list_id is required") + q = lambda v: urllib.parse.quote(str(v), safe="") + return request("GET", "/api/v2/policy/urllist/" + q(list_id), cfg) + + +_run(main) diff --git a/integrations/netskope/scripts/list_url_lists.py b/integrations/netskope/scripts/list_url_lists.py new file mode 100644 index 0000000..90ec7cb --- /dev/null +++ b/integrations/netskope/scripts/list_url_lists.py @@ -0,0 +1,43 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + return request("GET", "/api/v2/policy/urllist", cfg) + + +_run(main) diff --git a/integrations/netskope/scripts/list_users.py b/integrations/netskope/scripts/list_users.py new file mode 100644 index 0000000..e0f56bc --- /dev/null +++ b/integrations/netskope/scripts/list_users.py @@ -0,0 +1,44 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + limit = inputs.get("limit") + return request("GET", "/api/v2/scim/Users", cfg, params={"count": int(limit or 50)}) + + +_run(main) diff --git a/integrations/netskope/scripts/replace_url_list.py b/integrations/netskope/scripts/replace_url_list.py new file mode 100644 index 0000000..2ba01f1 --- /dev/null +++ b/integrations/netskope/scripts/replace_url_list.py @@ -0,0 +1,58 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + list_id = inputs.get("list_id") + if not list_id: + raise Exception("list_id is required") + name = inputs.get("name") + if not name: + raise Exception("name is required") + urls_raw = inputs.get("urls") + if not urls_raw: + raise Exception("urls is required") + urls_list = [s.strip() for s in str(urls_raw).split(",") if s.strip()] + if not urls_list: + raise Exception("urls is required") + list_type = inputs.get("list_type") or "exact" + q = lambda v: urllib.parse.quote(str(v), safe="") + body = {"name": name, "data": {"type": list_type, "urls": urls_list}} + return request("PUT", "/api/v2/policy/urllist/" + q(list_id), cfg, body=body) + + +_run(main) diff --git a/integrations/netskope/scripts/test_connection.py b/integrations/netskope/scripts/test_connection.py new file mode 100644 index 0000000..8acc5ec --- /dev/null +++ b/integrations/netskope/scripts/test_connection.py @@ -0,0 +1,44 @@ +import json, os, sys, urllib.parse, urllib.request, urllib.error + + +def _cfg(): + return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}")) + + +def _inputs(): + return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}")) + + +def request(method, path, cfg, body=None, params=None): + url = str(cfg.get("base_url", "")).rstrip("/") + path + if params: + clean = {k: v for k, v in params.items() if v not in (None, "")} + if clean: + url += "?" + urllib.parse.urlencode(clean) + data = json.dumps(body).encode("utf-8") if body is not None else None + headers = {"Netskope-Api-Token": str(cfg.get("api_token", "")), "Accept": "application/json"} + if data is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=data, headers=headers, method=method) + with urllib.request.urlopen(req, timeout=60) as r: + raw = r.read() + return json.loads(raw) if raw else {} + + +def _run(fn): + try: + print(json.dumps(fn(_cfg(), _inputs()))) + except urllib.error.HTTPError as e: + print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")})) + sys.exit(1) + except Exception as e: + print(json.dumps({"error": str(e)})) + sys.exit(1) + + +def main(cfg, inputs): + request("GET", "/api/v2/policy/urllist", cfg) + return {"ok": True} + + +_run(main)