Netskope Help

Configure the Threat Exchange Plugin

Only an Admin can configure the Threat Exchange plugin. This section describes how to configure the primary Netskope tenant for Threat Exchange. This configuration ensures that alerts data from the tenant is pulled regularly.

  1. Go to Settings and click Plugins.

  2. Click the Netskope v1.0.0 (CTE) box.

  3. On the first section, enter a Configuration Name and your Tenant URL (<tenantname>.goskope.com). Details about the other parameters are in the table below. When finished, click Next.

    TE-Basic-Info.png
  4. In the second section, enter the configuration parameters related to access to the tenant, file list, and URL list. When finished, click Save in the top right corner.

    TE-Parameters.png

Field

Description

Default Value

Filter Query

Select a filter query from the dropdown list.

-

Age of Indictors

The age range retained.

-

Tenant Name

Netskope Tenant name, like<companyname>.goskope.com

-

Aging Criteria

How long before the indicator is marked “inactive” and will no longer be sharable.

-

Override Reputation

All reputation indicators are honored when provided by plugged in alliance partners. If they are not provided, their reputation is set to 5. The native or assigned value can be overridden when setting this value. When using the prepopulated value of 0, the defaults are not changed.

5

Enable Polling

Enable/Disable polling data from Netskope.

Yes

Type of the Threat data to pull

Type of Threat data to pull. Allowed values are Malware, URL (For Malsite data) and Both.

Both

Initial Range

Number of days to pull the data for the initial run.

7

File Hash List name

The name of File Hash List on Netskope where malware file hashes are pushed.

-

URL List name

The name of the URL List on Netskope where malsites are stored.

-

Maximum File hash list size

Size of allowed payload(In MBs) for File Hash List. Defaults to 8MB.

8

Maximum URL list size

Size of allowed payload(In MBs) for URL list. Defaults to 8MB.

8

Default URL

Netskope requires a URL to be populated when initially creating a file. The default URL will be replaced during the first live upload of production data.

-