Microsoft File Share Plugin for Custom File Classification

This document explains how to configure the Microsoft File Share v1.1.0 plugin with the Custom File Classification (CFC) module of the Netskope Cloud Exchange platform. This plugin is used to pull images or zip files from provided directories present on a remote Windows server. The plugin supports both SMB protocol (version 2.0.2 to 3.1.1) and SFTP protocol for file transfer.

Prerequisites

To complete the configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Custom File Classifier on your Netskope tenant.
• A Netskope Cloud Exchange tenant with the Tenant plugin and the Custom File Classification plugin already configured.
• Windows Server with SFTP/SMB Protocol setup and access with SSH service enabled to pull files.
• Image or Archives of image files stored on the Microsoft server containing the data to be processed for CFC hash generation.

For the SMB Protocol

• Microsoft server with network sharing enabled (SMB/CIFS service running).
• Shared folder configured with appropriate permissions.
• Network connectivity to the Microsoft server on SMB ports (typically 445).

For the SFTP Protocol

• Microsoft server with OpenSSH service enabled and configured.
• SSH service running and accessible from Cloud Exchange.
• Network connectivity to the Microsoft server via SFTP protocol (typically port 22).

Microsoft File Share CFC Plugin Support

This plugin is used to pull images or zip files from provided directories present on a remote Windows server. The plugin supports both SMB protocol (version 2.0.2 to 3.1.1) and SFTP protocol for file transfer.

Permissions

This permission is needed for the plugin configuration: a SSH User should have read access for the provided files.

Microsoft Server Permissions

Required Permissions

These permissions are needed for the plugin configuration:

For the SMB Protocol

• Microsoft server with network sharing enabled (SMB/CIFS service running).
• Shared folder configured with appropriate permissions.
• Network connectivity to the Microsoft server on SMB ports (typically 445).

For the SFTP Protocol

• Microsoft server with OpenSSH service enabled and configured.
• SSH service running and accessible from Cloud Exchange.
• Network connectivity to the Microsoft server via SFTP protocol (typically port 22).

import paramiko

ssh_connection = paramiko.SSHClient()

ssh_connection.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ssh_connection.connect(

    hostname=configuration.get("sftp_server_ip", ""),

    username=configuration.get("sftp_username", ""),

    password=configuration.get("sftp_password", ""),

    port=configuration.get("sftp_port", 22)

)

with ssh_connection.open_sftp() as sftp_session:

sftp_session.get(

    data.get("path", ""),

    os.path.join(

    file_path, data.get("file", "")))

try:

    file_attributes = sftp_session.stat(directory_path)

    if not stat.S_ISDIR(file_attributes.st_mode):

        # Handle custom error

except FileNotFoundError:

    # Handle file not found error    pass

ssh_connection.close()

Performance Matrix

Here is the performance reading conducted for fetching and storing 10K Files metadata ( ~5.4 MB each file size and total file size is ~52.5 GB) on a Large Cloud Exchange instance with these specifications.

Workflow

1. Configure the Microsoft Server.
2. Configure the Microsoft File Share CFC plugin.
3. Configure a Business Rule for Microsoft File Share.
4. Configure Sharing for Microsoft File Share.
5. Validation for Microsoft File Share CFC Plugin.

Watch a Video

Click play to watch a video.

Configure the Microsoft Server with SFTP Protocol

1. Open PowerShell as Administrator (right-click > Run as Administrator).
2. Run the following command: Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
3. Verify successful installation by checking the output for State: Installed.
4. Open PowerShell as Administrator.
5. Start the SSH service: Start-Service sshd
6. Configure the service to start automatically on boot: Set-Service -Name sshd -StartupType 'Automatic'
7. Verify the service is running: Get-Service sshd
8. Go to the SSH configuration directory: cd 'C:\ProgramData\ssh'
9. Open the configuration file in Notepad if you want change port or allow users
10. After saving the configuration file, restart the service to apply changes: Restart-Service sshd
11. Open Windows Defender Firewall with Advanced Security from the Start Menu.
12. Click Inbound Rules in the left pane, then New Rule on the right.
13. Select Port as the rule type and click Next.
14. Select TCP, enter port 22 (or your custom port), and click Next.
15. Select Allow the Connection and click Next.
16. Select the applicable profiles (Domain, Private, Public) and click Next.
17. Name the rule Allow SFTP and click Finish.
18. Use any standard SFTP client to verify the connection like WinSCP. If the connection is established, you should be able to view the shared directory path.

Configure the Microsoft Server with SMB Protocol

1. Configure network sharing to work with the SMB protocol.

2. Right-click on the directory that has the images that you want to pull as part of this plugin. Go to the Sharing tab and click Advanced Sharing.

   

3. Check the Share folder option and click Permissions.

   

4. Click Add if the user for which you want to configure the network sharing is not present in the Group or user names section. Click Advanced, Find Now, and add the user.

   

5. Verify that the user can be seen on the Permissions dialog box and make sure that it has Read permissions for the directory.

   

6. Apply the configuration changes and ensure that the directory name appears immediately after the Computer/Machine name in the Network Path. When a directory with the same name is already configured on the machine, it will add an index after the directory name in the Network Path to uniquely identify it through SMB protocol. In this scenario, make sure to provide the directory name with the index while configuring the plugin.

