Connecting to Databricks Data Stores

Overview

Netskope One DSPM supports scanning of Databricks Data Stores. Follow these instructions to prepare your Databricks environment and connect it to the Netskope One DSPM platform.

Create a Databricks Service Account

Netskope One DSPM requires programmatic access to connect to & scan your Databricks Data Stores, including assigning specific user permissions. Please follow the steps below to create the necessary configurations within the Databricks console.

More information about creating Databricks users is available here.

Creating a Netskope One DSPM-specific service account will require a dedicated email account to use during configuration. Please work with your organization to have this made available before continuing.

Create and Configure Netskope One DSPM User

Begin by creating and configuring a Netskope One DSPM-specific service account in your Databricks instance.

Log into your Databricks Console as any Admin user.
If prompted, select the workspace which contains the Data Stores you wish Netskope One DSPM to monitor.
Navigate to Settings > Admin Console.
The Admin Console screen is displayed.
On the Users tab, click the Add User button.
The Add User modal is displayed.
Complete the Email field, using the value that corresponds to the Netskope One DSPM-specific user.
Click the Send invite button.
When the invitation arrives at the specified email address, click the link to accept the invitation.
Navigate back to Settings > Admin Console.
On the Users tab, for the user you just added, grant the following permissions:
1. Workspace Access
2. Databricks SQL Access
Navigate to the Workspace Settings tab.
Under the Access Control section > Personal Access Tokens section
1. Ensure that the section is enabled.
2. Click on its Permission Settings button.
The Permission Settings modal is displayed.
Add the above Netskope One DSPM-specific username to the list and grant the “Can Use” permission by clicking the + Add button.
Click the Save button.

Generate the Access Token

Next, you will use the Netskope One DSPM-specific service account itself to generate the access token that Netskope One DSPM requires for connecting to your Databricks instance.

Log into your Databricks Console as the Netskope One DSPM-specific service account that was created above.
If prompted, select the workspace which contains the Data Stores you wish Netskope One DSPM to monitor.
Navigate to Settings > User Settings.
The User Settings screen is displayed.
On the Access Tokens tab, click the Generate New Token button.
The Generate New Token modal is displayed
Complete the following fields:
1. Comment: any value, although it is recommended you note it is used by Netskope One DSPM
2. Lifetime (days): any value, including blank (indefinite)
Click the Generate button.
The screen will refresh to display your generated token.
Make note of the generated token, which will later be used within Netskope One DSPM for connecting your Databricks Data Stores
Click the Done button.

Configure the Databricks Cluster

Log into your Databricks Console as any Admin user.
If prompted, select the workspace which contains the Data Stores you wish Netskope One DSPM to monitor.
In the sidebar, navigate to Compute > All-Purpose Clusters tab.
Click on the name for the cluster being used by Netskope One DSPM to view its details
On the top-right, click the More... button, then select Permissions.
The Permission Settings modal is displayed.
Add the above Netskope One DSPM-dedicated username to the list & grant the “Can Manage” permission.
Click the Save button.
On the Configuration tab, click the Advanced Options toggle to expand its contents.
Within the expanded contents, click the JDBC/ODBC tab.
Make note of the following highlighted portions, which will later be used within Netskope One DSPM for connecting your Databricks Data Stores:

Highlight Color	Corresponding Netskope One DSPM Value	Example
Blue	Server
Grey	HTTP Path

Connect Your Data Store

Excerpt: Connect Your Data Store 1

Log into the Netskope One DSPM platform. Navigate to the Data Stores > Data Store Invento

Log into the Netskope One DSPM platform.
Navigate to Data Stores → Data Store Inventory.
Use the Discovered tab, then click the CONNECT button under Actions to connect a discovered data store. You'll immediately see the Credentials tab with some fields automatically populated.
Alternately, click the CONNECT A DATA STORE button in the upper right to select a data store type and go through the data store connection UI manually.

The Connect a Data Store modal is displayed, starting with the SELECT DATA STORE tab.
Click on the icon for the Data Store Type you wish to connect. The modal will auto-navigate you to the next tab.
On the PROVIDE CREDENTIALS tab, complete the following fields:

Field	Value
Data Store Identifier	Friendly name to describe this Data Store. Your value is displayed in other Netskope One DSPM screens such as Policy Management and Classification Management.
Server	Enter the Server Path value from the Configure the Databricks Cluster step above.
HTTP Path	Enter the corresponding value from the Configure the Databricks Cluster step above.
Username (Email) / Service Principal Application ID	Enter the email address for the Netskope One DSPM-dedicated user created in the Create and Configure Netskope One DSPM User sub-step above. Alternatively, enter any existing Service Principal Application ID.
Token	Enter the corresponding value from the Generate Access Token sub-step above, or the token associated with the Service Principal Application ID provided. If your token is configured to eventually expire, in the future you will need to generate a fresh token then update these configurations within Netskope One DSPM in order for the platform to continue scanning your Databricks Data Stores.
Scan Frequency	Controlling how often your Data Store is reviewed for changes, Netskope One DSPM’s recommended frequency is defaulted, which you can override if (desired).
Sidecar Pool	Excerpt: Connect Your Data Store: Credentials: Sidecar Pool If you will use sidecars to monitor this data store, select a sidecar pool with network visibility to said data store. This field is displayed when there is at least one defined sidecar pool. To learn more, please visit our Sidecar Administration article.

Excerpt: Connect Your Data Store 2

Click the NEXT button, which will navigate you to the next tab. On the SELECT CAP

Click the NEXT button. The SELECT CAPABILITIES tab is displayed.
Complete the following fields:

Assign a Data Owner (optional): define one or more Platform Users responsible for this Data Store and its data sets.
Which databases should Netskope One DSPM scan?: utilize the field’s picklist control to select which databases & schemas should be monitored by the Netskope One DSPM application. By default, all databases & schemas are selected.
Features: Netskope One DSPM’s recommended feature selections will be defaulted, which you can override if desired. Some features are always-on, some are not applicable (with disabled toggles), while others may request additional configurations.

Feature	Supported for Databricks?
Discovery	No
Privilege Analysis	No
Shadow Data Analysis	No
Classification	Yes
Data In Use Monitoring	Yes (custom query logs only)
Automation	Yes (always-on)

Excerpt: Connect Your Data Store 3

Click the NEXT button, which will navigate you to the next tab. On the REVIEW tab

Click the SAVE button, which will navigate you to the next tab.
On the REVIEW tab, Netskope One DSPM will validate your credentials and capability selections. In the event of any issues, follow the on-screen instructions to remediate the displayed warnings or errors.
Click the SAVE button to finalize your connection.

Welcome to the Netskope One DSPM Knowledge Base

You will find your answers here!

Sorry, we didn't find any relevant articles for you.