Major New Features
Distributed File System (DFS) Support for SMB
The SMB connector now supports DFS (Distributed File System) namespace paths. Previously, you had to connect each physical share with a direct share path. Now, you can connect the DFS namespace and DSPM scans the shares behind it.
With this release, data security administrators can:
- Enter a UNC path to a DFS namespace (for example,
\\domain\namespace) as the SMB data store endpoint. The Mount Point field is now optional for UNC/DFS endpoints. - Scan DFS namespaces. The connector follows DFS referrals, enumerates DFS links, scans each target share, and shows the results under the DFS namespace as one data store.
- Select a subset of shares in a DFS namespace to onboard. Only the selected shares are scanned.
- Create more than one data store from the same DFS endpoint, for example to split shares by location.
Individual file shares outside a DFS namespace continue to onboard as before.
Improvements and Updates
Privilege Analysis for NetApp ONTAP
Privilege Analysis now supports on-premises NetApp ONTAP and Amazon FSx for NetApp ONTAP data stores. DSPM collects file and folder permissions (ACLs) on these data stores, resolves users and groups through LDAP, and uses per-file permissions in risk analysis. NetApp data stores now have the same privilege analysis as SMB data stores.
Windows Backup Privilege (SeBackupPrivilege) Support for SMB
The SMB connector now supports the Windows backup privilege (SeBackupPrivilege). Previously, scans required explicit read permissions through the file ACL and updated file access timestamps. Now, DSPM can use the backup privilege to scan heavily restricted files without altering their metadata.
With this release, data security administrators can:
- Achieve complete scan coverage across file shares. DSPM uses the backup privilege to read and scan files even when their subfolder permissions deviate from the top-level structure.
- Maintain accurate file metadata. DSPM scans no longer change the
LastAccessTimeof the files they read, ensuring stale-data analysis remains accurate after a scan.
To scan SMB and NetApp files that the service account cannot read through the file ACL, grant SeBackupPrivilege to the DSPM service account (for example, through the Backup Operators group).
Granular Service-Level Discovery Disabling
Previously, you could turn off data store discovery only for a whole account or organization. Now, you can turn off discovery for individual services across all cloud service providers (CSPs). AWS also supports turning off discovery for individual regions. Other CSPs support only service-level discovery disabling.
For example, skip RDS in an account where policy does not allow it, or skip Athena across an organization. If both services and accounts are configured, the account-level settings take priority.
To enable this feature, please contact your account representative or Netskope support.