Risk Exchange Module - Netskope Technical Documentation

The Risk Exchange module replaces the original User Risk Exchange and Application Risk Exchange workflows. This new module is designed to ingest risk scores from one or multiple plugged-in vendors related to users, devices, and applications. It creates a single, unified view of individual contributors to the company’s overall risk score. Its rules-based engine matches single or multiple vendor scores, or a derived weighted score, to trigger notifications and drive highly-focused orchestrated actions to reduce the risk from individual users, devices, or applications. Risk Exchange entities can also be joined with each other and with Threat Exchange indicators in the Universal Schema Builder, where business rules act on the combined records.

To enable the Risk Exchange module, you must first disable Exact Data Match or Custom File Classification (if active) by navigating to Settings > General. The CLS, CTO, CTE and CRE modules are not supported simultaneously with Exact Data Match or Custom File Classification.

Click play to learn how to set up Risk Exchange to drive zero trust enforcement inside Netskope.

Risk Exchange Global Settings

Only write-access users can change Risk Exchange Global Settings. After the Risk Exchange module is enabled (Settings > General), go to Settings > Risk Exchange. There are four tabs: General, Logs Cleanup, Flap Suppression, and Records Cleanup.

Go to Settings > Risk Exchange and, on the General tab, enable Generate Alert to send an alert to the Ticket Orchestrator module when a Risk Exchange action is performed. This setting applies to all actions:

- Enabled: Each action generates alerts based on its own Generate Alert toggle. New actions have the toggle enabled by default.

- Disabled: No action generates alerts, even if its own Generate Alert toggle is enabled. The toggle on each action is unavailable until you enable this setting again.

Alerts are generated only when the Ticket Orchestrator module is enabled in Settings > General. For details about the action toggle, refer to Map a Risk Exchange Business Rule to an Action.

Upgrading to Cloud Exchange v7.0.0 enables Generate Alert in Settings > Risk Exchange, even if it was disabled before the upgrade. In earlier versions, this setting did not stop alerts, so your actions continue to generate alerts as before. If you do not want alerts from Risk Exchange actions, disable this setting after the upgrade.

Select the maintenance window time interval and days, and during this time interval, Risk Exchange actions (that are configured to be performed in the maintenance window) will be performed.

On the Logs Cleanup tab, you can specify how often to delete logs.

On the Flap Suppression tab, you can prevent an action from being triggered multiple times in a short duration.

On the Records Cleanup tab, set the option to enable/disable data purging, and then set a time duration for the records to remain inactive. After that, the duration records will be deleted from Cloud Exchange as specified. Purged records are also removed from any unified mapping that joins the entity, because a unified mapping is rebuilt from the current records each time it runs.

The Universal Schema Builder is part of Risk Exchange. While the Risk Exchange module is disabled, its pages are unavailable and existing unified mapping business rules are disabled and cannot be modified or run.

To learn how to trigger a Ticket Orchestrator alert using Risk actions, watch this video.