Configure GitHub for the Next Generation API Data Protection

To configure GitHub for the Next Generation API Data Protection, follow the instructions below. Before that, take a look at the following important notes about this integration:

• Netskope can scan for DLP and threat protection on plain text source code only. Netskope does not scan binary files such as Microsoft Office docs, PDFs, images, executable files, and likes. Each section of a commit that includes any violations will result in a unique incident with a URL linking to that section of the commit. To view a DLP incident, navigate to Incidents > DLP, look for a GitHub incident, and click it.

• If you have set up IP restrictions for your GitHub organization, make sure to allow requests from the installed Netskope CASB API app. This is necessary for Netskope to access your GitHub organization. To learn more: Allowing access by GitHub apps.
  Alternatively, you may add the appropriate Netskope IP ranges to your organization as described in this article. For a list of Netskope IP address ranges, see NewEdge Consolidated List of IP Ranges for Allowlisting (requires a log in credential. If you do not have one, contact support@netskope.com.)

Prerequisite

Before configuring GitHub for the Next Generation API Data Protection, review the prerequisites.

• You require a GitHub Enterprise Cloud edition.

  Next Generation API Data Protection supports GitHub Enterprise Cloud with data residency edition. To learn more about this edition, see GitHub Enterprise Cloud with data residency.

• A GitHub account who is either a member or owner of your GitHub organization.

• If you have guest or external users in your SaaS environment belonging to domains considered internal, you must set the appropriate internal domains for Netskope to classify exposure accurately. To set up internal domains, follow this article.

You can now configure two flavors of GitHub – Commercial (github.com) or GHE (ghe.com) with data residency.

Configure GitHub Instance in Netskope UI

To authorize Netskope to access your GitHub instance, follow the steps below:

1. Log in to the Netskope tenant UI and go to Settings > Configure App Access > Next Gen > CASB API.

2. Under Apps, select GitHub and click Setup CASB API Instance.

   The Setup Instance window opens.

3. Select the Environment.

   Commercial (github.com)

   GHE

   Enter the following:

   • GitHub organization name: Name of the organization where the GitHub app is installed.

     The organization name is case-sensitive.

   Enter the following details:

   • GitHub host: <your-ghe-enterprise-name>.ghe.com

   • GitHub organization name: Name of the organization where the GitHub app is installed.

     The organization name is case-sensitive.

   • GitHub app client ID: As noted in step 4 of Create a GitHub App.

   • GitHub app client secret: As generated in step 5 of Create a GitHub App.

   • GitHub app ID: As noted in step 4 of Create a GitHub App.

   • GitHub app private key: As noted in step 6 of Create a GitHub App.

   • Webhook secret: As generated in step 3.5 of Create a GitHub App.

4. Under Administrator Email, enter the email address of the user who will receive an email notification when a policy violation or event triggers. This step is optional.

5. Under Instance Name, enter a name of the SaaS app instance. This step is optional and if left blank, Netskope will determine the name of the app instance post grant.

6. Click Grant Access. You will be prompted to log in with your GitHub member or owner of your GitHub organization username and password, and then click Sign In. Authorize the app.
   When the configuration results page opens, click Close.

Refresh your browser, and you should see a green check icon next to the instance name.

Next, you can view the Next Generation API Data Protection Inventory page to get deep insights on various entities on your GitHub environment. Navigate to API-enable Protection > CASB API (NEXT GEN) > Inventory. The Inventory page lists the following entities from your GitHub environment:

• Content Collection > Repository: This page displays a list of GitHub repositories.

• Users: This page displays a list of GitHub users.

• User Group: This page displays a list of GitHub teams/user groups.

For more information on the Inventory page, see Next Generation API Data Protection Inventory.

You can receive audit events and standard user behavior analytic alerts in Skope IT. To know more: Next Generation API Data Protection Skope IT Events.

Next, you should configure a Next Generation API Data Protection policy. To do so, see Next Generation API Data Protection Policy Wizard.

Important Notes for GitHub Policies

When configuring a Next Generation API Data Protection policy for GitHub, keep the following limitations and behaviors in mind:

• Restrict Access to Internal Users action

  This action only removes external collaborators from the repository.

• Entity support
  Next Generation GitHub policies currently apply only to commits pushed to a repository.

(Optional) Enable User IP Address in Audit Logs

To view the source IP address of GitHub users in Skope IT under Events & Alerts > Application Events, you must first enable source IP disclosure in your GitHub organization settings.

1. Log in to your GitHub account as a member or owner of the organization. Go to your organization’s landing page.

2. From the top navigation bar, select Settings.

   

3. In the left sidebar, navigate to Archive > Logs > Audit log.

   

4. Click the Settings tab and select Enable source IP disclosure and click Save.

   

Once enabled, you can view the source IP address of each GitHub user in Skope IT > Events & Alerts > Application Events.

(Optional) Uninstall the Netskope CASB API App in GitHub

If you discontinue the integration between GitHub and Next Generation API Data Protection, first, you have to delete the GitHub instance from the Netskope tenant UI. Then, uninstall the Netskope CASB API app from GitHub.

You can uninstall the Netskope CASB API app. To uninstall the app, follow the steps below:

1. Log in to www.github.com using your GitHub administration username.

2. On the top-right, click Settings.

   

3. On the left navigation, click Organizations.

4. Identify the organization where you have installed the GitHub app and click Settings.

5. On the left navigation, click GitHub Apps.

6. Identify the GitHub app and click Configure.

7. Scroll down to the Uninstall <app name> section and click Uninstall.

   

Once you uninstall the app, Netskope stops receiving any notifications from GitHub.