Add Netskope adapter (REST API v2 dataexport iterator)

[maximelb]

Summary

Adds a Netskope USP adapter that pulls Netskope security telemetry into LimaCharlie via the REST API v2 dataexport iterator endpoints (/api/v2/events/dataexport/{events|alerts}/{type}).

Modeled on the threatlocker adapter. Each event/alert stream is a feed with its own server-side iterator cursor (the index query parameter): Netskope remembers the read position per index name, so the adapter keeps no local state and a restart resumes each stream with no gaps or duplicates.

What it ingests

• Out of the box: every alert stream — dlp, malware, malsite, ctep, compromisedcredential, uba, policy, quarantine, remediation, securityassessment, watchlist — plus the audit event stream.
• Opt-in (high volume): page / application / network / incident / infrastructure / endpoint events, via alert_types / event_types or a custom feeds list.
• Records are shipped verbatim (LimaCharlie parses/maps in the cloud); EventType is the feed name (e.g. alert_dlp, event_audit) and the event time is the record's epoch-seconds timestamp.

Implementation notes

• Auth: Netskope-Api-Token header (REST API v2 token), verified against Netskope's official SDK source.
• Pacing: honours the server's wait_time, drains backlogs quickly, and respects the documented 4 req/s/endpoint rate limit (Retry-After / RateLimit-Reset aware).
• Resilience: source-side errors (incl. 401/403 for a missing endpoint scope) are non-fatal warnings, so one broken feed never tears down the whole adapter; only a failure delivering to LimaCharlie is fatal (mirrors threatlocker's rationale for the hosted cloud-adapter environment).
• start_time optionally seeds a brand-new stream for a bounded backfill (epoch / RFC3339 / relative duration); default is operation=next (restart-safe).
• An in-memory deduper guards the only re-delivery cases (iterator resend / start_time re-seed after restart).

Registration

• containers/conf/all.go — import + Netskope field on GeneralConfigs (json:"netskope").
• containers/general/tool.go — import + method == "netskope" dispatch branch.
• Root README.md + netskope/README.md.

Testing

• go build ./containers/general ✅, go vet ./netskope/... ✅, gofmt clean ✅
• go test ./netskope/... ✅ — a faithful httptest mock of the iterator (cursor / epoch-seed / resend semantics, Netskope-Api-Token auth, {"ok":1,"result":[...],"wait_time":N} envelope) drives end-to-end tests for shipping fidelity (verbatim payload + parsed timestamp), multi-page walking, multi-feed tagging, dedup, start_time seeding, transient-error retry, and bad-token handling, plus unit tests for config validation, envelope parsing, base-URL/start-time/index helpers and transient-error classification.
• Not yet live-verified against a real Netskope tenant (no tenant credentials available). The mock is built from the official docs + SDK; a few response-shape details (exact field inventories for some streams) are noted for live validation.

🤖 Generated with Claude Code