Sync CrowdStrike file indicators to Netskope blocklists
Build a workflow (scheduled or event-driven) that retrieves file indicators (hashes) from CrowdStrike. For each new indicator, publish it to Netskope's file/hash blocklist via API with appropriate action and metadata. Deduplicate against indicators already present in Netskope, paginate the CrowdStrike source, retry failures, and respect rate limits. Output the indicators synced and any that failed to publish.
What this prompt builds
Push CrowdStrike file indicators into Netskope so endpoint threats are blocked at the proxy too.
The problem
Threat indicators identified by CrowdStrike on endpoints aren't automatically known to Netskope's web/cloud controls, leaving a gap attackers can use. Manually copying hashes between consoles doesn't scale.
Solution and impact
This workflow publishes CrowdStrike file indicators to Netskope, extending endpoint detections to the network edge automatically. Confirmed bad files are blocked consistently across both controls without manual syncing.