Onboard OCI Infrastructure for DSPM

Overview

Netskope DSPM supports the ability to onboard, connect to, and scanning your Oracle Cloud Infrastructure (OCI) compartments. These capabilities require programmatic access to connect to and scan the Data Stores, including configuring specific OCI users or IAM roles.

Configure OCI Access

We recommend creating a dedicated OCI Domain, User, Group and Policy to connect your OCI environment to Netskope DSPM. 

Create OCI Domain (Optional)

You could choose to use an existing OCI domain when later creating the OCI User for providing read access to Netskope DSPM:

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Click on the Create domain button 
4. Provide the right name, description, type and administrator details 

Create OCI User

We recommend creating a dedicated service account user to provide Netskope DSPM with read only privileges required to perform Data Store Discovery.

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on the correct domain and navigate to the Users section
5. Click on Create User to create a dedicated service account user to connect to DSPM 
6. Copy the created user’s OCID (this will be required as an input in Netskope DSPM UI while onboarding the compartment)
7. Navigate to API keys section and Add API key for this user
8. Download the private and public key files (this will be required as an input in Netskope DSPM UI while onboarding the compartment)
9. Also copy the Fingerprint value (this will be required as an input in Netskope DSPM UI while onboarding the compartment)

Create OCI Group

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on the correct domain and navigate to the Group section
5. Click on Create group to create a dedicated group for assigning the read only policies required for data store discovery and classification
6. Add the above-created OCI User to the Netskope DSPM Group

Create OCI Policy

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Policies
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on Create Policy to create a dedicated policy to connect to Netskope DSPM 
5. Enter the Policy Name and description
6. Toggle the “Show manual editor” option and enter the below statements, substituting OCI GROUP with the above-created OCI Group and compartment with your OCI compartment
7. Click the Create button

Allow group '<Domain>'/'<DSPM_Group>' to inspect policies in compartment <Compartment_NAME>
Allow group '<Domain>'/'<DSPM_Group>' to inspect autonomous-databases in compartment <Compartment_NAME>
Allow group '<Domain>'/'<DSPM_Group>' to inspect pluggable-databases in compartment <Compartment_NAME>
Allow group '<Domain>'/'<DSPM_Group>' to inspect databases in compartment <Compartment_NAME>
Allow group '<Domain>'/'<DSPM_Group>' to inspect db-nodes in compartment <Compartment_NAME>
Allow group '<Domain>'/'<DSPM_Group>' to inspect vnic in compartment <Compartment_NAME>

Create a Netskope DSPM Infrastructure Connection

At this point, your configuration of OCI is complete, and Netskope DSPM can now be connected to your infrastructure.

1. Log into Netskope DSPM.
2. Navigate to Administration → Infrastructure Connections → OCI tab.
3. Click the Add Infrastructure button in the upper right. 
4. Click ADD COMPARTMENT.
5. On the Capabilities tab, set the following toggles depending on your discovery & classification needs: 

Toggle Description	Details
Auto-Discover New Compartments	Enables the auto-discovery and onboarding of newly-discovered child compartments, ensuring that your compartment list always remains accurate within DSPM
Auto-Discover New Data Stores	Enables the auto-discovery of newly-created data stores, to ensure that DSPM is always aware of all possible data stores

6. Click NEXT.
7. Enter the following values:

Field	Value
Compartment Name	Any value (this is used to identify your infrastructure connection within Netskope One DSPM).
Home Region	1. Obtain from your OCI console. 2. Click on the region name near the top right corner of the screen. 3. Then click in Manage regions and copy the Region Identifier for the home region and paste into Netskope One DSPM UI
Compartment OCID	You can onboard compartment at root or any intermediate level to include all child compartments within it. To retrieve the value required by Netskope One DSPM: 1. Log into the OCI Console 2. Navigate to Identity & Security section and select Identity 3. Select the correct OCI compartment that you want to onboard to DSPM 4. Copy the OCID value 5. Enter the copied value the Compartment OCID field within Netskope One DSPM
Tenant OCID	To retrieve the value required by Netskope One DSPM: 1. Log into the OCI Console 2. Click on the profile icon on the top right corner, then click Tenancy 3. Copy the Tenancy OCID value 4. Enter the copied value the Tenant OCID field within Netskope One DSPM

8. Click NEXT.
9. Review the already filled fields 
10. Enter the User OCID of the service account created in the Create OCI User section
11. Enter the Public Key Fingerprint that was copied while adding API Key to the OCI user
12. Upload the Private Key that was downloaded while adding API Key to the OCI user
13. Click SAVE.