NetskopeWebTx: Blob Storage CCF connector — schema expansion, workbook, v3.0.1#14492
Merged
v-atulyadav merged 6 commits intoJun 25, 2026
Merged
Conversation
…k, v3.0.1 - Add Netskope CCF connector for Web Transaction logs (StorageAccountBlobContainer ingestion via DCR + Event Grid), authored in V3 source format - Expand NetskopeWebTransactions_CL with 51 additional Web Transaction fields (threat protection, endpoint posture, process, identity/authorization, remote geo, action) across the DCR transform, custom table, and parser - Refresh the 'Netskope Web Transactions' workbook (Threat Protection, Endpoint Posture, Process Activity, Identity & Authentication, Action Analysis); add canonical WorkbooksMetadata entry + preview images - Set DataConnectorCCFVersion 2.0.0; solution version 3.0.1 - Update README and ReleaseNotes
Resolve NetskopeWebTx conflicts in favor of the Blob Storage CCF connector (blob replaces upstream's polling connector): - Keep blob NetskopeWebTxConnector_CCF; remove polling NetskopeWebTx_CCF - Keep 51-field schema expansion (DCR/table/parser) + refreshed workbook - Adopt upstream's analytic rules and WorkbooksMetadata entry - Regenerate package (solution 3.0.1, connector 2.0.0); ship only 3.0.1.zip
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR updates the NetskopeWebTx solution to support an expanded Netskope Web Transaction (Blob Storage / CCF) connector schema and refreshes the related workbook and documentation, with a version bump to 3.0.1.
Changes:
- Expanded the Netskope Web Transactions workbook with new analysis sections (Threat Protection, Endpoint Posture, Process Activity, Identity/Auth, Action Analysis).
- Updated the solution’s parser and connector assets to align with the expanded schema and new CCF connector structure.
- Bumped solution versioning and refreshed packaging/UX text and documentation.
Reviewed changes
Copilot reviewed 15 out of 18 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| Workbooks/NetskopeWebTx_Workbook.json | Updates standalone workbook header text and adds multiple new investigative sections/queries. |
| Solutions/NetskopeWebTx/Workbooks/NetskopeWebtxDashboard/NetskopeWebTx_Workbook.json | Mirrors workbook updates inside the solution folder for packaging/deployment. |
| Solutions/NetskopeWebTx/ReleaseNotes.md | Adds a new release entry for version 3.0.1 describing schema/workbook updates. |
| Solutions/NetskopeWebTx/README.md | Updates workbook description, log table notes, and the stated solution version. |
| Solutions/NetskopeWebTx/Parsers/NetskopeWebtx.yaml | Extends the parser’s projected fields to include the newly supported schema columns. |
| Solutions/NetskopeWebTx/Package/createUiDefinition.json | Updates solution UI text to reflect the connector naming change (“Web Transactions”). |
| Solutions/NetskopeWebTx/Data/Solution_NetskopeWebTx.json | Updates referenced connector path, version bump to 3.0.1, and adds CCF connector version metadata. |
| Solutions/NetskopeWebTx/Data Connectors/NetskopeWebTxConnector_CCF/NetskopeWebTx_Table.json | Introduces an updated table schema including additional columns. |
| Solutions/NetskopeWebTx/Data Connectors/NetskopeWebTxConnector_CCF/NetskopeWebTx_DCR.json | Adds an updated DCR with expanded transform mapping. |
| Solutions/NetskopeWebTx/Data Connectors/NetskopeWebTxConnector_CCF/NetskopeWebTx_ConnectorDefinition.json | Adds an updated connector definition with refreshed metadata, samples, and instructions. |
| Solutions/NetskopeWebTx/Data Connectors/NetskopeWebTxConnector_CCF/NetskopeWebTxLogs_DataConnector.json | Adds the StorageAccountBlobContainer data connector resource referencing the DCR. |
… package - Rename connector folder/files to published names (NetskopeWebTx_CCF/ NetskopeWebtx_*.json), preserving blob connector content + 51-field schema - Restore Package/3.0.0.zip alongside the new 3.0.1.zip - Regenerate package (solution 3.0.1, connector 2.0.0)
Contributor
|
Hi @keshavm021 Kindly ensure that the existing ZIP file is not updated or modified as part of this change. 
Thanks! |
…kage The existing Package/3.0.0.zip (the already-published 3.0.0 release) was inadvertently regenerated/overwritten during the 3.0.1 package build. This restores it byte-for-byte to the upstream/master version so the PR only adds the new 3.0.1.zip and leaves the existing released ZIP untouched.
keshavm021
force-pushed
the
feature/netskope-connector-update
branch
from
June 18, 2026 15:29
112ce8e to
52c735a
Compare
Contributor
Author
|
Hi @v-maheshbh |
Contributor
|
Hi @keshavm021 Kindly verify the URL below. 
Thanks! |
….0.1 package via V3 tool The DCR transformKql and parser emitted 'XRCertStartdate'/'XRCertEnddate' while the custom table defines 'XRCertStartDate'/'XRCertEndDate'. DCR output-to-table binding is case-sensitive, so those columns never populated. Aligned the transform output and parser references to the canonical table casing. Regenerated mainTemplate.json + 3.0.1.zip with createSolutionV3.ps1 (local, patch) instead of a hand-patch; arm-ttk passes except the documented concat baseline. The existing 3.0.0.zip is left byte-for-byte unchanged.
…ming; regenerate 3.0.1 package Updated the Netskope Log Streaming documentation link in the connector definition instruction step and regenerated mainTemplate.json + 3.0.1.zip via createSolutionV3.ps1 (local, patch). The existing 3.0.0.zip is left unchanged.
Contributor
Author
|
Hi @v-maheshbh |
v-maheshbh
approved these changes
Jun 25, 2026
v-atulyadav
approved these changes
Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change(s):
Added Netskope CCF connector for Web Transaction Logs (Blob Storage /
StorageAccountBlobContaineringestion via DCR + Event Grid). Also:NetskopeWebTransactions_CLschema with 51 additional Web Transaction fields (threat protection, endpoint posture, process, identity/authorization, remote geo, action) across the DCR transform, custom table, and theNetskopeWebtxparserVersion Updated:
3.0.1
Testing Completed:
Yes