This document explains how to configure the Bitsight plugin with the Application Risk Exchange module of the Netskope Cloud Exchange platform. This integration has a monitored vendor’s section that stores the vendor details across the enterprise. This plugin provides a mechanism to send the application data of Netskope tenants to Monitored Vendors for risk analysis. This plugin requires Bitsight account details, which has access to Monitored Vendors.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Netskope Cloud Exchange tenant with the Tenant Plugin and the Risk Exchange plugin already configured..
- Bitsight instance Authorization Key.
- Connectivity to Bitsight.
Bitsight Plugin Support
This plugin provides a mechanism to share Applications to the Bitsight platform.
| Type of data shared | Application |
Mappings
Fields Pushed
| Third-Party Fields | Netskope CE Fields |
|---|---|
| Internal Notes | Application Name, Cloud Confidence Index, CCL, Category Name, Deep Link, Last Shared at |
API Details
List of APIs Used
| API Endpoint | Method | Use Case |
|---|---|---|
| /api/v2/connections.inactives | GET | Get Application/Vendor details |
| /api/tier/{vendor_id}/note | POST | Share applications Risk Score |
Get Application/Vendor Details
Method: GET
Headers:
Content-Type: application/json
Accept: application/json
Authorization: Token {token}
API Request Endpoint: https://api.thirdpartytrust.com/api/v2/connections.inactives
Sample API Response – 200 OK:
[
{
"incoming": {
"model_name": "CompanyConnection",
"approval_boolean": false,
"approval_date": "",
"connection_date": "2021-03-18T11:17:13.837654",
"created_on": "2021-03-18 11:17:13",
"description": "",
"internal_contacts": [],
"lifecyclestate_uuid": "b8ca0bea-1b11-4adf-9601-ee7ec06d4e8e",
"manual": "True",
"owner_contacts": [],
"primary_uuid": "f8feed5f-d200-4ea3-8fe8-8a0fc690eff1",
"relationship_date": "",
"review_year": 0,
"secondary_uuid": "153e6623-da10-404e-bddf-66a872d3c8c3",
"type_relation": "secondary_views_primary",
"uuid": "e3b80f16-3191-4aab-8892-2eb385d7de93",
"is_owner": false
},
"outgoing": null,
"company": {
"model_name": "Company",
"uuid": "f8feed5f-d200-4ea3-8fe8-8a0fc690eff1",
"domain": "oracle.com",
"company_legal_name": "Oracle Corporation, Lodestar",
"name": "Oracle Corporation, Lodestar",
"website": "oracle.com",
"labels": [],
"departments": [],
"lifecycle_state": null,
"logo_url": "https://s3.amazonaws.com/s3-apps-prd-fileservice/d21aa983-4519-4868-a2ec-e2a569d05fb9",
"company_cluster_domain": "oracle.com",
"domains": [],
"generic": {
"connection_date": "2021-03-18T11:17:13.837654",
"description": "",
"approval_date": "",
"approval_boolean": false,
"relationship_date": "",
"lifecycle_state": {
"model_name": "LifeCycle",
"base_value": true,
"color": "#767676",
"icon": "x",
"type": 1,
"uuid": "b8ca0bea-1b11-4adf-9601-ee7ec06d4e8e",
"value": "Base Pending"
}
},
"tier_score": 1,
"trust_score": 55.38,
"next_review_date": "--",
"due_date": {
"date": null
}
}
}
]
Share Applications Risk Score
Method: POST
Headers:
Content-Type: application/json
Accept: application/json
Authorization: Token {token}
Request Body:
{
“note”:”Netskope CE ….”
}
API Request Endpoint: https://api.thirdpartytrust.com/api/tier/{vendor_id}/note
Sample API Response – 200 OK:
[
{
"incoming": {
"model_name": "CompanyConnection",
"approval_boolean": false,
"approval_date": "",
"connection_date": "2021-03-18T11:17:13.837654",
"created_on": "2021-03-18 11:17:13",
"description": "",
"internal_contacts": [],
"lifecyclestate_uuid": "b8ca0bea-1b11-4adf-9601-ee7ec06d4e8e",
"manual": "True",
"owner_contacts": [],
"primary_uuid": "f8feed5f-d200-4ea3-8fe8-8a0fc690eff1",
"relationship_date": "",
"review_year": 0,
"secondary_uuid": "153e6623-da10-404e-bddf-66a872d3c8c3",
"type_relation": "secondary_views_primary",
"uuid": "e3b80f16-3191-4aab-8892-2eb385d7de93",
"is_owner": false
},
"outgoing": null,
"company": {
"model_name": "Company",
"uuid": "f8feed5f-d200-4ea3-8fe8-8a0fc690eff1",
"domain": "oracle.com",
"company_legal_name": "Oracle Corporation, Lodestar",
"name": "Oracle Corporation, Lodestar",
"website": "oracle.com",
"labels": [],
"departments": [],
"lifecycle_state": null,
"logo_url": "https://s3.amazonaws.com/s3-apps-prd-fileservice/d21aa983-4519-4868-a2ec-e2a569d05fb9",
"company_cluster_domain": "oracle.com",
"domains": [],
"generic": {
"connection_date": "2021-03-18T11:17:13.837654",
"description": "",
"approval_date": "",
"approval_boolean": false,
"relationship_date": "",
"lifecycle_state": {
"model_name": "LifeCycle",
"base_value": true,
"color": "#767676",
"icon": "x",
"type": 1,
"uuid": "b8ca0bea-1b11-4adf-9601-ee7ec06d4e8e",
"value": "Base Pending"
}
},
"tier_score": 1,
"trust_score": 55.38,
"next_review_date": "--",
"due_date": {
"date": null
}
}
}
]
User Agent
netskope-ce-1.1.1
Workflow
- Get your Bitsight API Key.
