This document explains how to configure Azure Cloud Storage with the Log Shipper module of the Netskope Cloud Exchange platform. This integration allows pushing the WebTx data and creating blobs inside the container in Azure Blob Storage.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Netskope Cloud Exchange tenant with the Tenant plugin and Log Shipper plugin already configured.
- A Netskope Cloud Exchange tenant with AWS Netskope Log Streaming or Azure Netskope Log Streaming plugin already configured (for pulling WebTx from the Netskope Log Streaming plugins).
- An Azure Cloud instance.
Note
- Verify your Azure Blob instance permissions are secure and not set up for open public access. Only allow access to your cloud storage instance from your Cloud Exchange Host and any other addresses that need access.
- CLS WebTX based on Google Pub Sub Lite is deprecated. Please refer to Netskope Product EOL/EOS Announcements – Netskope Knowledge Portal
- For ingesting WebTX logs to your Log delivery destinations like SIEM, SOAR, XDR, Data Lake, use the AWS Netskope Log Streaming or Azure Netskope Log Streaming plugin.
Workflow
- Configure an Azure Cloud account.
- Configure the Azure Cloud Storage plugin.
- Configure Log Shipper Log Delivery.
- Validate the plugin.
Click play to watch a video.
Configure an Azure Cloud Storage Account
- Go to your Azure instance https://portal.azure.com/.
- Log in to your Azure Cloud instance.
- Click on Storage Accounts, Click + Create and provide a unique Storage Account name, and then click on Review + Create. Shortly, a Storage Account will be created and deployment will be completed.
- Click on Home, and go to Storage Accounts, Search for your storage account.
- In the left pane, under Security + networking, click on Access Keys and copy the connection string, it will be required when configuring the Azure Cloud plugin.
Configure the Azure Cloud Storage Plugin
- In Cloud Exchange, go to Settings > Plugin Store.
- Search for and select the Azure Cloud Storage v1.0.1 (CLS) plugin.
- Enter a Configuration Name.
- Click Next.
- Enter your Azure Connection String, Container Name, Object Prefix, Minimum File Size, and Minimum Duration.
- Container names must start with a letter or number, and can contain only letters, numbers, and the dash character.
- Every dash character must be immediately preceded and followed by a letter or number; consecutive dashes are not permitted in container names.
- All letters in a container name must be lowercase.
- Container names must be from 3 through 63 characters long.
- Click Save.
Configure a Log Shipper Log Delivery for Azure Storage
- Go to Log Shipper > Log Delivery and click Add Log Delivery Configuration.
- Select the Source plugin (AWS Netskope Log Streaming or Azure Netskope Log Streaming) and Destination plugin (Microsoft Azure Storage.)
- Click Save.
Validate the Azure Storage Plugin
To validate the configuration, you must have Azure instance and/or SIEM mappings.
Validate in Netskope Cloud Exchange
Go to Logging. Logs will be seen regarding File name and data ingested into Azure.
Validate the Storage Plugin in Azure:
- In your Azure instance From Storage accounts.
- Go to Storage Accounts and search your storage account from the list.
- In the left pane, under Data Storage, click on Containers. The container name which has been given while configuring the plugin would be seen in the list. If the Container has already been there, files will be appended, else a new Container would be created and then files will be pushed.
- Click on a Container Name and files pushed into Azure will be seen, and by clicking on the file, the Download option appears to view the content locally.
