The integration between Netskope CE CREV2 and CrowdStrike CNAPP (Cloud-Native Application Protection Platform) combines Netskope's ZTNA with CrowdStrike’s cloud workload protection capabilities to provide a seamless solution for securing cloud environments, particularly by enabling workload quarantine. Using this integration we can quarantine all the risky workloads via the Netskope CREv2

The workload quarantine feature ensures that in the event of a security incident or detection of a compromised workload by CrowdStrike CNAPP, the affected instance or service is quickly isolated from Netskope Tenant for the users, limiting the spread of threats across the cloud environment. This capability helps in rapid incident containment and response.

Requirements

• Cloud Exchange-5.1.0
  • Netskope Risk Exchange Plugin
  • CrowdStrike Cloud Protection Plugin
• CrowdStrike CNAPP 
• Netskope Tenant

Implementation

Configure the Netskope Risk Exchange Plugin

Configure the Entity Sources for the Netskope Risk Exchange plugin and click on save.

Configure the CrowdStrike Cloud Protection plugin

Create the API Client in CrowdStrike

Configure parameters

Configure Entity and click on save

After both the plugin configuration you can find the Indicator of misconfiguration in CrowdStrike Cloud Security.

All the fields in the Entity can be found under the Schema Editor. You can create new Entity with different fields or use the existing one.

After all the configuration you will start seeing the records for different workloads being fetch with the risk associated with the workloads

Create the business rule for any High or Medium workload.

Currently the malicious workload is can be access as we haven’t taken the action or configure the action configuration

Create action configuration for the workload quarantine. Additionally the Malicious Workload App I have already created in Netskope

Before executing the action configuration. Let’s create the Private App policy in Netskope.

Malicious Workload Private App before the Action configuration execution.

After the Action execution

Netskope client has started taking action on the Private App

Security and business outcomes

Automate the process of quarantining  Malicious Workload. As soon as workloads are detected to be malicious by the CrowdStrike CNAPP, CloudExchange CREV2 can take the action of moving those workloads in the some different category or assigning with the tags which can help in taking the action of Blocking those app via the Netskope policy.