Only admins and write-access users can configure 3rd-party Threat Exchange plugins. Threat Exchange comes with a library of supported plugins. Plugins can be easily configured to collect and share indicators related to file hashes of malicious software (malware) used in a Netskope DLP policy by following the plugin guide. Refer to the Threat Exchange Custom Plugin Developers Guide to understand how to build and upload a custom plugin.
You can also disable, enable, or delete existing plugin configurations. Threat Exchange can be configured with multiple plugins to the same system for different workflows from either the same Netskope tenant or multiple Netskope tenants.
Threat Exchange ONLY pulls the following IoC’s when they are available:
- Malicious file file hashes in MD5 or SHA256 format.
- URL: Depending on the nature of the plugin, these could be malicious URL, restricted URL, or allowed URL. The latter two would be for firewall, SWG, or CASB policy synchronization. Fetching malicious Hostnames, Domains and FQDNs are also supported.
- IP addresses (CIDR): Depending on the nature of the plugin, these could be malicious IP (IPv4/IPv6), restricted IP, or allowed IP. The latter two would be for firewall, SWG, or CASB policy synchronization.
- Abnormal Security Plugin for Threat Exchange
- Anomali ThreatStream XDR Plugin for Threat Exchange
- API Source Plugin for Threat Exchange
- AWS GuardDuty Plugin for Threat Exchange
- Carbon Black Plugin for Threat Exchange
- Commvault Plugin for Threat Exchange
- CrowdStrike Plugin for Threat Exchange
- Cybereason Plugin for Threat Exchange
- Darktrace Plugin for Threat Exchange
- Digital Shadow Plugin for Threat Exchange
- ExtraHop Reveal(x) 360 Plugin for Threat Exchange
- Feedly Plugin for Threat Exchange
- GitHub Plugin for Threat Exchange
- HarfangLab Plugin for Threat Exchange
- Illumio Plugin for Threat Exchange
- Imperva Plugin for Threat Exchange
- Infoblox Plugin for Threat Exchange
- Maltiverse Plugin for Threat Exchange
- Mandiant Plugin for Threat Exchange
- Microsoft Defender for Cloud Apps Plugin for Threat Exchange
- Microsoft Defender for Endpoint Plugin for Threat Exchange
- Microsoft Office 365 Endpoints Plugin for Threat Exchange
- Mimecast Plugin for Threat Exchange
- MISP Plugin for Threat Exchange
- OpenCTI Plugin for Threat Exchange
- Palo Alto Networks Cortex XDR Plugin for Threat Exchange
- Palo Alto Networks Panorama Plugin for Threat Exchange
- Proofpoint Plugin for Threat Exchange
- Rubrik Plugin for Threat Exchange
- SecLytics Plugin for Threat Exchange
- Secureworks Taegis Plugin for Threat Exchange
- SecurityScorecard Plugin for Threat Exchange
- SentinelOne Plugin for Threat Exchange
- ServiceNow Plugin for Threat Exchange
- Skyhigh Plugin for Threat Exchange
- STIX/TAXII Plugin for Threat Exchange
- Sophos Plugin for Threat Exchange
- Tanium Plugin for Threat Exchange
- ThreatConnect Plugin for Threat Exchange
- ThreatQ Plugin for Threat Exchange
- Trellix Plugin for Threat Exchange
- Trend Vision One Plugin for Threat Exchange
- Vectra AI Plugin for Threat Exchange
- VMRay Plugin for Threat Exchange
- Web Page IoC Scraper Plugin for Threat Exchange