Netskope SWG

Netskope SWG Integration

Overview

High Level Flow

• Traffic from the client machine is tunneled to Netskope Secure Web Gateway by the Agent installed on the client machine.
• Any traffic matching WitnessAI destinations
• Will undergo SSL inspection in Netskope
• Will be Forwarded to Witness AI Proxy after Injecting the User Name in the format ai/johndoe as the X-Authenticated-User value in the header.
• Once the traffic reaches the WitnessAI Proxy, the applicable controls and guardrails are applied on the traffic.

Prerequisites (For Customers)

• Netskope Tenant should be configured to send Web and Non-Web traffic via Netskope.Under Settings > Security Cloud Platform > Steering Configuration, the configuration applied to the relevant User Group/Organization Unit should steer All Traffic (HTTP/HTTPS and Non-web) via Netskope.
• Copilot and other thick client Apps use websocket connections and these traffic will need the above configuration to be routed via Witness AI Proxy.
• If SSL Decryption Bypass exists for Microsoft Domains/Apps, the Real-time Protection policies used for forwarding traffic to proxy will not be evaluated. Hence ensure that AI URLs used by WitnessAI are inspected.
• The Destination Profile used by this integration is created and managed by WitnessAI via API. Customers do not create it manually. A dedicated RBACv3 Service Account with a REST API token is therefore required on the customer Netskope Tenant, both for Destination Profile management and for forwarding page events to the WitnessAI Logger. Refer to the API Credentials (RBACv3 Service Account) section below for details.

API Credentials (RBACv3 Service Account)

Creating the Role

1. On the Netskope Tenant, navigate to the Roles tab on the Settings > Administrators & Roles page and click on New to create a new role.

1. In the new window, enter the Role Name (for example WitnessAI-Role) and optionally enter a Role Description. Leave all the Functional Areas unchecked.
2. In the Permissions list, under the Objects function, enable the Manage and Apply permissions for Destination Profile.

1. In the Permissions list, under the Skope IT section, enable the Read permissions for Alerts and Page Events.

1. Click on Save to save the configuration.

Creating the Service Account

1. On the Netskope tenant, navigate to Settings > Administration > Administrators & Roles > Service Account

1. Specify the Service Account Name, for example WitnessAI-SA, select the Role created in the previous section (WitnessAI-Role), and under REST API Authentication Methods click on API Key to generate the REST API token. Select Generate token now with expiry and give a high lifetime for the token (Ex: 12 Months). Click Create.

1. Once the token is generated, click on Copy Token from the Success message. The token is shown only once: copy and store it securely.

1. Share the below information with the WitnessAI Account Team at the time of onboarding:
• Tenant ID from the Netskope URL. For example: https://{tenant-id}.goskope.com
• API Token.

• Once the customer instance is provisioned on the WitnessAI side, a new Destination Profile named Witness-Forward-List will be created in the customer's Netskope Tenant via API. You will reference this profile when creating the Custom Category in Step 3 of the Configuration Guide below.

Configuration Guide

1. CA Certificate Import

• To install the Proxy CA Cert on Netskope, navigate to Settings > Manage > Certificates
• Under Trusted CA tab, click New Trusted CA

• Enter a file name and upload the CA certificate (.pem format) by clicking Select File (CA Certificate will be provided by the Account Team)

• Click on Validate and finally Save

2. Forward to Proxy Integration Configuration

• To configure the Proxy details, Navigate to Settings > Manage > Forward to Proxy Integration and click on Setup Proxy

• In the new window, Configure the below settings:
• Proxy Name (Ex: Witness-AI-Proxy)
• Proxy Hostname (Ex: {tenant-id}.{region}.witness.ai)
• Port: 4128
• Enable the X-Authenticated-User Checkbox
• Select X-AU-ENCODE-FORMAT as Domain User
• And Click on Save

3. Destination Profile and Custom Category Creation

• For matching the required traffic and forwarding it to the proxy, a URL Custom Category will be used. The Custom Category references a Destination Profile that contains the WitnessAI-managed list of AI destinations.

• The Destination Profile is created and managed by WitnessAI via API. Customers do not need to create or populate it manually. WitnessAI will automatically configure the Destination Profile in the Customer Netskope Tenant using the API, and any changes to this Destination Profile will be managed by WitnessAI.
• To enable this, create an RBACv3 Service Account and API token for the Netskope Tenant and share the details with the WitnessAI Account Team. Refer to the API Credentials (RBACv3 Service Account) section above for steps to create the Role, Service Account, and API Token.
• Once the customer instance is provisioned on the WitnessAI side, a new Destination Profile named Witness-Forward-List will be created in the customer's Netskope Tenant via API. It can be viewed under Policies > Destination.

• After the Destination Profile has been created via API automation, Go to Policies > Custom Categories and click on New Category.
• In the new Window, Enter a Custom Category Name (Ex: Witness-Forward)
• Under the OR Section, Select the Destination Profile created via API automation (Witness-Forward-List) and Click on Save.

4. SSL Decryption Policy Creation

• An SSL Decryption Policy ensures that traffic matching the Custom Category is decrypted by Netskope. SSL decryption policies are applied right after the traffic is steered to Netskope, and the traffic must be decrypted for the Real-Time Protection policy (created in the next step) to forward it to the WitnessAI Proxy.
• Navigate to Policies > SSL Decryption and click on Add Policy to create a new policy.

• To add a Match Criteria, click on ADD CRITERIA and select Category.

• Select the Witness-Forward category which was configured in the previous step, from the drop down.
• Set the action to Decrypt, policy name as Witness-Decrypt, status to Enabled and finally click on Save to save the configuration.

• Upon saving the configuration, please ensure that the policy is on top.

• Click on Apply Changes for the policy to take effect.

5. Real-Time Protection Policy Creation

• Real-Time Protection Policy will be used to forward any traffic matching the Custom Category to Witness AI Proxy
• Go to Policies > Real-time Protection and click on New Policy, in the dropdown select Web Access.

• In the new Window, Configure the below settings:
• Source: Select the Users, User Group or Organizational Unit intended for using Witness AI Solution
• Destination: Under Category Select the URL Custom Category created earlier (Witness-Forward)
• Profile & Action: Forward to Proxy
• Proxy: Witness-AI-Proxy
• Policy Name: Give a name for the policy. (Ex: Witness-Forward-Policy)
• Make sure that the policy status is Enabled and click Save