Skip to content

History / Setting Up Netskope for Access Control Integration

Revisions

  • Netskope: mark live in Hub, document console tag path, add setup screenshots Cover Manage Tags via Settings → Devices, Hub create/link CA + policy flows, and embed the console and Hub screenshots.

    @edamamedev edamamedev committed Jul 28, 2026
  • Netskope: Linux device UID is readable, correct the no-Linux-support claim The client writes nsdeviceid= to /opt/netskope/stagent/provisioning at install time; verified against client 139.0.0.2721. Linux is supported given a recent enough agent, so replace the hard exclusion with a version caveat and correct the prerequisites table.

    @edamamedev edamamedev committed Jul 28, 2026
  • Netskope: note the Linux gap is ours to close, not a Netskope limit Operators reading "Linux devices cannot be tagged" had no way to tell whether Netskope refuses to tag them or EDAMAME cannot name them. It is the latter, and it is fixable, so say so and point at the shape of the fix rather than leaving it as a flat limitation. Also narrows "Netskope's API" to "the tag endpoints", since the inventory endpoints do expose MAC and serial.

    @edamamedev edamamedev committed Jul 28, 2026
  • Document that overlay/endpoint integrations have no IP or MAC fallback NetBird, Tailscale and Netskope address devices only by an identity the vendor's own client issues. Saying a device without that identity is 'silently skipped' left it open whether EDAMAME falls back to the IP or MAC it also holds. It does not, and cannot: an enforcement point that keys on its own identifier has no way to resolve an address it never issued. Spell out the consequence per provider, since it differs and is never neutral: omission from the NetBird group, active deauthorization from the Tailscale tailnet, and denial by the allow-on-tag policy in Netskope. All three fail towards denial, so a broken agent cannot leave a device authorized.

    @edamamedev edamamedev committed Jul 28, 2026
  • Add Netskope setup guide Netskope tags compliant devices rather than allow-listing them, so the guide leads with the label-versus-enforce split and the Netskope-side policy chain the customer has to build for the tag to mean anything. Documents the constraints that are invisible from the Hub UI: Linux devices cannot be tagged (no provisioning device UID), a device already at Netskope's five-tag cap silently loses EDAMAME's tag, Base URL takes a bare hostname, and the tag marks compliant devices so the policy must allow on its presence. Marked as not yet available in the index, since the provider is not selectable in Hub yet while the tenant-side steps can be prepared now.

    @edamamedev edamamedev committed Jul 28, 2026