Connect Self-Managed IBM Db2 to DSPM - Netskope Knowledge Portal

Overview

Netskope One supports scanning self-managed IBM Db2 data stores. Follow these instructions to set up your self-managed IBM Db2 database and configure its connection to Netskope DSPM.

Create a Netskope DSPM Service Account

Begin by configuring an IBM Db2 database service account which will be dedicated to Netskope DSPM’s use.

There are two approaches you can use for configuring this service account.

User Type	Benefit	Note
Super User (Netskope DSPM-recommended)	Can automatically access new schemas and tables as they are created.	Some customers are not comfortable with granting super user access.
Read-only User	Useful for customers who wish to grant Netskope DSPM access to only the data within scanning scope.	Must be explicitly granted access to new schemas and tables.

IBM Db2 does not manage user accounts internally, instead it relies on an external authentication system for user management. Hence this process will vary based on your environment such as Windows, Linux, LDAP, etc. The following steps may require the assistance of your local database administrator.

In both the approaches, you will need to ask your system administrator to create the service account with the privileges you wish to grant.

Super User

Non-Super User (manual)

Non-Super User (script)

As a database administrator user, log onto your Db2 Shell interface.
Make sure the new user has access to CONNECT to the database
Create the Netskope DSPM-specific IBM Db2 user by executing the following commands in order, depending on the user type you wish to create:

Command	Outcome
`GRANT CONNECT ON DATABASE TO USER <USER_NAME>;`	Grant the Netskope DSPM-specific user access to IBM Db2 database.
`GRANT DATAACCESS ON DATABASE TO USER <USER_NAME>;`	Grant the newly created user privileges to access all data. Note: This will also grant privileges to INSERT, UPDATE, or DELETE data from tables.

As a database administrator user, log onto your Db2 Shell interface.
Make sure the new user has access to CONNECT to the database
Create the Netskope One DSPM-specific IBM Db2 user by executing the following commands in order, depending on the user type you wish to create:

Command	Outcome
`GRANT CONNECT ON DATABASE TO USER <USER_NAME>;`	Grant the Netskope One DSPM-specific user access to IBM Db2 database.
`GRANT SELECTIN ON SCHEMA <SCHEMA_NAME> TO USER <USER_NAME>;`	Grant read-only privileges to specific schemas. Note: This command must be run for each schema or database you wish Netskope One DSPM to scan.
`GRANT SELECT ON TABLE <SCHEMA_NAME>.<TABLE_NAME> TO USER <USER_NAME>;`	Grant read-only privileges to specific tables. Note: This command must be run for each schema or database you wish Netskope One DSPM to scan.

Netskope DSPM provides a script that you can use to grant read-only permissions to the newly created service account.

Prerequisites

You have database administrator access for the data store.
You have a python environment for IBM database servers set-up and running.
Make sure the environment where you are running the script can connect to your database instance.

Run Script

Open the command line interface (CLI).
Run the following command to download the script:

wget https://dasera-release.s3.us-west-2.amazonaws.com/db2_setup.py

If necessary, navigate to the directory where the script was downloaded.
Run the script using python db2_setup.py
When prompted, enter the following parameters:

Parameter	Value
Database Endpoint	The IP address or DNS name of your IBM Db2 instance
Port	The TCP/IP port number that Db2 is exposed on (default is 50000)
Database	The name of the Db2 database
Username	Username of the Db2 admin user which has the permission to invoke SELECTIN grant to DSPM Service Account
Password	Password for the above user
Username for Netskope DSPM User	Username for the Netskope One DSPM Service Account

Retrieve Connection Information

In addition to configuring a service account, Netskope DSPM will require additional information to communicate with your self-managed IBM Db2 database. Please follow the steps below to identify the connection values for later use within Netskope DSPM.

Corresponding Netskope DSPMValue	Details
Endpoint	– Enter a single string in the format: `server_address:port/database` – `server_address` – the IP address or DNS name of your IBM Db2 instance – `port` – the TCP/IP port number that Db2 is exposed on (default is 50000) – `database`– the name of the Db2 database

Note that in IBM Db2, each database within the instance is completely isolated. Hence, in order to connect multiple databases, you will need to create multiple data store connections within Netskope DSPM. Replace the /database part in the endpoint with the database you wish to connect each time.

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Data Store Identifier	Human-friendly name to describe this Data Store. This value displays in other Netskope DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5432/example_db. 50000 is the default IBM Db2 port number. If you are using a custom port number, be sure to substitute it here.
Database Username (if Service Account)	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Password (if Service Account)	Enter the corresponding value from the Create a Netskope DSPM Service Account step above.
Scan Frequency	Controls how often your Data Store is reviewed for changes; Netskope DSPM’s recommended frequency is defaulted, which you can override as needed.
Sidecar Pool	If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Capability	Supported for Oracle Base Database
Discovery	Yes (always-on)
Privilege Analysis	Yes
Shadow Data Analysis	No
Classification	Yes
Data In Use Monitoring	No
Automation	Yes (always-on)

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.