- Configure the Bitsight plugin.
- Configure an Application Risk Exchange Business Rule for Bitsight.
- Configure Application Risk Exchange Sharing for Bitsight.
- Validate the ThirdPartyTrust plugin.
To watch a demo, click play.
Get your Bitsight Authorization Key
- Log in to Bitsight and go to Settings.
- Go to the Integrations tab.
- Click Generate Key.
- Copy the generated Authorization Key. This is needed to configure the Bitsight plugin.
Configure the Bitsight Plugin
- In Cloud Exchange, go to Settings > Plugins. Search for and select the ARE Bitsight plugin.
- Add a Configuration Name, and enable the Use System Proxy if you are using a proxy for configuring the plugin. Click Next.
- Enter the Authorization Key, and click Next.
- Provide the Mapping.
- The left dropdown represents the Bitsight Platform’s field, and the right dropdown represents the Netskope fields.
- Verify the name of the field by expanding the application stored in Cloud Exchange.
- The Company Name present in Bitsight should be the domain, and it can be mapped with the value present in Discovery Domains or Steering Domains present in the application stored in Cloud Exchange.
- Click Save.
Configure an Application Risk Exchange Business Rule for Bitsight
- Go to Application Risk Exchange > Business Rules and click Create New Rule.
- Enter the Rule Name, and configure a query for business rules based on your requirement.
- Click Save.
Configure Application Risk Exchange Sharing for Bitsight
- Go to Application Risk Exchange > Sharing and click Add Sharing Configuration.
- Select the required Business Rule and Configuration (plugin) from their respective dropdowns.
- Click Save.
Validate the Bitsight Plugin
Validate in Cloud Exchange
- Go to Application Risk Exchange > Application. You will be able to see all the applications and their pulled scores.
- Go to the Logging page to see the application pulled.
Note
Only unique applications are stored in Cloud Exchange, so if pulled data are the same from the Netskope tenant, then unique applications will only be stored in Cloud Exchange.
Go to the Logging page to verify the sharing of the application to the Bitsight platform.
Note
The Internal notes are added to the applications on Bitsight based on the unique domains present in the Netskope Applications. For example, if there is only one Application on Cloud Exchange, but it contains multiple discovery and steering domains. On the BitSight platform, there will be multiple applications but with a unique domain. So all the unique domains present in the Cloud Exchange application that are present on BitSight will be updated with the note. There might be the case that for a single Cloud Exchange application multiple applications are updated on BitSight.
In general if a single application in Netskope has many domains, BitSight will list each domain as a separate application.
Validate in Bitsight
- Log in to the Bitsight platform.
- Go to Connections and click Monitored Vendors.
- Go to the Company that got updated.
- Check the Internal notes section to get the Netskope tenant details.
Troubleshooting
Unable to share Applications to the Bitsight Platform
If applications are not shared to the Bitsight platform, check the logs on Cloud Exchange Logging. It could be either of the following.
- Application is not present on the Bitsight platform, that is intended to share.
- The Mapping provided while configuring the Bitsight platform has no match.
What to do: If you have received any warning while sharing the applications, check the warning message and accordingly follow the below step.
- Make sure that the application is already present on the Bitsight platform.
- Make sure that the provided mapping’s value matches properly for Bitsight and the shared applications.
Unable to configure the BitSight plugin
If not able to configure the BitSight Plugin, check the logs in Cloud Exchange Logging. It could the Authorization Key is expired/invalid/deleted.
What to do: If you have received any error while configuring the BitSight Plugin, check the message, and then check the Authorization Key. If it is invalid/expired/deleted, create a new Authorization Key, and then configure the plugin.