Introduction
The tags beginning with casb.paloalto identify events generated by CASB Netskope.
Valid tags and data tables
The full tag must have 4 levels. The first two are fixed as casb.paloalto. The third level identifies the type of events sent.
Technology | Brand | Type | Subtype |
|---|---|---|---|
casb | paloalto |
|
|
These are the valid tags and corresponding data tables that will receive the parsers' data:
Tag | Data table |
|---|---|
casb.paloalto.prisma.activity_monitoring | casb.paloalto.prisma.activity_monitoring |
casb.paloalto.prisma.admin_audit | casb.paloalto.prisma.admin_audit |
casb.paloalto.prisma.incident | casb.paloalto.prisma.incident |
casb.paloalto.prisma.invalid | casb.paloalto.prisma.invalid |
casb.paloalto.prisma.other | casb.paloalto.prisma.other |
casb.paloalto.prisma.policy_violation | casb.paloalto.prisma.policy_violation |
casb.paloalto.prisma.remediation | casb.paloalto.prisma.remediation |
casb.paloalto.prisma-basic | casb.paloalto.prismaBasic |