NetApp ONTAP

The following ports and endpoints must be open between the DSPM scanner and the SVM:

Minimum supported version: ONTAP 9.10.1 or higher.

The connector authenticates using an SVM-scoped account. Create a custom role on the SVM that grants access to the REST endpoints listed below.

CIFS share exposure. Every volume in scope must be exposed through a CIFS share. Volumes that are visible over REST without a corresponding CIFS share will be discovered, but their file content will not be classified.

Root ACE permissions (NTFS volumes). An explicit ACE granting modify-equivalent rights must be configured for the CIFS scan account at the root of every NTFS volume, applied to this folder, subfolders, and files:

In the DSPM console, navigate to Administration > Data Sources, switch to the Provider tab, expand NETAPP, and select NetApp ONTAP. Because no credentials exist yet, the connector opens on its start page; choose + NEW CREDENTIALS to define the first credential set. Once at least one credential set is saved, scan configurations and tagging rules can be created against it.

Figure: Figure 1: Selecting the NetApp ONTAP provider under Administration > Data Sources and starting a new credential set.

To configure the NetApp ONTAP connection in DSPM, provide:

• ONTAP management endpoint / SVM LIF — REST API host or IP address.
• SVM-scoped API user and password — REST credentials matching the role defined in Required SVM REST API Privileges.
• CIFS/SMB user and password — scan account for data access over SMB.
• SMB domain — required for Active Directory-backed SVMs to qualify the CIFS scan account.

The credentials form is split into two groups that correspond directly to the two communication channels described in Architectural Overview. ONTAP management takes the SVM management LIF host and port (443 by default) with the SVM-scoped REST account, while SMB content fetch takes the CIFS data LIF host and port (445 by default) with the scan account and its domain or workgroup. Both groups are mandatory — omitting the SMB details leaves content classification, persistent tagging, and file moves unavailable. Use SAVE & CLOSE to store the credentials, or SAVE & CREATE SCAN to continue straight into a scan configuration.

Figure: Figure 2: New Credentials form — the ONTAP management (REST) and SMB content fetch (CIFS) channels are configured separately.

Workgroup-backed SVM. Resolves local CIFS users and groups, and UNIX users and groups, directly from ONTAP local tables.

Active Directory-backed (domain-joined) SVM. Domain principals are mapped to join trustees discovered by the DSPM LDAP/AD connector. An active LDAP/AD connector covering the same domain must be configured in DSPM for domain trustees to resolve properly.

Give the configuration a name and select the saved credential set. For Scan Scope, either Entire Data Source covers everything the connection can reach, or Selected Location narrows the scan to specific SVM volumes — the recommended option, since a tighter scope completes noticeably faster. Enabling Fetch Permissions instructs the connector to read DACLs and enumerate trustees over the REST channel using the privileges listed in Required SVM REST API Privileges. START FILE SCAN queues the scan immediately.

Figure: Figure 3: Scan configuration with the scope narrowed to a single volume and permission fetching enabled.

The connector page lists every configuration on the Scan configurations tab, with live scan status, last-updated time, and running counts of files discovered, files classified, and trustees resolved. A rising discovered count with classified remaining at zero is the usual signature of an unreachable CIFS data LIF, because enumeration runs over REST while content retrieval requires SMB. The adjacent Credentials and Tagging rule tabs manage the stored credential sets and the rules that drive persistent tagging.

Figure: Figure 4: Scan configurations list showing scan status and discovery, classification, and trustee counts.

Completed results are available in Enterprise Search, where each file can be opened for detail. The Source field reports NETAPP_ONTAP, confirming the origin, alongside risk, classification and confidence, compliance tags such as PII and PHI, detector hits, and keyword hits. The Permissions tab exposes the trustee data collected when Fetch Permissions is enabled, and is the starting point for the remediation actions summarised in Capabilities and Limitations Matrix.

Figure: Figure 5: Enterprise Search file details for a file scanned from NetApp ONTAP, including classification and compliance tags.

Permission revocation. Revoking permissions on UNIX files fails because of ONTAP REST API restrictions on UNIX mode-bit and ACL modifications, regardless of the scan account's privilege level.

Tagging. Only hard (persistent) tagging embedded directly into the file structure is supported. Cloud-based soft tagging and Microsoft Information Protection (MIP) tags are not supported.

NFS access. NFS client data access is not implemented; all file content retrieval runs over SMB.