Overview
Netskope DSPM supports scanning self-managed PostgreSQL data stores. Follow these instructions to set up your self-managed PostgreSQL database and configure its connection to Netskope DSPM.
Create a Netskope DSPM Service Account
Begin by configuring a PostgreSQL service account, which will be dedicated to Netskope DSPM’s use. There are two approaches you can use for configuring this service account:
| User Type | Benefits | Drawbacks |
|---|---|---|
| Super User (Netskope DSPM-recommended) | Can automatically access new schemas and databases as they are created. | Some customers are not comfortable with granting super user access. |
| Non-Super User | Useful for customers who wish to grant Netskope DSPM access to only the data within scanning scope. | Must be explicitly granted access to new schemas and databases. |
Super User (Netskope DSPM-recommended)
Non-Super User
- As an administrator, log into your PostgreSQL database’s shell using these AWS instructions.
- Create the Netskope DSPM-specific PostgreSQL user by executing the following commands in order, depending on the user type you wish to create:
| Command | Outcome | Notes |
|---|---|---|
CREATE USER dasera_user WITH PASSWORD 'dasera_password' LOGIN; | Creates the Netskope DSPM-specific user. | Substitute dasera_user and dasera_password with your own preferred values. |
GRANT rds_superuser TO dasera_user; | Grants to the Netskope DSPM-specific user the required permissions which power capabilities within the Netskope DSPM platform. | Substitute dasera_user with your own preferred values. |
- As an administrator, log into your PostgreSQL database’s shell using these AWS instructions.
- Create the Netskope One DSPM-specific PostgreSQL user by executing the following commands in order, depending on the user type you wish to create:
| Command | Outcome | Notes |
|---|---|---|
CREATE USER dasera_user WITH PASSWORD 'dasera_password' LOGIN; | Creates the Netskope One DSPM-specific user. | Substitute dasera_user and dasera_password with your own preferred values. |
GRANT SELECT ON ALL TABLES IN SCHEMA public TO dasera_user; | Grants to the Netskope One DSPM-specific user the required permissions which power capabilities within the Netskope One DSPM platform. | Substitute dasera_user with your own preferred values. This command must be run for each schema or database you wish Netskope One DSPM to scan. |
ALTER DEFAULT PRIVILEGES GRANT SELECT ON TABLES TO dasera_user; | Lets the Netskope One DSPM-specific user access any new tables added in the future, for schemas and databases they can access. | Substitute dasera_user with your own preferred values. This command must be run for each schema or database you wish Netskope One DSPM to scan. |
Retrieve Connection Information
In addition to configuring a service account, Netskope DSPM will require additional information to communicate with your self-managed PostgreSQL database. Please follow the steps below to identify the connection values for later use within Netskope DSPM.
| Corresponding Netskope DSPM Value | Details |
|---|---|
| Endpoint | Enter either the IP address or DNS name for your PostgreSQL instance, used to create the service account above. |
Connect Your Data Store
Step 1: Provide Credentials
Follow these steps to configure the connection:
-
Go to Data Stores > Data Store Inventory.
-
Click CONNECT A DATA STORE in the upper right.
Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
-
In the Connect a Data Store window, click the data store icon you wish to connect.
-
In the Provide Credentials section, complete the following fields:
| Field | Value |
|---|---|
| Data Store Identifier | Provide a friendly name to describe this Data Store. Your value is displayed in other Netskope DSPM screens such as Policy Management and Classification Management. |
| Data Store Endpoint | Enter the corresponding value from the Retrieve Connection Information step above, plus the port number and database name. For example, for a Public IP address like 1.2.3.4 and database named “example_db”, you would enter 1.2.3.4:5432/example_db. Note: 5432 is the default PostgreSQL port number. If you are using a custom port number, be sure to substitute it here. |
| Database Username | Enter the corresponding value from the Create a Netskope DSPM Service Account step above. |
| Password | Enter the corresponding value from the Create a Netskope DSPM Service Account step above. |
| Scan Frequency | Controls how often your Data Store is reviewed for changes. Netskope DSPM’s recommended frequency is defaulted, which you can override if (desired). |
| Sidecar Pool | If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article. |
Step 2: Scanning Infrastructure
- Click Next.
- When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.
| Capability | Supported for self-managed PostgreSQL Data Stores |
|---|---|
| Discovery | N/A |
| Configuration Analysis | N/A |
| Privilege Analysis | Yes (database user & role retrieval only) |
| Shadow Data Analysis | Yes |
| Classification | Yes |
| Data-In-Use Monitoring | Yes (Custom Query Logs only) |
| Automation | Yes (always-on) |
Step 3: Review and Save
- Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
- Click Save to finalize the connection.