Connect Azure PostgreSQL to DSPM - Netskope Technical Documentation

Overview

Netskope DSPM supports scanning Azure PostgreSQL Data Stores. Follow these instructions to setup your Azure PostgreSQL database and configure its connection to Netskope DSPM.

Prerequisites:

You have database administrator access for the data store.
The following are locally-installed:
- Python (version 3 or higher)
- Psycopg PostgreSQL driver for Python
- Azure CLI
You have validated your setup & Azure environment connectivity using the CLI

Retrieve Connection Information

Please follow the steps below to identify the connection values to communicate Netskope DSPM with your Azure PostgreSQL database.

Click this link to log into your Azure Portal, which will navigate you to the resource view of your PostgreSQL servers.
Locate your database server resource and click the hyperlink.
Navigate to the Overview section and take note of the following values:

Highlight Color	Corresponding Netskope DSPM Value	Example
Blue	Data Store Endpoint
Green	Admin name
Blue	List of Databases

Create Netskope DSPM Service Account

A PostgreSQL service account within the database is required for connecting your data store with the Netskope DSPM application. Netskope DSPM provides a Python script which both creates the service account and assigns the necessary non-super user permissions.

Run Script

Open the command line interface (CLI).
Type the following command download the automation script locally in your system

 wget https://dasera-release.s3.us-west-2.amazonaws.com/postgres_setup.py

If necessary, navigate to the directory where the script was downloaded.
Setup your Azure account subscription from CLI by running the following commands
1. az login
2. az account list

Run the script by typing python postgres_setup.py
When prompted, enter the following parameters:

Parameter	Value
Endpoint	Enter the corresponding value from the Retrieve Connection Information step above.
Database	Enter the corresponding database name as listed under Available resources from the Retrieve Connection Information step above.
Port	Enter the corresponding value from the Retrieve Connection Information step above. Note: 5432 is default PostgreSQL port number. If you are using a custom port number, be sure to substitute it here.
Username	Username of the database administrator running this script. Enter the corresponding value from the Retrieve Connection Information step above.
Password	Password of the database administrator running this script
Username to create for Netskope DSPM user	Provide the Database name for which you want to create the Netskope DSPM DB user. dasera_user is recommended, but you can use any value.
Password	Password for the Netskope DSPM DB user

When the script is complete, the following message (or similar) will be displayed:

Created user dasera_sa with global select access

Since the DB admin privileges might differ in each of the databases, you would need to run the above steps, for each of the databases separately that you wish to connect with Netskope DSPM application.

Connect Your Data Store

Before attempting to connect an Azure Data Store, be sure you have configured a Netskope DSPM-specific Azure Service Account as described above and onboarded the Azure Infrastructure for this Data Store.

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Select Azure Account	Select one of the Azure Accounts defined within the Infrastructure Section screen. The field will default if there is just one AWS Account configured.
Data Store Identifier	Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5439/example_db. Note: 5432 is default PostgreSQL DB port number. If you are using a custom port number, be sure to substitute it here.
Database Username	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Authentication Method	Select “Password”.
Password	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Side car	Provide reference of a sidecar instance connected to Database (optional) Note: Refer to the article Installing Netskope DSPM sidecar via Azure containers for more details
Scan Frequency	Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override if (desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Capability	Supported for PostgreSQL
Discovery	Yes (always-on)
Privilege Analysis	Yes (database user & role retrieval only)
Shadow Data Analysis	No
Classification	Yes
Data In Use Monitoring	No (custom query logs only)
Automation	Yes (always-on)

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.

Overview

Netskope DSPM supports scanning Azure PostgreSQL Data Stores. Follow these instructions to setup your Azure PostgreSQL database and configure its connection to Netskope DSPM.

Prerequisites:

You have database administrator access for the data store.
The following are locally-installed:
- Python (version 3 or higher)
- Psycopg PostgreSQL driver for Python
- Azure CLI
You have validated your setup & Azure environment connectivity using the CLI

Retrieve Connection Information

Please follow the steps below to identify the connection values to communicate Netskope DSPM with your Azure PostgreSQL database.

Click this link to log into your Azure Portal, which will navigate you to the resource view of your PostgreSQL servers.
Locate your database server resource and click the hyperlink.
Navigate to the Overview section and take note of the following values:

Highlight Color	Corresponding Netskope DSPM Value	Example
Blue	Data Store Endpoint
Green	Admin name
Blue	List of Databases

Create Netskope DSPM Service Account

Run Script

Open the command line interface (CLI).
Type the following command download the automation script locally in your system

 wget https://dasera-release.s3.us-west-2.amazonaws.com/postgres_setup.py

If necessary, navigate to the directory where the script was downloaded.
Setup your Azure account subscription from CLI by running the following commands
1. az login
2. az account list

Run the script by typing python postgres_setup.py
When prompted, enter the following parameters:

Parameter	Value
Endpoint	Enter the corresponding value from the Retrieve Connection Information step above.
Database	Enter the corresponding database name as listed under Available resources from the Retrieve Connection Information step above.
Port	Enter the corresponding value from the Retrieve Connection Information step above. Note: 5432 is default PostgreSQL port number. If you are using a custom port number, be sure to substitute it here.
Username	Username of the database administrator running this script. Enter the corresponding value from the Retrieve Connection Information step above.
Password	Password of the database administrator running this script
Username to create for Netskope DSPM user	Provide the Database name for which you want to create the Netskope DSPM DB user. dasera_user is recommended, but you can use any value.
Password	Password for the Netskope DSPM DB user

When the script is complete, the following message (or similar) will be displayed:

Created user dasera_sa with global select access

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Select Azure Account	Select one of the Azure Accounts defined within the Infrastructure Section screen. The field will default if there is just one AWS Account configured.
Data Store Identifier	Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5439/example_db. Note: 5432 is default PostgreSQL DB port number. If you are using a custom port number, be sure to substitute it here.
Database Username	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Authentication Method	Select “Password”.
Password	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Side car	Provide reference of a sidecar instance connected to Database (optional) Note: Refer to the article Installing Netskope DSPM sidecar via Azure containers for more details
Scan Frequency	Controls how often your Data Store is reviewed for changes, Netskope DSPM’s recommended frequency is defaulted, which you can override if (desired).
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Capability	Supported for PostgreSQL
Discovery	Yes (always-on)
Privilege Analysis	Yes (database user & role retrieval only)
Shadow Data Analysis	No
Classification	Yes
Data In Use Monitoring	No (custom query logs only)
Automation	Yes (always-on)

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.