Onboard Custom SaaS Apps

Custom SaaS app can be any SaaS app that your organization uses, whether publicly available or built in-house, that isn’t supported out-of-the-box by Netskope SSPM. With Bring Your Own App (BYOA), you can extend the SSPM monitoring to custom SaaS apps. It allows you to define configuration attributes to be monitored, create custom rules, continuous monitoring and reporting for your custom apps.

Benefits

• Extended coverage: You can extend SSPM monitoring to custom SaaS apps.

• Centralized monitoring: Single pane of view for SSPM Supported SaaS apps and custom apps.

• Integrated reporting: You can benefit from a unified reporting and alerting.

Add a Custom App in SSPM

To add a custom app in SSPM, you need to first register your app with SSPM. Once registered, create an instance of your custom app in SSPM UI, send configuration data of the instance to SSPM. Create custom rules for continuous monitoring, and attach these rules to a policy. Once the policy is in place, SSPM starts generating findings for your custom app instance.

Considerations

Some steps to integrate your custom app in SSPM are API driven. To refer to the API documentation, navigate to your SSPM tenant >  Settings > Tools > REST API v2 > API DOCUMENTATION link. Look for “spm” to locate the SPM endpoints and identify those that include “customapps” in the API endpoint.

Procedure

Follow the in depth steps to add your custom app in Netskope SSPM:

• Step 1 : Register Your Custom Application – In this step, you will register your custom app metadata with SSPM. Using API, create a new custom app by providing an app name and, optionally, an app logo. If you do not provide an app logo, a default Netskope icon will be used.

  The app name should qualify the following conditions:

  • “EXT” prefix

  • Only use alphabets and numbers

  • No spaces allowed

  • Max 25 characters

  For example: EXTCustomApp

  Logo is not mandatory but if present:

  • Logo size should be less than 120×120 pixels

  • svg format

  API Endpoint: /api/v2/spm/customapps

• Step 2 : Onboard an Instance of your Custom App – Once you have registered your app in step 1, you will see the custom app in SSPM UI for onboarding.

  • Your app appears in your SSPM tenant > Configure App Access > Next Gen > Security Posture > Custom Apps list.

    

     

  • Setup security posture instance of the registered custom app by providing Instance Name and Administrator Email.

    

    This creates an instance of the custom app.

• Step 3: Define App Specific Configurations – SSPM supports a list of predefined attributes for users, roles, groups, and 3rd Party Apps.

  Users:

  Resource Type: Users

  Supported Attributes:

  • email_id [required]
  • name
  • user_type : values can be internal or external
  • user_status : values can be enabled or disabled
  • administrator : values can be yes or no
  • last_login_time
  • group_ids
  • role_ids
  • created_time
  • modified_time
  • additional_metadata

  Roles:

  Resource Type: Roles

  Supported Attributes:

  • id
  • name
  • description
  • permissions
  • created_time
  • modified_time

  Groups:

  Resource Type: Groups

  Supported Attributes:

  • id
  • name
  • description
  • role_ids
  • created_time
  • modified_time

  3rd Party Apps:

  Resource Type: Applications

  Supported Attributes:

  • application_id
  • name [required]
  • description
  • risk_score – If you do not provide a risk score, it will default to 0, which is interpreted as Low risk.
  • created_time
  • modified_time

  In addition to these, you can define custom configuration attributes. Account Settings is the resource type. To define these configurations, you should provide:

  • Name: name of attribute

  • Data type: data type accepted by this attribute. Supported data types are string, number, boolean, and string_list.

  • Description: describe the attribute

  Following are some examples of configuration attributes:

  • is_mfa_enabled (boolean)

  • tags (list of string)

  • external_user_permission (string)

  • public_link_sharing (string)

  API Endpoint: /api/v2/spm/contentdef/customapps/{app_name}/accountsettings

  You can currently monitor 30 max configuration attributes.

• Step 4 : Push Data for Your Custom App Instance – Using the API, you can start pushing the data for users, roles, groups, 3rd Party Apps attributes and custom configurations.

  API Endpoint:

  • /api/v2/spm/ingestor/customapps/{appname}/instances/{instancename}/users 

  • /api/v2/spm/ingestor/customapps/{appname}/instances/{instancename}/groups

  • /api/v2/spm/ingestor/customapps/{appname}/instances/{instancename}/roles 

  • /api/v2/spm/ingestor/customapps/{appname}/instances/{instancename}/thirdpartyapps

  • /api/v2/spm/ingestor/customapps/{appname}/instances/{instancename}/accountsettings

• Step 5 : Create Custom Rules and Policies – Now you can create custom rules using Netskope Governance Language (NGL) and then add these rules into a policy, enabling monitoring of your instance.
  

  Example Custom Rule:

  EXTCustomApp AccountSetting should-have external_sharing = “disabled”

After the integration of your custom app is completed in SSPM, you can take advantage of all the other features of SSPM. This includes a single pane of view for all monitored SaaS apps, Posture Score, Advanced Analytics Reports, Alerting, Monitoring, and more.

References

• Create custom rules using NGL

• Create Policies