Threat Exchange Module - Netskope Technical Documentation

Threat Exchange is a rules-based engine for collecting and sharing indicators related to file hashes of malicious software (malware), file hashes of files used in Netskope DLP policy for absolute matching, or URLs used by plugged in systems for policy enforcement of restricted or allowed access. Indicators can be collected by a source plugin, or generated from Risk Exchange entity records and from unified mappings created in the Universal Schema Builder.

To enable the Threat Exchange module, you must first disable Exact Data Match or Custom File Classification (if active) by navigating to Settings > General. The CLS, CTO, CTE and CRE modules are not supported simultaneously with Exact Data Match or Custom File Classification.

Click play to learn how to set up Threat Exchange.

Threat Exchange Global Settings

Only write-access users can change Threat Exchange Global Settings. Go to Settings > Threat Exchange. If the same IoC value is reported from different sources, then based on the reconciliation criteria, Threat Exchange will decide which IoC metadata should be kept and which will be ignored.

Reconciliation Criterias

Possible Reconciliation Criterias include:

Always Overrides: If this criteria is selected, the latest IoC metadata will be kept in case of IoC Duplication.
Never Overrides: If this criteria is selected, the oldest IoC metadata will be kept in case of IoC Duplication.
Highest Severity Source Override: If this criteria is selected, the highest severity source’s IoC metadata will be kept in case of IoC Duplication.

Reconciliation criteria apply to IoCs contributed by source plugins. IoCs generated from Risk Exchange entity records or from a unified mapping are attributed to the rule that produced them, and each rule keeps its own contribution, so there is nothing to reconcile between them. Their severity, reputation, comments, and tags are set when the IoC is first created and are not overwritten afterwards.

Click play to watch a video.

IoC(s) Retraction

To enable IoC retraction from Cloud Exchange:

Go to Setting > Threat Exchange.
Enable the IoC(s) Retraction toggle and enter the Retraction Interval.
Click Save.

Retraction applies only to IoCs contributed by a source plugin. IoCs generated from Risk Exchange entity records or from a unified mapping are not retracted, regardless of this setting. If the same IoC value is also contributed by a source plugin, that plugin’s contribution is still eligible for retraction.

Generate Alert

Go to Settings > Threat Exchange and enable Generate Alert to send alerts to the Ticket Orchestrator module when IoCs are shared. This setting applies to all sharing configurations:

Enabled: Each sharing configuration generates alerts based on its own Generate Alert toggle. New sharing configurations have the toggle enabled by default.
Disabled: No sharing configuration generates alerts, even if its own Generate Alert toggle is enabled. You cannot change the toggle on a sharing configuration until you enable this setting again.

Alerts are generated only when the Ticket Orchestrator module is enabled in Settings > General. For details about the sharing configuration toggle, refer to Configure Threat Exchange IoC Sharing.

Reconciliation Criterias

Possible Reconciliation Criterias include:

Always Overrides: If this criteria is selected, the latest IoC metadata will be kept in case of IoC Duplication.
Never Overrides: If this criteria is selected, the oldest IoC metadata will be kept in case of IoC Duplication.
Highest Severity Source Override: If this criteria is selected, the highest severity source’s IoC metadata will be kept in case of IoC Duplication.

Click play to watch a video.

IoC(s) Retraction

To enable IoC retraction from Cloud Exchange:

Go to Setting > Threat Exchange.

Enable the IoC(s) Retraction toggle and enter the Retraction Interval.

Click Save.

Generate Alert

Go to Settings > Threat Exchange and enable Generate Alert to send alerts to the Ticket Orchestrator module when IoCs are shared. This setting applies to all sharing configurations:

Enabled: Each sharing configuration generates alerts based on its own Generate Alert toggle. New sharing configurations have the toggle enabled by default.

Disabled: No sharing configuration generates alerts, even if its own Generate Alert toggle is enabled. You cannot change the toggle on a sharing configuration until you enable this setting again.

Alerts are generated only when the Ticket Orchestrator module is enabled in Settings > General. For details about the sharing configuration toggle, refer to Configure Threat Exchange IoC Sharing.