Overview

If multiple employees use a business intelligence (BI) platform that following uses a single database user account to interface with a data warehouse, all activity will appear to come from that single user within the query logs. You can link un-linked (eg. ghost) usernames from the Employee Management page to a Service Account application, creating a Netskope One DSPM Service Account to disambiguate employee details from the query’s metadata (e.g. query headers).

Usernames linked with Service Accounts can then be identified within the following screens: Employee Management, User Assessment, Policy Management, and Alerts & Tasks.

Netskope One DSPM supports connecting to the following BI platforms:

• Looker
• Mode
• Periscope

Other BI platforms may also be used, depending on their support for custom query headers (see the next section).

Query Headers and Unique Identifiers

Each supported BI platform has a standard query header, which Netskope One DSPM will search to find a unique identifier. This value is extracted and associated with that employee’s query activity within Netskope One DSPM. How we determine this unique identifier differs per platform. See below for examples with supporting details:

Looker

Netskope One DSPM uses the “user_id” value, prepended with “looker_user_”. In this example, Netskope One DSPM would use the string “looker_user_70”:

-- Query Context '{"user_id":70,"history_id":119108,"instance_slug":"35234234235234234234234"}'
SELECT * FROM USERS

Mode

Netskope One DSPM uses the “email” value with no changes:

SELECT * FROM USERS
-- {"user":"gwashington","email":"gwashington@example.com","url":"modeanalytics.com/whitehouse/reports/123456","scheduled":false}

Periscope

Netskope One DSPM uses the “email_address” value with no changes:

{"chart_name":"User Data",
"Dashboard_id":123456, 
"user_email":"gwashington@example.com”,
"Query_source":"user_chart_editor",
"Priority":10, 
"filter_values":"Test One",
"Aggregation":"weekly", 
"date_range":{"type":"units","num_units":null,"unit_aggregation":"day"}}
*/ SELECT * FROM USERS

Other

If your BI platform is not listed above, it may also be used as long as its query headers can include unique employee identifiers within a key named “email”.

Linking Service Account to Usernames

Unlinked usernames in Netskope One DSPM may correspond to Service Account Applications, which can be verified and linked by taking the following steps.

1. Navigate to User Identity → Employee Management
2. Click the Un-Linked Users tab
3. Click on a Username that may be associated with a Service Account Application and look at their Queries. If you see many queries generated by the same application, it is likely a Service Account.
4. Go back to the Un-linked Users tab and click on the LINK button next to the Username.
5. Select Service Account Application and use the dropdown below Application to pick the corresponding application. Select one of the following:
   1. Looker
   2. Mode
   3. Periscope
   4. Other 
6. Click SAVE.

This link creates a new Service Account, visible on the Service Account tab. Once this link is made, Netskope One DSPM will automatically disambiguate users who made queries in the service account and associate them with specific employees to enable better risk assessment.

Delete a Service Account

When you delete a Service Account, any extracted employee information will be removed from the system, and no further Alerts or Tasks will be generated in regards to their activities.

1. Log into Netskope One DSPM.
2. Navigate to the User Identity → Service Account tab.
3. Click the red trash icon on any existing Service Account row.
4. A warning will display to confirm the removal of the Service Account. 

5. If you wish to proceed, click the Yes button.