Netskope Cloud Exchange

Configure IoC Sharing

Only an Admin can configure IoC sharing. This section describes how to configure IoC sharing between the plugins (and therefore connected vendor systems). Make sure to identify the sharing requirements between systems in advance of configuration. The sharing filters (optionally posted in the filter query box) allow for greater control over what data is shared with each plugin. This is covered in a later section on filtering.

image15.png
  1. In the Threat Exchange module, click Sharing. The Sharing page displays the existing relationships for each sharing configuration in grid view as shown below. The Sharing page also has inputs to configure new sharing from one plugin to another.

    image16.png
  2. Adding a new sharing configuration on the active source poll will share the existing IoCs of the configuration to the destination configuration. Whenever a new sharing configuration is built, all the active IoCs will also be considered for sharing if they match the source/destination combination.

  3. The sharing configuration is unidirectional by default: data obtained from one plug-in is shared with another plugged-in system. To achieve bi-directional sharing, configure both directions of sharing separately.

Note

Plugins that do not have API for ingesting data cannot receive threat data. This is true of the installed plugin API Source, which provides a bucket associated with an API endpoint for remote 3rd-party systems to push data to.

Add a Sharing Configuration

  1. Select a configured plugin that will act as the source. IoCs from this configuration will be available to be shared with other plugged-in systems.

  2. Select a configuration that will receive the IoCs from the source selected in step 1. You can select multiple destinations, or delete some or all systems by clicking on the X next to the plugin name.

  3. Click Add.

    image17.png

After a sharing configuration has been created, the card will show the system(s) that the source data from that plugin (vendor name, plugin name) is being pushed.

Delete a Sharing Configuration

  1. To delete a sharing configuration, click the X over the name of the destination system in the applicable card in the grid view as shown below. The UI will prompt you to confirm deletion before proceeding. Deleting a sharing configuration will immediately stop the sharing of new IoCs; it will not change any IoCs already shared with plugged-in system(s) in those apps.

  2. To delete the entire sharing configuration for a source plugin, delete all shared destinations from the tile.

    image18.png