Netskope One DSPM supports scanning AWS PostgreSQL Data Stores. Follow these instructions to setup your AWS PostgreSQL database and configure its connection to Netskope One DSPM.

Begin by configuring a PostgreSQL service account, which will be dedicated to Netskope One DSPM’s use.  There are two approaches you can use for configuring this service account:

CREATE USER dasera_user WITH PASSWORD 'dasera_password' LOGIN;

GRANT rds_superuser TO dasera_user; 

CREATE USER dasera_user WITH PASSWORD 'dasera_password' LOGIN; 

GRANT SELECT ON ALL TABLES IN SCHEMA public TO dasera_user; 

ALTER DEFAULT PRIVILEGES GRANT SELECT ON TABLES TO dasera_user; 

Netskope One DSPM’s Data-In-Use-Monitoring capability requires access to query logging.  If you wish to leverage this capability, you must configure your PostgreSQL database to begin generating such logs. This includes configuring parameters and establishing a log retrieval function.

Please follow the steps below to define these configurations.

Set Query Logging Parameters

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, navigate to Parameter groups.

3. Select an existing parameter group for your PostgreSQL database. If one does not exist, create a new one using these AWS instructions.
4. On the next screen, click the Edit parameters button.
5. Using the search box, find the following parameter keys and set the corresponding values:

Create a Log Retrieval Function

The following steps may require the assistance of your local database administrator.

1. Download the latest (master) Amazon RDS / Aurora Logging function script from the aws-samples GitHub repository.
2. As an administrator, log into your PostgreSQL database's shell as an administrator using these AWS instructions.
3. Run the downloaded script within your shell to create the necessary logging function. Once run successfully you should be able to see the following five functions created in the logs schema

To validate call the new function once by executing select public.load_postgres_log_files().This should result in loading the query logs into the postgres_logs table.  You can also run select * from logs.postgres_logs to check the query log output.

Netskope One DSPM will require information about your data store in order to communicate with your PostgreSQL database. Please follow the steps below to identify the connection values for later use within Netskope One DSPM.

1. Click this link to log into your AWS RDS Console, which will navigate you to the RDS service.
2. Under Amazon RDS in the left-hand menu, navigate to Databases.
3. For the database you wish Netskope One DSPM to scan, click its link in the DB Identifier column.  For Aurora PostgreSQL, be sure to choose a database with Role = "Writer Instance" (instead of "Regional cluster")
4. In the Connectivity & security section, make note of the following values:

Highlight Color	Corresponding Netskope One DSPM Value	Example
Blue (Endpoint)	Data Store Endpoint
Grey (Port)	Data Store Endpoint

1. Log into the Netskope One DSPM platform.
2. Navigate to Data Stores → Data Store Inventory.
3. Use the Discovered tab, then click the CONNECT button under Actions to connect a discovered data store. You'll immediately see the Credentials tab with some fields automatically populated.
4. Alternately, click the CONNECT A DATA STORE button in the upper right to select a data store type and go through the data store connection UI manually.

5. The Connect a Data Store modal is displayed, starting with the SELECT DATA STORE tab.
6. Click on the icon for the Data Store Type you wish to connect. The modal will auto-navigate you to the next tab.
7. On the PROVIDE CREDENTIALS tab, complete the following fields:

7. Click the NEXT button. The SELECT CAPABILITIES tab is displayed.
8. Complete the following fields:

• Assign a Data Owner (optional): define one or more Platform Users responsible for this Data Store and its data sets.
• Which databases should Netskope One DSPM scan?: utilize the field’s picklist control to select which databases & schemas should be monitored by the Netskope One DSPM application. By default, all databases & schemas are selected.
• Features: Netskope One DSPM’s recommended feature selections will be defaulted, which you can override if desired. Some features are always-on, some are not applicable (with disabled toggles), while others may request additional configurations.

9. Click the SAVE button, which will navigate you to the next tab.
10. On the REVIEW tab, Netskope One DSPM will validate your credentials and capability selections. In the event of any issues, follow the on-screen instructions to remediate the displayed warnings or errors.
11. Click the SAVE button to finalize your connection.