   

7. Enable OpenSSH service on Windows server to work with SFTP protocol.

   • Follow these steps to enable the OpenSSH service on the Windows server
     https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui
   • For older versions of Windows, If OpenSSH isn’t found in the Optional features, Install the OpenSSH service by following this document:
     https://github.com/PowerShell/Win32-OpenSSH/releases/
   • Make sure that the User to be configured can use the OpenSSH service.

Configure the Microsoft File Share CFC Plugin

1. In Cloud Exchange, go to Settings > Plugin Store.

2. Search for and select the Microsoft File Share v 1.1.0 (CFC) plugin.

   

3. Enter the Basic Information:

   • Configuration Name: Enter a name appropriate for your integration.
   • Sync Interval: Interval to pull the data from plugin source. We recommend keeping it longer than 12 hours. (Default: 12 hours)

   

4. Select protocol per your requirements.

   

5. Click Next and enter the Configuration Parameters:

   For the SFTP Protocol

   • Server IP/Hostname: Hostname or IP address of the Windows machine from which the files are to be pulled.
   • Username: Username of the Windows machine that is configured to use OpenSSH service on the machine.
   • Password: Password for the provided username.
   • Port: TCP port number to connect to the OpenSSH service on the machine.

   

   For the SMB Protocol

   • Server IP/Hostname: Hostname or IP address of the server from which the files are to be pulled.
   • Machine Name: NetBIOS machine name of the server.
   • Username: Username of the remote machine which has read access to shared directories.
   • Password: Password for the provided username.

   

   We suggest to you the SMB plugin for Custom File Classification for SMB Protocol.

6. Click Next and enter the Directory Configuration parameters:

   • Directory Path: Path of the directory from where the files will be pulled. It supports files with extensions related to Images or Zip formats.
   • Filename Filter: A Regular expression that filters the image files to be pulled. Ensure that the filter is a valid regular expression.
     • Empty value, pull all the files from directory.
     • The filter will only pull the images stored immediately in the directory.

   

   You can add multiple directories in the Microsoft File Share Plugin.

7. Click Next and preview file scanning results for the configured directory. Ensure that the file count and size of files being pulled up by the plugin are correct and do not exceed the total file count limit (10,000) and total file size limit (~78.125 GB).

   

8. Click Save.

   

Configure a CFC Business Rule for Microsoft File Share

The CFC module requires business rules to share file data to the Netskope Tenant. You can add rules to filter files by name, size, extension, source, etc. Multiple rules can be grouped together for advanced filtering.

1. Go to Custom File Classification > Business Rules.

2. Click Create New Rule and enter these parameters:

   • Rule Name: A unique name for the business rule.
   • Rule: Set a filter based on conditions to make a group of files.
   • Folder Name: Provide a folder or sub-folder name to group multiple business rules. It will help to see a structured list of business rules in the table.

   

3. Click Save.

   

Configure Risk Exchange Sharing for Microsoft File Share

1. Go to Custom File Classification > Sharing.

2. Click Add Sharing Configuration and select the Microsoft File Share CFC plugin as the Source Configuration.

3. Select the Netskope CFC plugin as the Destination Configuration.

4. The Target will be selected by default, based on the Destination Configuration.

5. Select a Mapping for Business Rule, File Classifier, and Training Type. You can map multiple business rules in one sharing. The File Classifier lists only custom file classifiers created on the Netskope Tenant.

   

6. Click Save.

   

Sync or Delete a Sharing Configuration

• Sync the sharing configuration by clicking on the synchronization icon. This starts the sharing process immediately, without waiting for the actual event to be triggered.
• Delete the sharing configuration by clicking on the garbage can icon.

Validate the Microsoft File Share CFC Plugin

Validate the Pull

After the Sharing is configured, you should wait until the next plugin lifecycle run of the configured Microsoft File Share CFC plugin gets executed successfully.

Validate the Microsoft File Share Plugin status on the Sharing and Upload Management page. Go to Custom File Classification > Sharing and Upload Management.

The status of the Sharing configuration can be one of the following:

• Scheduled: This represents that the sharing is configured but it is still in the queue and waiting to run for the first time.
• Generating Hash: This represents that the process of generating a hash is in progress. 
• Uploading Hash: This represents that the hash is generated successfully and the process of sharing it to the configured destination is in progress.
• Completed: This indicates that the generated hash is successfully shared with the destination configuration.
• Failed: Indicates that the process failed in either pulling data, hashing data or uploading hash.

Clicking View Metadata will redirect you to the Files Metadata page.

Validate Sharing on the Netskope Tenant

1. Log in to your Netskope Tenant.

2. Go to Policies > DLP > File Classifiers.

   

   

3. Select the Classifier that you have selected during the sharing configuration, you will see the file hashes received here:

   

Troubleshooting the Microsoft File Share CFC Plugin

Unable to configure the Microsoft File Share CFC Plugin

If the user is unable to configure the Microsoft File Share CFC plugin, it may be due to one of these reasons:

• Incorrect credentials were provided.
• The user doesn’t have permission to read the file.
• Incorrect hostname/server IP.
• The provided port value is disabled on the Server.
• Incorrect directory path.

What to do:

1. Make sure to provide the correct credentials.
2. Make sure that the user has the required permissions to read the file.
3. Make sure that the correct hostname/ server IP is provided.
4. Make sure that the port is enabled and in listening mode.
5. Make sure you have the image file data in the provided path.