Skip to main content

Netskope Help

ServiceNow Plugin for Threat Exchange

This document explains how to configure the ServiceNow Threat Intelligence Plugin integration with the Cloud Threat Exchange module of the Netskope Cloud Exchange platform. This integration allows for sharing of URLs and file hashes with Netskope that has been identified by ServiceNow.

Prerequisites

  • A Netskope Tenant (or multiple, for example, production and development/test instances).

  • A Secure Web Gateway subscription for URL sharing.

  • A Threat prevention subscription for malicious file hash sharing.

  • A Netskope Cloud Exchange tenant with the Threat Exchange module already configured.

  • A ServiceNow instance with admin access

Workflow

  1. Create a custom File Profile.

  2. Create a Malware Detection Profile.

  3. Create a Real-time Protection Policy.

  4. Create a Service Now user.

  5. Configure a ServiceNow Plugin.

  6. Configure sharing between Netskope and ServiceNow.

  7. Validate the ServiceNow Plugin.

Create a Secure Web Gateway Custom File Profile

  1. In the Netskope UI, go to Policies , select File , and click New File Profile.

    image3.jpeg

  2. Click File Hash in the left panel, select SHA256 from the File Hash dropdown list.

    image4.jpeg

  3. Enter a temporary value in the text field. Netskope does not support progressing without having a value in this field, and recommends entering a string of 64 characters that consists of the character f. For example, ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff. This will have a very low possibility of matching a valid file format.

    image5.jpeg

  4. Click Next.

  5. Enter a Profile Name and a Description. We recommend not having blank spaces in your profile name; use underscores for spaces.

    image4.png

  6. Click Save.

  7. To publish this profile into the tenant, click Apply Changes in the top right.

In this section: