Skip to main content
  • EN

Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

  • 55 Topics
  • 37 Replies
55 Topics
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope
Threat Exchange Best Practices

The Netskope Threat Exchange module within Cloud Exchange is our open source solution to IoC sharing between security tools. Once configured, Threat Exchange can store and share thousands of IoC’s from tools such as Netskope, CrowdStrike, Microsoft Defender, ThreatConnect and many others, alongside the capability of adding IoC’s via Cloud Exchange’s API. The large amount of data pulled can be overwhelming, so we wanted to share some best practices for Threat Exchange that you can follow and use within your own environment. Refine Your Business Rules. Your business rules are one of the most important aspects of your Threat Exchange instance since they are used for your sharing configurations. Unless you want everything being shared over to your set of configured tools, you will need to refine your business rules to the specific items you want to send. You can leverage fields found within the IoC’s you pull. For example, some plugins will allow you to pull severity information from t

1020
jramirez
Netskope Employee
1 year ago
mharsh
Netskope Employee
mharshNetskope Employee
posted in Inside Netskope
PostgreSQL vulnerabilities and their preventions

PostgreSQL is the world’s most advanced enterprise-class open source database management system that is developed by the PostgreSQL Global Development Group. It is a powerful and highly-extensible object-relational SQL (Structured Query Language) database system popular for its reliability, feature robustness, and high performance. It is known to be highly scalable, both in the amount of data it can store and manage and in the number of concurrent users it can accommodate.   How does it work? PostgreSQL uses a client-server model where the client and the server can reside on different hosts in a networked environment. The server program manages the database files, accepts connections to the database from client applications. It can handle multiple concurrent connections from clients by “forking” a new process for each connection. It executes database requests from clients and sends the results back to the clients. Remote clients can connect over the network or internet to the serv

5290
mharsh
Netskope Employee
1 year ago
jramirez
Netskope Employee
jramirezNetskope Employee
posted in Inside Netskope
Netskope Alerts via Slack Messages

Netskope Alerts via Slack Messages Prerequisites: Slack channel with a webhook.https://slack.com/help/articles/115005265063-Incoming-webhooks-for-Slack Cloud Exchange version 3.2 and above. Netskope Tenant added to Cloud Exchange. Procedure: Step 1. Netskope ITSM (CTO) Plugin Setup (skip to step 2 if already setup): Login to Cloud Exchange as a user with admin privileges. Navigate to Settings > Plugins.     Click on the Netskope ITSM (CTO) plugin.   Name the configuration and set the tenant field to the Netskope tenant you want to receive alerts from. Click Next.   Navigate to Ticket Orchestrator and click on Alerts. Make sure the section is being populated with alert data from the configured tenant.   Step 2. Notifier Plugin for Slack Webhook (CTO) Setup: Navigate to Settings > Plugins.     Click on the Notifier (CTO) plugin.   Name the configuration and set the sync interval. The default of 60 minutes is recommended, but for

2420
jramirez
Netskope Employee
1 year ago
ukrishna
Netskope Employee
ukrishnaNetskope Employee
posted in Inside Netskope
Effective Allowlisting with Netskope DLP

Are you facing excessive Netskope DLP alerts which are false positives? The Netskope DLP solution provides a wide range of capabilities for detecting data theft and data mishandling. While setting up these policies, one of the common difficulties a security team faces is applying proper allowlisting mechanisms to reduce the amount of false positives. Luckily, the Netskope DLP solution has native effective ways that help allowlist certain applications, instances, users, and activities. Here are a some of those approaches to consider:   Exclude certain external domains from within API data protection policy: This option helps analysts to exclude permitted vendors and partners from a particular API protection DLP policy. For example, an organization may be allowed to share sensitive financial information with its financial consulting firm. So the PCI DLP policy could exclude that particular domain/site for the “External Share” policy. The list of applications supporting this feature

4440
ukrishna
Netskope Employee
1 year ago
A
Netskope Employee
AFunkhouserNetskope Employee
posted in Inside Netskope
The Threat Hunt Process

Requirements  Transaction Streaming SKU    What is Threat Hunting?  Threat hunting is the process of using the scientific method to proactively and iteratively search through an organization's environment to identify threats that have evaded detection. One of the goals of threat hunting is to enrich and automate detection that is unique to an organization's environment. Additionally your team builds knowledge of your organization's environment, understanding the gaps and further enriching your security solutions. This document is to help you understand the basic process of threat hunting using data logged with Netskope. We have included an example of a threat hunt.    The Hunting Loop    Figure 1: The Hunting Loop   Hypothesis  A threat hunt starts with a hypothesis that should be realistic for your environment. We recommend reviewing research articles on the threats you want to hunt to assist with hypothesis generation and avoid hunti

2710
A
Netskope Employee
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings