Connect SQL Server to DSPM - Netskope Technical Documentation

Overview

Netskope One DSPM supports scanning self-managed SQL Server Data Stores. Follow these instructions to setup your self-managed SQL Server database and configure its connection to Netskope One DSPM.

Create Netskope One DSPM Service Account

These steps may require the assistance of your local database administrator.

These configuration commands are required only if you connect using SQL Server Authentication (Username / Password). If you authenticate using Active Directory or Kerberos, database administrators must provision the domain account or Kerberos service principal with equivalent read access (db_datareader) and metadata permissions according to your organization’s directory service procedures.

Begin by configuring a service account which will be dedicated to Netskope One DSPM’s use.

As a DB administrator, log into your SQL database.
Create the Netskope One DSPM-specific SQL user by executing the following commands in the mentioned order:

Command	Outcome	Notes
`CREATE LOGIN 'dasera_user' WITH PASSWORD ='dasera_password';`	Creates the DB user with which will be dedicated to Netskope One DSPM’s use as a service account.	Substitute `dasera_user` and `dasera_password` with your own preferred values. You will need this information later when configuring Netskope One DSPM. Note: We recommend to use `dasera` as the username and a password of your choice. You will need this information later when configuring Netskope One DSPM.
`USE "database name";` `CREATE USER dasera FOR LOGIN 'dasera_user';` `ALTER ROLE db_datareader ADD MEMBER dasera;`	Grants read-only access to the Netskope One DSPM specific DB user in each SQL database to you want to scan.	Substitute `database name` with each SQL DB you wish to scan with Netskope One DSPM Application. The `CREATE USER` command enables the previously-created `LOGIN` to access the database. The built-in `db_datareader` role grants read-only access to all schemas and tables (including system tables) on the active database.

Retrieve Connection Information

In addition to configuring a service account, Netskope One DSPM will also require additional information in order to communicate with your SQL database. Please follow the steps below to identify the connection values for later use within Netskope One DSPM.

Corresponding Netskope One DSPM Value	Details
Endpoint	Either the fully-qualified domain name or the listener IP address for your SQL Server instance, used to create the service account above. If necessary, the latter can be found by: – Querying the `local_net_address` Connection Property. – Running `ipconfig.exe` from the instance’s CLI and parsing its output
Port	Either the default (`1433`) or the TCP/IP port value override defined within SQL Server Configuration Manager.

Connect Your Data Store

Step 1: Provide Credentials

Follow these steps to configure the connection:

Go to Data Stores > Data Store Inventory.
Click CONNECT A DATA STORE in the upper right.

Tip: Alternatively, if the data store was already found by auto-discovery, go to the Discovered tab and click Connect in the Actions column.
In the Connect a Data Store window, click the data store icon you wish to connect.
In the Provide Credentials section, complete the following fields:

Field	Value
Data Store Identifier	Friendly name to describe this Data Store. Your value is displayed in other Netskope One DSPM screens such as Policy Management and Classification Management.
Data Store Endpoint	Enter the corresponding value from the prior section above.
Authentication Type	Select the authentication method configured on your SQL Server instance: • Username / Password: Standard SQL Server database authentication. • Active Directory Password: Active Directory domain user authentication. • Active Directory Principal: Active Directory principal authentication using a Principal ID and Principal Secret. • Kerberos (Username / Password): Kerberos authentication using a Kerberos Principal and Password. • Kerberos (Keytab): Kerberos authentication using a Kerberos Principal and an uploaded `.keytab` file.
Username	Enter the database username (for SQL Server Authentication) or domain account username (for Windows Authentication).
Password	Enter the corresponding password for the user account specified above. (Applicable when using SQL Server Authentication or Kerberos Username and Password).
Keytab File	If using Windows Authentication (Kerberos) with a keytab file, upload the valid Kerberos `.keytab` file generated for your domain account or Service Principal Name (SPN).
Scan Frequency	Controls how often your Data Store is reviewed for changes. Netskope One DSPM’s recommended frequency is defaulted, which you can override (if desired).

You can switch between Username and Password and Keytab File authentication at any time by editing the data store connection in Settings > DSPM > Data Stores.

Step 2: Scanning Infrastructure

Click Next.
When the Select Capabilities tab appears, complete the following fields:
- Assign a Data Owner (Optional): Select one or more users responsible for this data store.
- Which databases should Netskope DSPM scan?: Select the specific data stores and schemas to monitor, if applicable.
- Features: Select the features you want to enable.

Capability	Supported for Microsoft SQL Server
Discovery	Yes (always-on)
Configuration Analysis	Yes
Privilege Analysis	Yes
Stale Data Analysis	Yes
Classification	Yes
Data De-Identification (DID)	Yes
Data In Use Monitoring	No (custom query logs only)
Automation	Yes (always-on)

To learn more about structured de-identification workflows see Apply DSPM Data De-Identification.

Step 3: Review and Save

Click Save.
- When the Review tab appears, the system validates your configuration. If there are any issues, follow the on-screen instructions to fix them.
Click Save to finalize the connection.