Netskope Cloud Security Posture Management (CSPM) allows for the creation of custom rules using Domain Specific Language (DSL) for all three major cloud platforms: AWS, Azure, and GCP. This capability is integral to CSPM and enables organizations to tailor their security posture assessments to their specific needs across different cloud environments.
The ability to create custom rules using DSL within Netskope CSPM for AWS, Azure, and GCP is documented in the Netskope Knowledge Portal. It provides detailed instructions on how to build custom rules under Policies > Security Posture > Profiles & Rules for security assessment of resources across these cloud platforms

For a new Netskope tenant provisioned, to create a secure tenant configuration, you should consider changing the following default settings:
B . Change Untrusted Root Certificate to Block: This setting will ensure that any traffic coming from an untrusted root certificate is blocked, which is a critical security measure to prevent man-in-the-middle attacks and other types of cyber threats1.
D . Change "Disallow concurrent logins by an Admin" to Enabled: This setting will prevent multiple concurrent logins by the same admin account, which is an important security control to mitigate the risk of unauthorized access. If an admin's credentials are compromised, this setting will help limit the potential damage by ensuring that only one session can be active at a time1.
These changes are part of the recommended security hardening guidelines for Netskope tenants to enhance the overall security posture of the tenant environment.

When designing a policy for AWS S3 bucket scans with a custom DLP profile in Netskope, the available policy actions are Alert and Quarantine. These actions allow you to be notified when a policy violation occurs and to quarantine sensitive data to prevent potential data loss or exposure. The Alert action will notify the designated personnel or system when a match to the DLP profile is found during the scan. The Quarantine action will move the offending file to a secure location where it can be reviewed and dealt with appropriately1.
The information about policy actions for AWS S3 bucket scans is available in the Netskope documentation, which provides guidance on creating API Data Protection policies for scanning S3 buckets and the actions that can be taken when a policy is triggered1.

For organizations running workloads across multiple AWS VPCs and needing to steer machine-generated traffic to Netskope with minimal tunnel overhead, the optimal approach is to use IPsec tunnels from AWS Transit Gateway. The Transit Gateway acts as a centralized network hub that connects multiple VPCs, enabling traffic from all connected VPCs to be routed through a single set of IPsec tunnels to Netskope. This significantly reduces the number of tunnels required compared to creating individual tunnels from each VPC separately. GRE tunnels are not natively supported by AWS Transit Gateway in the same manner as IPsec, making IPsec the preferred protocol for this architecture. Using per-VPC Virtual Private Gateways would result in one tunnel set per VPC, greatly increasing operational complexity and management overhead.

When configuring a DLP policy for AWS S3 bucket scanning through Netskope's API-enabled Protection, the available policy actions are determined by the capabilities supported for that specific API integration and data plane context. For AWS S3, the supported DLP policy actions are Alert and Quarantine. Alert generates an incident and notifies the security team without modifying the object, while Quarantine moves the policy- violating file to a designated quarantine location within the S3 environment. Block and User Notification are not supported actions within the API-enabled Protection workflow for S3 buckets, as these actions are designed for inline Real-time Protection policies where the user is actively interacting with content in real time, not for asynchronous API-based scans.