07-12-2021 05:10 PM - edited 08-18-2022 12:55 PM
The intention of this document is to level set on the base set of policies, policy grouping, and policy evaluation behavior that is generally applicable to all inline(CASB/NS-SWG) customers.
We are also working on runbooks to accompany each of the policy groups highlighted in the presentation, which will be posted in the near future.
07-15-2021 10:02 AM
This is an incredibly valuable document. It would be fantastic if the tenant could be autoconfigured as a baseline. Short of implementing a feature, is that what a runbook would do (i.e. import a policy config)?
07-26-2021 10:05 AM - edited 07-26-2021 10:06 AM
At this point, we don't have the Rest API end-point to automate this so this is the intention of the runbooks.
08-12-2021 11:12 AM
Justin, this is by far the best approach I have ever seen to ensure interoperability between real time policy types. We have adopted this approach with our clients at Optiv and it has been a huge success. Thank you so much for taking the time to put this together and communicating it out there to the Netskope community.
08-24-2021 12:00 PM
Any chance there is a supporting video recording? This guide is great and was curious if there was any additional commentary while going through slides (mostly for education)
08-24-2021 12:39 PM
Hi @ddrake , this session is best done in person with your TSM/TAM please reach out to your assigned TSM pool and they can assist with this session.
03-15-2022 06:23 AM
Justin, this doc is great. I'm wondering if you can elaborate on the sanctioned instance tagging. In your doc you state "you have to tag the instance before you can set an
instance id policy. instance_id !~ 'NULL'" which is how Ive been identifying my sanctioned apps in the data but how do you tag using that query so it can be used in a real-time policy?
03-15-2022 12:50 PM
Thanks for the question 🙂 It seems that the query needs to be modified post-R90 MP, you can leverage this skopeit query, [instance_id != '' ], under application events to pull up all of the events with an instance id. Then you can review the list to tag the instances that don't have an existing Instance Name associated with the detected instance_id.
Please let me know if this helps.
In order to view this content, you will need to sign in to your account. Simply click the "Sign In" button belowSign In