Export DSPM Logs to Amazon S3

Overview

Netskope Data Security Posture Management (DSPM), also known as Netskope One DSPM, generates activity logs that capture events such as scan executions, findings, configuration changes, and sidecar activity. You can export these logs to an Amazon Simple Storage Service (Amazon S3) bucket for long-term retention, analytics, or integration with downstream systems.

You can see downloadable logs of all activity within Netskope DSPM by navigating to Administration > Activity Logs. These are divided between User Activity and System Activity tabs, and can be sorted and filtered by activity type.

This guide explains how to configure your Netskope DSPM tenant to automatically publish these Activity Logs to Amazon S3 as .json objects, and how to validate that log delivery is working as expected.

Prerequisites:

Before you start, ensure you have the following.

• Netskope DSPM tenant: Administrator access to your Netskope DSPM tenant.
• AWS account: An AWS account with permissions to create and manage:
  • Amazon S3 buckets.
  • IAM roles and policies.
  • (Optional) KMS keys, if you use server-side encryption with AWS KMS.
• Target S3 bucket: An S3 bucket that will receive the DSPM logs. You can use an existing bucket or create a dedicated one for this purpose.

Plan Your S3 Log Export

Before configuring the export in Netskope DSPM, determine the following settings:

• Bucket name and region: The exact S3 bucket name and AWS Region where you will store DSPM logs.
• Folder/prefix structure: An optional prefix to organize logs, for example: s3://<bucket-name>/dspm/logs/
• Encryption requirements: Decide if logs must be encrypted with S3-managed encryption keys (SSE-S3) or customer-managed keys using AWS KMS (SSE-KMS).
• IAM trust and permissions model: Netskope DSPM will write logs to S3 using an IAM role. This role requires a trust policy (allowing Netskope’s logging service to assume it) and an IAM policy granting write access (s3:PutObject, s3:ListBucket) to your target bucket.

Create or Select an S3 Bucket

If you do not already have a bucket for DSPM logs:

1. Sign in to the AWS Management Console and open the Amazon S3 console.
2. Click Create bucket.
3. Specify the Bucket name (a globally unique name, such as mycompany-dspm-logs) and the AWS Region.
4. Configure options such as Bucket versioning (recommended for audit use cases) and Default encryption (SSE-S3 or SSE-KMS).
5. Adjust the Block Public Access settings to ensure the bucket remains private.
6. Click Create bucket.

If you are using an existing bucket, review its configuration to ensure it complies with your organization’s security and retention requirements.

Configure IAM Role and Policy for DSPM Logs

Create an IAM role that Netskope DSPM can use to write logs to your S3 bucket.

1. In the AWS Management Console, open the IAM service.
2. Click Roles and then Create role.
3. For Trusted entity type, configure the trust policy according to the guidance provided in the DSPM UI (typically, allowing a Netskope-managed principal to assume the role).
4. Attach an IAM policy that grants the role permission to write logs to the appropriate bucket and prefix. For example:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::<bucket-name>/<optional-prefix>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::<bucket-name>"
    }
  ]
}

5. Complete the role creation and copy the Role ARN, which you will need to enter in the Netskope DSPM UI.(Replace <bucket-name> and <optional-prefix> with values for your environment).

Configure DSPM to Export Logs to Amazon S3

After the S3 bucket and IAM role are ready, configure DSPM to publish logs.

1. Log in to your Netskope DSPM tenant.
2. Navigate to Administration > Activity Logs.
3. Follow the UI prompts to configure Amazon S3 as the log destination. Provide the following required fields:

Field	Required?	Value
cloud_account_id	Yes	Internal ID corresponding to your AWS Infrastructure Connection.
bucket_name	Yes	Name of the target bucket (assumption = this must already exist)
bucket_region	Yes	Region where bucket resides
file_prefix	No	Optional sub-folder to store destination files (only necessary if the S3 bucket is being shared with other business processes & you want to keep Netskope DSPM data segregated)

4. If the configuration screen supports it, run a Test connection to verify that DSPM can successfully write to the specified bucket.
5. Click Save.

Validate Log Delivery to S3

After the configuration is saved, confirm that DSPM logs are being published to S3 correctly:

1. In the AWS console, go to Amazon S3.
2. Open the bucket configured as the DSPM log destination.
3. Navigate to the configured prefix or folder.
4. Confirm that new .json objects are being created. Depending on your settings, logs may appear organized by time, region, or log type.
5. (Optional) Download a log file and verify that it contains the expected events (resource, action type, timestamp, user ID, description).

Troubleshooting: If logs do not appear after a reasonable period:

• Recheck the IAM role’s trust policy and permissions.
• Confirm that the bucket name, region, and prefix in DSPM exactly match the S3 bucket.
• Review any error messages in the DSPM UI related to log export.

Secure and Manage DSPM Logs in S3

To ensure ongoing security and compliance for your exported logs:

• Encryption: Ensure logs are encrypted at rest using SSE-S3 or SSE-KMS, based on your security policy.
• Access Control: Use strict S3 bucket policies and IAM to limit access to only the roles and users who require it.
• Lifecycle Policies: Configure S3 Lifecycle rules to transition older logs to lower-cost storage classes (such as S3 Glacier) or to expire them after a defined retention period.
• Monitoring and Auditing: Use AWS CloudTrail and AWS CloudWatch to monitor access to the bucket and detect anomalies.

Log Examples

All system and user activities are stored as separate .json objects with standard formatting. The timestamp on each record matches the time the activity was recorded in Netskope DSPM.

System Activity

{
   "timestamp": "02-15-2023 04:33:13",
   "type": "scan",
   "description": "Netskope One DSPM completed a scan of data store: 'fp-redshift'\n\nStart time: 2023-02-15 18:48:02.0\nEnd time: 2023-02-15 18:48:45.309\n\nNew queries scanned: 0\nExfiltration alerts generated: 0\nPrivacy alerts generated: 0\nData modification alerts generated: 0\nColumn classification alerts generated: 0\n\n# of new fields detected: 0\n# of new fields classified as sensitive: 0\n# of new fields classified as not sensitive: 0\n"
}

User Activity

{
   "timestamp": "02-15-2023 04:33:13",
   "type": "create",
   "username": "demo@netskope.com",
   "resource": "User Identity",
   "description": "User configured a new employee directory service with name Netskope One DSPM Directory"
}