How to resolve error 'Source Netskope… 403 - Forbidden. Legacy Rest API v2 is deprecated' when using Panther's Netskope log source integration

Last updated
Save as PDF

Issue

My Netskope log source stopped working, and the following error occurs:

Source Netskope did not pass configuration check because: Netskope API response error (403) {”ok”: 0, “error”: “403 - Forbidden. Legacy Rest API v2 is deprecated. Please use Data Export API.

I tried generating a token for the new /api/v2/events/dataexport/events/audit endpoint, but it didn't work. Does Panther have plans to make adjustments and continue support for that log source?

Resolution

Panther is aware that the /api/v2/events/data/audit endpoint is deprecated and the engineering team is working on migrating to the new dataexport endpoint.

As a temporary workaround to resume the data ingestion:

If you have a way of exporting the data to a custom log source, then either the managed Netskope schema or a custom schema can be used to ingest the data in Panther.

Cause

Netskope has deprecated their/api/v2/events/data/audit endpoint, which Panther currently uses for the Netskope integration.