SSE in Device Intelligence

SSE in Device Intelligence

You can now configure SSE Integration in Device Intelligence and share device detail data from Device Intelligence to SSE. This feature allows you to use device details captured by Device Intelligence in SSE. 

Netskope Security Service Edge (SSE) is a data-centric, cloud-native, and fast security solution. This feature enables you to create granular level policies with device context and device risk in Netskope SSE. The integration ensures that Device Intelligence integrates with SSE as a platform so the policy enforcement will be a common point of enforcement facilitated. 

To do so, you need to follow a few steps:

1. Configure SSE in Device Intelligence
2. SSE use cases
3. SSE UI

Configure SSE in Device Intelligence

Follow the procedure to configure SSE in Device intelligence UI:

1. Navigate to the Manage > Configurations menu.

2. Give a unique name to the integration configuration.

3. Add a description.

4. Choose the type of supported remediation integration configurations as Firewall.

5. Choose a supported vendor from the dropdown list as SSE.

6. Provide a valid host IP address or a domain name to connect to the network.

7. Choose an authentication type:

   • Username/password – provide the credentials for configuration.

   • Token – provide a token for configuration.

8. Choose a connection method as HTTPS.

9. Optionally, you can add extra key-value pair parameters to pass to this configuration.

10. Click Create Configuration button

Once you configure SSE in Device Intelligence, you can use this as an action for your policies in the next step.

SSE Use Case

Follow the procedure to create the policy:

1. Navigate to the Policies menu and click on the Create Policy tab.

2. Mark the status of the policy to be active on creation.

3. Give a unique policy name.

4. Select the type as context policy.

5. Give a category of the policy as Computers.

6. Add a description to explain the policy behavior.

7. Define a custom condition to capture managed and unmanaged devices.

8. Click on Add Rule and select field as Managed, condition as Equals, value as True. Add one more condition with OR conjunction and select field as Managed, condition as Equals, value as False. This condition will capture managed and unmanaged devices.

   

9. Select the alert severity as High.

10. Select the action to take as NAC.

11. Select the SSE configured in Step 1.

12. Select action as Segment and give a Segment Name as “SSE unsegment”.

13. Click Save Policy.

You will simultaneously see the policy results in SSE UI when this policy will capture devices with a high-risk score.

SSE UI

Login to the SSE UI using your credentials and you will see the Device Intelligence information in the Network Location tab > Segment Name section.