Overview

Netskope One DSPM supports the ability to onboard, connect to, and scanning your Oracle Cloud Infrastructure (OCI) compartments. These capabilities require programmatic access to connect to and scan the Data Stores, including configuring specific OCI users or IAM roles.

Configure OCI Access

We recommend creating a dedicated OCI Domain, User, Group and Policy to connect your OCI environment to Netskope One DSPM. 

Create OCI Domain

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Click on the Create domain button 
4. Provide the right name, description, type and administrator details 

Create OCI User

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on the correct domain and navigate to the Users section
5. Click on Create User to create a dedicated service account user to connect to DSPM 
6. Copy the created user's OCID (this will be required as an input in Netskope One DSPM UI while onboarding the compartment)
7. Navigate to API keys section and Add API key for this user
8. Download the private and public key files (this will be required as an input in Netskope One DSPM UI while onboarding the compartment)
9. Also copy the Fingerprint value (this will be required as an input in Netskope One DSPM UI while onboarding the compartment)

Create OCI Group

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Domains
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on the correct domain and navigate to the Group section
5. Click on Create group to create a dedicated group for assigning the read only policies required for data store discovery and classification
6. Add the above-created OCI User to the Netskope One DSPM Group

Create OCI Policy

1. Log into the OCI Console
2. Navigate to Identity & Security section and select Policies
3. Select the correct OCI compartment that you want to onboard to DSPM
4. Click on Create Policy to create a dedicated policy to connect to Netskope One DSPM 
5. Enter the Policy Name and description
6. Toggle the “Show manual editor” option and enter the below statements, substituting OCI GROUP with the above-created OCI Group and compartment with your OCI compartment
7. Click the Create button

Allow group <'OCI GROUP'> to inspect autonomous-databases in compartment <dspm>
Allow group <'OCI GROUP'> to inspect pluggable-databases in compartment <dspm>
Allow group <'OCI GROUP'> to inspect databases in compartment <dspm>
Allow group <'OCI GROUP'> to inspect db-nodes in compartment <dspm>
Allow group <'OCI GROUP'> to inspect vnic in compartment <dspm>

Create a Netskope One DSPM Infrastructure Connection

At this point, your configuration of OCI is complete, and Netskope One DSPM can now be connected to your infrastructure.

1. Log into Netskope One DSPM.
2. Navigate to Administration → Infrastructure Connections → OCI tab.
3. Click the Add Infrastructure button in the upper right. 
4. Click ADD COMPARTMENT.
5. On the Capabilities tab, set the following toggles depending on your discovery & classification needs: 

6. Click NEXT.
7. Enter the following values:

Field	Value
Compartment Name	Any value (this is used to identify your infrastructure connection within Netskope One DSPM).
Home Region	Obtain from your OCI console.  Click on the region name near the top right corner of the screen. Then click in Manage regions and copy the Region Identifier for the home region and paste into Netskope One DSPM UI
Compartment OCID	You can onboard compartment at root or any intermediate level to include all child compartments within it.     To retrieve the value required by Netskope One DSPM:   Log into the OCI Console Navigate to Identity & Security section and select Identity Select the correct OCI compartment that you want to onboard to DSPM Copy the OCID value Enter the copied value the Compartment OCID field within Netskope One DSPM
Tenant OCID	To retrieve the value required by Netskope One DSPM:   Log into the OCI Console Click on the profile icon on the top right corner, then click Tenancy Copy the Tenancy OCID value Enter the copied value the Tenant OCID field within Netskope One DSPM

8. Click NEXT.
9. Review the already filled fields 
10. Enter the User OCID of the service account created in the Create OCI User section
11. Enter the Public Key Fingerprint that was copied while adding API Key to the OCI user
12. Upload the Private Key that was downloaded while adding API Key to the OCI user
13. Click SAVE.