Introduction
This guide is designed to help customers & partners quickly integrate their systems with Netskope One DSPM, to either retrieve Netskope One DSPM insights and/or incorporate their own system’s details into the Netskope One DSPM application.
Benefits of Integrating with Netskope One DSPM
Netskope One DSPM is a data security posture management (DSPM) platform that automates data security and governance controls, on-prem and in your cloud, to protect your data throughout its entire journey. We provide visibility, control, and remediation for structured, semi-structured, and unstructured data across cloud and on-prem databases, data lakes, and data warehouses. With Netskope One DSPM, you get robust Data Security Posture Management (DSPM), Data Access Governance (DAG), Data Detection and Response (DDR), enhancing compliance and audit readiness.
Problems that Netskope One DSPM can help you solve:
- Little to no visibility into data sprawl, increasing the likelihood of data breaches. Netskope One DSPM continuously discovers data stores for complete visibility across cloud, on-prem, and hybrid environments, helping improve data security posture across the organization.
- Manual data classification and tagging are time-consuming and error-prone. Netskope One DSPM continuously classifies sensitive data, then programmatically assigns sensitivity levels and business purpose tags and maps them to known regulations.
- Sensitive data exposure due to misconfigurations. Netskope One DSPM performs configuration analysis to identify data stores with issues and prevent data exposure.
- Challenges in implementing least-privilege access for hundreds of users. Netskope One DSPM performs privilege analysis to detect excess privilege to sensitive data automatically.
- Inability to detect risky and privacy-violating data interactions. Netskope One DSPM profiles user behavior based on query analysis to help mitigate risky data interactions at scale and ensure regulatory compliance.
- Overwhelming management of many complex data security issues. Netskope One DSPM’s risk scores and advanced policy engine provide workflows to help prioritize and automate remediation.
Glossary of Netskope One DSPM Terms
| Term | Definition |
|---|---|
Infrastructure Connection |
Connection between Netskope One DSPM and a major cloud service provider, such as AWS, GCP, or Azure. This can be either individual accounts (projects / subscriptions) or organizations (tenants) |
| Data Store | Connection to an individual data source, either structured or unstructured. These are typically connected after an auto-discovery process that runs on your Infrastructure Connections. |
| Data Tags | xxxxx |
| Platform User | xxxxx |
| Authentication Token | xxxxx |
Understanding Netskope One DSPM’s Open API
All available Netskope One DSPM API routes are described within master Swagger UI documentation, which can be accessed on your Netskope console by navigating to All available Netskope One DSPM API routes are described within master Swagger UI documentation, which can be accessed on your Netskope console by navigating to Settings > Tools > REST API v2.
After authentication, the base path for all API resources is:
https://<TENANTURL>.goskope.com/api/v2/dspm/The following diagram illustrates the relationship between data stores and related data (accounts, tags, etc.). Each table is labeled with its corresponding API resource route:
Rest API Tokens
Netskope REST API tokens are used by external applications for authenticating into Netskope One DSPM’s Open API. The token informs the API that the bearer of the token has been authorized to access the API and perform authorized actions.
To create a token, please visit the main Rest API v2 Overview article. Once generated, have your stakeholder share with you the token value for use below using your preferred method.
Because tokens are associated to Netskope Administrators, it is recommended that your stakeholder create them using a dedicated user and with limited scope.
Authentication
To use the Netskope One DSPM API, you must first authenticate to it with an authentication token. Such tokens inform the API that the bearer of the token has been authorized to access the API and perform authorized actions.
Include the token in your request header as apikey. For example:
curl -X 'GET' \
'https://example.goskope.com/api/v2/dspm/data_stores/discovered?offset=0&limit=20' \
-H 'accept: application/json' \
-H 'apikey: `cd123456-789d-0123-4567-e8c901234fbb'Retrieving Data From Netskope One DSPM
Follow these instructions to use Netskope One DSPM’s Open API to pull data defined / generated within Netskope One DSPM for use within your own systems. These instructions are applicable for any CSP and assume you have:
- Onboarded at least one Infrastructure Connection (ex: AWS)
- Connected at least one Data Store for said Infrastructure Connection (ex: RDS PostgreSQL)
To learn more about each activity, visit our main Using Netskope DSPM category and select the relevant subject.
