We're evaluating Netskope and the insider threat module is flagging constantly. It seems to mostly trigger when our developers are working in Git—pushing code, cloning repos, accessing tools like GitHub or GitLab.
Our security team is getting overwhelmed with alerts. Has anyone else faced this? How did you tune the policies to distinguish real threats from normal dev activity without just turning it all off? I'm curious about specific DLP or activity rules that worked.
Yeah, we saw the same thing during our trial. The Git stuff set off everything because of the data patterns in commits.
We got our security team to exempt certain IPs for our dev subnet from the high-risk data movement alerts. Also, we made a custom DLP profile that excludes common dev file types like .java and .py from the "source code" policy. That cut down the noise a lot.
Did you try setting up a test policy for a single dev team first? Might be easier to tune.
That sounds really frustrating. We're only just starting with Docker and our team is small, but I can imagine the alert fatigue is real.
The custom DLP profile idea that was mentioned for common dev file types seems smart. Did you find it tricky to define what "normal" Git activity looks like for your policies? Like, would a bulk clone of a new repo still get flagged?
Thanks for sharing this, it's helpful to see what to watch out for.