The Configuration section of AISecOps contains all tenant-level settings that control how cases are created, investigated, and managed. This section allows you to fine-tune AI behavior and connect AISecOps to external services like Slack and ServiceNow.
Access these settings from the left navigation bar under the Settings icon.
Preferences
Preferences control three AI-driven automation behaviors. Each can be independently toggled and tuned to match your organization’s needs.
Auto-Assignment
Automatically assigns new cases to analysts based on historical similarity.
- Similarity Threshold: Higher values require closer matches before assigning.
- Min Similar Cases: Minimum matches required before the system triggers an assignment.
- Lookback Days: How far back to search for historical assignment data.
Auto-Investigation
Prevents redundant work by skipping AI investigations if very similar recent cases were flagged as “low-risk.”
- Low Risk Skip Threshold: The fraction of similar cases that must be low-risk for the skip logic to activate.
Auto-investigation is now enabled by default for new tenants. New tenants start with a 7-day priming window at a reduced quota cap of 10%, allowing AISecOps to validate signal quality before full quota consumption begins.
Auto-investigations are capped at 70% of the weekly quota by default. You can change this value from 0-100%.
Rate Limit Info
A read-only view displaying the platform-set case creation limits per day.
Case Rules
This is the central hub for managing detection rules that drive DLP case creation.
- Rule Lifecycle: New rules start as Disabled by default to allow for review. Every update increments the Version Number.
- Optimistic Locking: If another user updates the rule first, you will receive a
409 Conflicterror. - Format: Rules use the V3 Pipe Query format.
- Example:
filter incident.dlp_incident_severity = 'High' | create_case group_by incident.user when group.evidence_count >= 1
- Example:
- Author Attribution: User-created Case Rules now display the creator’s email on the rule card, replacing the previous “Created by Netskope” label.
- The rule editor now prompts you to confirm before canceling a form with unsaved changes.
DLP Incident Pre-Filtering
This section allows you to suppress specific DLP incident patterns known to be “noise.”
- Views: Organized by DLP Profile or DLP Policy.
- The Matrix: Expand any row to see a matrix of Severity × Action. You can exclude specific combinations (e.g., exclude all “Low” severity incidents that resulted in an “Alert”).
- Auto-Tuning: Automatically suppresses low-signal combinations based on observed patterns. Auto-tuning is now enabled by default for new tenants, with a minimum-volume floor in place to prevent over-filtering on low-volume tenants.
- Sample Incidents: Review real events within the tuning UI to ensure you aren’t accidentally suppressing critical signals.
Agent Memory
Agent Memory provides persistent context and instructions that the AI Worker reviews before every investigation.
| Type | Purpose | Sample Content |
|---|---|---|
| Instruction | Directives on how the AI should reason. | “Treat all Finance folder access by contractors as high-risk.” |
| Configuration | Structured key-value pairs/lists. | List of trusted domains or sensitive project codenames. |
- Validation: Memories are validated against Bedrock Guardrails to prevent unsafe content.
- Immediate Effect: Changes take effect on the very next investigation—no service restart required.
Usage
The Usage page provides insight into your current usage. Here you can view a breakdown of the average case investigation on a weekly or daily basis.
Auto-investigations are capped at 10% of the weekly quota by default. This can be changed.
Failed investigations don’t count against the quota.
Manual investigations and auto-investigations always consume quota.
The quota resets every Monday at 00:00 UTC with no rollover.
Integrations
Slack
Connect AISecOps to Slack to for the manager approval workflow. If Slack is configured, a message will go to the manager on Slack, otherwise it will go as an email.
ServiceNow
Bridges AISecOps with your ITSM workflow by creating and syncing tickets for high-risk cases.
- One-Way Sync: AISecOps writes data to ServiceNow; the ITSM sync worker tracks the ticket ID and status back in the AISecOps case.
- Requirements: Instance URL must be
https://*.service-now.com. - Tracking: Linked cases display the human-readable ServiceNow ticket number (e.g.,
INC0012345) and a direct link to the ticket.
Setup
-
Follow Step 1 on the Onboard ServiceNow page.
-
Follow Step 2 on the Onboard ServiceNow page, but update the table name to
sn_si_incident -
Go to Configuration > Integrations > ServiceNow
-
Enter your Instance URL, Client ID, Client Secret and press Connect to ServiceNow
EntraID
- Follow steps here to create RBAC v3 token
- Follow steps here to connect the Netskope app in Entra with Netskope
- Now they need to provision custom attributes which the DLP agent needs.
- High level steps are mentioned here but some alterations are needed
- Run the below command below to allow custom attributes needed by AISecOps
curl --location --request PUT 'https://<tenant_url>/api/v2/scim/Schemas/urn:ietf:params:scim:schemas:extension:tenant:2.0:User' \
--header 'accept: application/scim+json;charset=utf-8' \
--header 'Content-Type: application/scim+json;charset=utf-8' \
--header 'Authorization: Bearer <token>' \
--data '{
"name": "AISecOps Custom Attributes",
"attributes": [
{
"name": "hireDate",
"type": "dateTime",
"description": "Employee hire date",
"mutability": "readWrite",
"returned": "default",
"required": false,
"multiValued": false,
"caseExact": false,
"uniqueness": "none"
}
],
"description": "Netskope AISecOps Additional Attributes",
"id": "urn:ietf:params:scim:schemas:extension:tenant:2.0:User",
"meta": {
"location": "https://<tenant_url>/Schemas/urn:ietf:params:scim:schemas:extension:tenant:2.0:User",
"resourceType": "Schema"
}
}'
- Follow one of the step below:
- If logged in to https://portal.azure.com, open link https://portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true
- If logged in to https://entra.microsoft.com, open link https://entra.microsoft.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true
- From the same page, open the netskope app created earlier and go to the attribute mapping page.
- Add below netskope attributes and save it
- urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.manager : string
- urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.department : string
- urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.organization : string
- urn:ietf:params:scim:schemas:extension:tenant:2.0:User.hireDate : DateTime
- Add mappings so that the final mappings looks like this
Email Manager Approval Workflow
After configuring Netskope with Entra ID and setting up the manager email integration, AISecOps will enable the email manager approval workflow.
If an agent determines that a case requires manager input to assess risk, the investigation is paused to allow an analyst to intervene. The analyst then has two primary options:
- Bypass/Continue: The analyst may choose to skip the email request or “force continue” the investigation if the manager does not respond in time.
- Request Manager Input: The analyst triggers an automated email to the manager. The manager can then authorize or flag the activity directly via the email. The investigation remains paused for up to 6 hours or until the manager responds.
Example email:
Escalation options:
