Detect large data downloads in Netskope and flag insider risk
Build a scheduled workflow that retrieves large-download events from Netskope. Filter for users on a configurable watchlist. For each qualifying event, create a Jira issue capturing user, volume, destination, and timestamp for investigation. Deduplicate repeat events, paginate the Netskope API, and retry failures. Output the issues created and a summary of flagged activity.
What this prompt builds
Watch Netskope for large downloads by watchlisted employees and open a Jira issue for review.
The problem
Bulk downloads by employees, especially those already under scrutiny, can signal data theft, but the signals are buried in Netskope logs no one reviews in real time. Insider incidents are usually discovered far too late.
Solution and impact
This workflow pulls Netskope large-download warnings, focuses on watchlisted employees, and raises a Jira issue for each so the security team can investigate. Potential exfiltration is surfaced quickly with a tracked case.