Create a Forensic Profile

After you have configured the IaaS/SaaS app for which you want to use forensics, next you need to create a forensic profile.

To create a forensic profile:

1. In the Netskope tenant UI, go to Policies > Profiles > Forensic.

2. Click New Forensic Profile.

3. In Profile Name, enter the name of the forensic profile.

4. Under App and Instance, select the appropriate SaaS/IaaS app followed by the corresponding instance name.

   – A few storage apps have two options to choose from. The storage apps with ‘Next Gen Forensics’ next to the storage app name are supported on the Next Gen platform and enable forensic-only instances when creating a new forensic profile. To learn more: Create a Forensic Profile in Next Gen Forensics.
   – On selecting an app, additional fields may get enabled. Enter the appropriate details for the additional fields. For most of the apps, you need to enter the email address of the user. The forensic folder will be created under the email address of this user.
   – For Egnyte, you can either select a Personal Folder or Team Folder. For more information, see Forensic Folder Support for Egnyte.
   – For SharePoint, select a site where you would like to store the forensic data.
   – For Microsoft Azure, you should enter the exact name of the Azure storage account and container where the forensic data will be stored. To get these details, log in to your Azure portal.

5. Click Save and Apply Changes.

To enable the forensic profile, see Enable a Forensic Profile.

Forensic Folder Support for Egnyte

A forensic profile can either be created on team folders or personal folders. If the team folder is selected, a forensic folder is created under Shared folder(/Shared/Netskope Forensic Folder). If a personal folder is selected, a forensic folder is created under users’ private folder(/Private/User/Netskope Forensic Folder). In the User Email field, enter the email address of the owner of the forensic folder. The email address should be of either the Egnyte administrator or power user. Standard user email address is not supported. If a DLP policy is triggered, based on the forensic folder selected, a summary of file content is uploaded into forensic folder.