Skip to main content

Netskope Help

User Risk Exchange Workflow

User Risk Exchange is designed to ingest one or multiple plugged-in vendors’ user or device risk scores and create a single view of individual contributors to the companies overall risk score and trend. Its rules-based engine matches single or multiple vendor scores or a derived weighted score to trigger notifications and drive highly focused orchestrated actions to reduce the risk from individual users or devices.

Click play to learn how to set up User Risk Exchange to drive a zero trust enforcement inside Netskope.

 
User Risk Exchange Global Settings

Only Admins can change Risk Exchange Global Settings. Go to Settings > User Risk Exchange. There are four tabs: General, Logs Cleanup, Plugin Weights, and Flap Suppression.

On the General tab, you can enable generating alerts that are shared with the Ticket Orchestrator module. You can also specify how long to keep the score history. The default is 30 days. Select the maintenance window time interval, and during this time, interval Risk Exchange actions (which are configured to be performed in the maintenance window) will be performed.

RE-General.png

On the Logs Cleanup tab, you can specify how often to delete logs.

RE-Log-Cleanup.png

On the Plugin Weights tab, aggregate scores are calculated based on the weights assigned to each plugin configuration and their respective contributions. You can set the ranges for scores as per requirement and preview results. User Scores are generated based on on the specified ranges.

RE-Plugin-Weights.png

On the Flap Suppression tab, set the Flap Suppression time to prevent actions being triggered multiple times on the same user in a short duration time until the score does not change.

RE-Flap-Suppression.png