Fetch Infrastructure Connections
Begin by pulling a list of Infrastructure Connections, whose response will include the following details for each account:
- Which cloud platform (AWS, GCP, or Azure)
- The account’s unique identifier in that platform
- Its parent organization (if any)
With this information, you can pair it to like connections in your system and later use the IDs to filter the data stores.
| Action | Example |
|---|---|
| Get list of all supported platforms |
Request
|
|
Response | |
| Get list of Infrastructure Connections filtered by a specific platform (ex: AWS) |
Request
|
|
Response |
Fetch Connected Data Stores
Once you know which Infrastructure Connection(s) whose Data Stores you wish to inspect, next you will pull a list of their Connected Data Stores:
- The entire list
- A subset filtered by Infrastructure Connection ID (ex: AWS Production)
- A subset further filtered by database services (ex: PostgreSQL)
| Action | Example |
|---|---|
| Get list of all supported services |
Request
|
|
Response | |
| Get list of all Connected Data Stores |
Request
|
|
Response | |
| Get list of Connected Data Stores filtered by a specific Infrastructure Connection |
Request
|
|
Response | |
| Get list of Connected Data Stores filtered by both a specific Infrastructure Connection and service |
Request
|
|
Response |
Many different values are available for Connected Data Stores, but those of the most value to external systems include:
-
endpoint: the unique remote identifier for the cloud data set, which you can use to correlate Netskope One DSPM Data Stores with your own system’s data set connections -
data_tags: array of Netskope One DSPM Data Tag IDs, if any are assigned. See below to learn how to retrieve details for each -
data_store_sensitivity_score: xxxxx -
data_store_risk_rating: xxxxx -
data_store_sensitive_data_access_risk_score: xxxxx
Fetch Data Store Tags
Often, Data Stores will be tagged with one or more Data Tags. Each Data Tag participates in a single Data Tag Category, which may be information useful to your system.
Traditionally, Data Tags and Data Tag Categories don’t change as often as Connected Data Store information, so you may not need to retrieve this kind of data as often.
Follow these steps to pull details for each Data Tag ID:
| Action | Example |
|---|---|
| Get list of all Data Tags |
Request
Response |
| Get details for specific Data Tag IDs |
Request
Response |
Augmenting Netskope One DSPM with Your Data
In turn, you can use Netskope One DSPM’s Open API to supply Netskope One DSPM with Data Tags that represent information from your own systems.
For example, if your system was responsible for backing up data sets, you could tag Netskope One DSPM’s Connected Data Stores to show which aren’t enrolled in backup protection. In turn, Netskope One DSPM’s policy engine could take action on such Data Tags to drive outcomes, such as creating ServiceNow tickets to remedy such scenarios.
Create Data Tags in the Data Tag Catalog
Before you can tag a Connected Data Store, you must first make the Data Tag available in the Data Tag Catalog. You might also create a custom Data Tag Category, so your custom Data Tags can be collected and easily-identifiable throughout the system.
Follow these steps to create and update your custom Data Tags:
Once a Data Tag has been added to the Data Tag Catalog, it is recommended to never delete it, as doing so also removes the Data Tag from any associated record (including but not limited to Connected Data Stores).
| Action | Example |
|---|---|
| Create new Data Tag Category |
Request
|
|
Response | |
| Create new Data Tag |
Request
|
|
Response | |
| Get list of all Data Tags for a specific Data Tag Category |
Request
|
|
Response | |
| Update existing Data Tag |
Request:
|
|
Response | |
| Delete existing Data Tag |
Request:
|
|
Response |
Add Data Tags to Connected Data Stores
Once your custom Data Tags are available in Netskope One DSPM, you can now tag your Connected Data Stores know which Infrastructure Connection(s) whose Data Stores you wish to inspect, next you will pull a list of their Connected Data Stores:
| Action | Example |
|---|---|
| Associate specific Data Tags to Connected Data Store |
Request
|
|
Response |