Security Rules - Netskope Knowledge Portal

A rule is a definition of check created in Netskope Governance Language (NGL). It has associated metadata, such as severity, which is used to identify a specific violation of a SaaS resource.

For example:

microsoft365 remotedomain should-have autoforwardenabled = false

The Rules page allows you to view your rule repository, create new rules, and assign rules to policies to evaluate SaaS app configurations.

Rule Types

Netskope SaaS Security Posture Management (SSPM) supports the following types of rules to help enforce security best practices across SaaS apps:

Predefined Rules: Netskope provides ready-to-use rules for supported SaaS apps. These rules follow industry best practices and common compliance standards. Predefined rules can not be modified.
Predefined Rule Templates: Netskope offers templates for some common security use cases. You can customize these templates by modifying values to match your organization’s needs. For example:
```
Box User should-have textmatch(login, {{ .CompanyDomainString }}) = true
```
Custom Rules: You can create your own rules using Netskope Governance Language (NGL). Custom rules let you define organization-specific security checks that go beyond the predefined options.

Rule Severity

Netskope SSPM categorizes rules into four severity levels: Critical, High, Medium, and Low. Each level indicates the urgency and impact:

Critical: Represents the highest risk and requires immediate attention. These findings are often actively exploited, have severe impact potential, and usually involve unusual misconfigurations.
High: Needs prompt action, ideally within a week. High severity issues can be directly exploited and may lead to serious consequences such as data exposure.
Medium: Common misconfigurations with moderate risk. These findings are generally addressed as part of routine maintenance and may require indirect steps for exploitation.
Low: Informational in nature and pose minimal risk. Exploitation likelihood is low, and any impact would be minor.

View Rules

To see the Custom, Predefined or Template Rules, follow:

Log in to your Netskope tenant UI.
Navigate to Policies > SaaS Security Posture Management.
Click the Rules tab. You will see a list of rules and corresponding categories.
Click on a rule to get a detailed view.

Understanding the Rules Page

The Metrics section at the top of the Rules page displays basic metrics about the rules:

Pending Changes: Number of rules with incorrect NGL definition vs rules with pending changes.
- Rules marked with Error may require review, as it indicates incorrect NGL definition. Rules with errors can not be applied to policies.
- Pending changes are changes you have already done but not yet saved or applied to reflect the findings.
Predefined Rules: Number of predefined rules provided by SSPM.
Custom Rules: Number of rules created by you.
Rule Templates: Number of reusable templates available to help you create new rules.
Predefined Rule and Template Updates (Last 30 Days): This metrics displays the number of predefined rules and templates that were added, deleted, or updated in the past 30 days. You can click on the metrics to dive deeper.
- Newly Added: Number of new predefined rules or templates created in the last 30 days.
- Deleted: Number of predefined rules or templates removed in the last 30 days. When you click the metric, the Include Deleted Rules toggle switches on and the deleted rules appear in the table.
- Updates to Definition: Number of predefined rules with NGL definition changes in the last 30 days.
- Updates to Rule Name: Number of predefined rules or templates where the rule name or the template name has changed in the last 30 days.
- Updates to Categories: Number of predefined rules whose category changed in the last 30 days. A policy can reference rules directly or via categories. When a rule is added to or removed from a category, any policy using that category needs to be re-evaluated, because its effective rule set may have changed.
- Other Updates: Number of predefined rules with other types of updates (for example, description or remediation step changes) in the last 30 days.
  
  See the Rule Change Log to view the specific modifications for the updates rules.

The Include Deleted Rule toggle controls whether deleted rules are shown in the Rules table. When enabled, deleted rules are displayed. By default, the toggle is disabled (OFF).

Below the metrics, the page lists all available rules along with the following details:

Rule Name: The name of the rule.
Type: Indicates whether the rule is a Template, Predefined or Custom.
Severity: The rule’s severity level—Critical, High, Medium, or Low.
In Policies: Number of policies where the rule is currently applied.
Compliance Standard: Standards set by industry or organizations relevant to the rule, such as CIS, HIPAA, ISO, and others.
Domain: Security domain or category, such as IAM, Device Security, or Encryption.
MITRE ATT&CK: Displays mappings to relevant MITRE ATT&CK techniques, if applicable.
Netskope Best Practices: Indicates if the rule aligns with Netskope’s recommended best practices for configuration.

View Rule Change Log

View the rule’s change log to see all modifications. Rule history is retained for up to 2 years, whereas a deleted rule is available for 90 days. To access the change log for a rule:

Click a rule to open the Rule Details side panel.
Scroll to the bottom to find the Change Log section.
You will see entries with the following fields:
- Date: The date when the change occurred. If multiple changes were made on the same day, each will appear as a separate entry.
- Change Type: Indicates the kind of modification made. Possible types include:
  - Updated Definition: Changes to the rule’s logic or criteria
  - Updated Description: Edits to the explanatory text of the rule.
  - Updated Remediation Steps: Alterations to the recommended steps for fixing.
  - Updated Rule Name: A renaming; also includes the previous name.
  - Added Category / Sub-category: Addition of a new category or subcategory (with specifics).
  - Removed Category / Sub-category: Removal of an existing category or subcategory (with specifics).
  - Rule Created / Rule Deleted: Initial creation or deletion of the rule.
- Change Details: Shows exactly what changed, for example, the old and new name, prior description, removed or added categories, and so on.
  
  This change log includes entries from November 14, 2025 onwards. Changes made before the feature release are excluded.

Rule Category

Compliance Standard: A compliance standard is a policy library of security best practices. It is organized into sections and controls. Each control is mapped to one or many rules.
Domain: In the context of Security Operations (SecOps), there are several well-known domains or categories that are commonly addressed to ensure a comprehensive security posture. These domains cover various aspects of security operations and help organizations in managing and responding to security incidents effectively.
MITRE ATT&CK: MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized framework and knowledge base that helps organizations understand and categorize the tactics, techniques, and procedures (TTPs) used by cyber adversaries during various stages of a cyberattack.
Netskope Best Practices: These are Netskope recommended rules for the supported SaaS apps.

Actions on the Rule

Bulk actions – Select one or more custom rules to Revert Pending Changes or Delete rules in bulk action.
Individual actions – Click on the … icon to the right of the rule for options. Depending on whether the rule is Predefined or Custom, the following options are available:
- Add to/Remove from Policy: Rule association to a policy.
- Edit: Make changes to the rule. This option is available for custom rules only.
- Clone: Clone the rule to modify as per requirements.
- Revert Pending Changes: Discard all unsaved changes and restore the last applied version.
- Delete: Delete the rule. This option is available for custom rules only.
- Create Rule: Copy the template to create a custom rule out of the template. This option is available for template rules only.

Filters in Rules

Search a rule by Rule Name ~ search filter or based on Policies filter.
Filter the rules based on Compliance Standard, Domain, MITRE ATT&CK and Netskope Best Practices, App Suite, Resource Type, Severity, Rule Type, and Uncategorized Rules.
Filter the rules based on Change Type (rules added, deleted, or modified) and by Change Time Range, the time range for when the change occurred.

Create New Rules

Click New Rule to start creating a new custom rule. You have to apply the rule to a policy to observe the findings. You can create rules in multiple ways, see: