Docy

Configure the Netskope Plugin for User Risk Exchange

Configure the Netskope Plugin for User Risk Exchange

This document explains how to configure the Netskope integration with the User Risk Exchange workflow of the Netskope Cloud Exchange platform. This integration extracts users from UBA alerts and populates user scores from Netskope.

Prerequisites

To complete this configuration, you need:

  • A Netskope Tenant (or multiple, for example, production and development/test instances) that is already configured in Cloud Exchange.
  • A Netskope Cloud Exchange tenant with the User Risk Exchange module already configured.

Workflow

  1. Obtain your SCIM Server URL and SCIM Key from your Netskope Tenant.
  2. Configure the Netskope plugin for User Risk Exchange.
  3. Configure User Risk Exchange Business Rules and Actions for the Netskope plugin.
  4. Validate the Netskope plugin for User Risk Exchange.

Get your SCIM Server URL and SCIM Key

  1. Log in to the Netskope UI.
  2. Go to Settings > Tools > Directory Tools.
  3. Select the SCIM Integration tab from the top of the page.
    image11.png
  4. Make note of the SCIM Server URL.
  5. Click New Auth Token , enter a Client name, and click Generate Token.
    image1.png
  6. Save the token and use it for the SCIM Key when configuring the Netskope plugin.

Configure the Netskope Plugin for User Risk Exchange

  1. In Cloud Exchange, go to Settings > Plugins.
  2. Select the Netskope (CRE) box to open the plugin creation page.
    image3.png
  3. Enter a configuration name and select your Netskope tenant.
    image9.png
  4. Enter your SCIM Server URL and SCIM Key.
    image12.png
  5. Select the range of scores.
    image8.png
  6. Click Save.
    image2.png

Configure Business Rules for User Risk Exchange

  1. Go to User Risk Exchange and click Business Rules.
  2. Click Create New Rule.
    image7.jpg
  3. Select the options in the filter that you want to use. From the dropdowns, select a field, an operator, and a value. For example: Aggregate Score Grouping – Any in – medium.
    image6.png

You can see what your users’ scores are by going to Users in the Risk Exchange left panel.

Configure Actions for User Risk Exchange

  1. Go to User Risk Exchange and click Actions.
  2. Click Add Action Configuration.
    image4.jpg
  3. Click the Business Rule dropdown and select the Business rule you created.
  4. From the Configuration dropdown, select your Risk Exchange plugin.
  5. From the Actions dropdown, select the Add to Group, Remove to Group, or No Action options.
    • Add to Group: When triggered, users are added to that group.
    • Remove to Group: When triggered, users are removed from that group.
    • No Action: This does not perform any actions on users.
      image5.png

      Enable the Generate Alert toggle. This ensures that new alerts are added in the Ticket Orchestrator module whenever this action is taken.

  6. Click Save.

Validate the Netskope Plugin for User Risk Exchange

To verify the plugin is working correctly, go to Risk Exchange > User and confirm whether any risky users are being listed.

image10.png
Share this Doc
In this topic ...