Recently active topics

1. OverviewThis solution implements a "read-once" or "time-limited" file storage system on AWS S3. It automatically deletes files from a specific S3 bucket 30 seconds after they are downloaded (accessed via the GetObject API).Architecture FlowConnector Activity: Connector downloads a file from S3 (GetObject). Logging: AWS CloudTrail captures this specific Data Event. Trigger: Amazon EventBridge detects the GetObject event in the CloudTrail logs and triggers a Lambda function. Processing: The Lambda function waits for a configurable buffer period (30 seconds). Action: The Lambda issues a DeleteObject command to permanently remove the file.2. Prerequisites (Critical)By default, CloudTrail does not log S3 Data Events (file-level access). You must enable this for the automation to work.How to Enable CloudTrail for S3 Data EventsNavigate: Go to the AWS Console > CloudTrail > Trails. Select Trail: Open your existing management trail. (Create one if none exists). Edit Data Events: Scrol

This document outlines the migration steps from the Netskope CCP connector to the officially published Netskope Alerts and Events connector.Migration to the officially published connector on the Microsoft content hub is mandatory for the Netskope connectors listed below. Note: Ensure the Contributor role is assigned to the environment to make the necessary changes.   Steps for MigrationDisconnect Netskope CCP ConnectorDisconnect the existing Netskope CCP connector. Verify that the connector is disconnected before proceeding with the migration.  Download Netskope Connector from Content hubDownload the Netskope Connector from the Content hub in azure sentinel. Note:  Before configuring the new connector the current data must be migrated to the new schema. A script is provided to perform the schema migration.    Table Schema ChangesYou need to run the below script to perform the migration from the old schema to the new schema. All field schema changes for the different tables are already

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

in one of our customer getting power shell attack in all users office 365 . how we can block .is it possible to block power shell access based on country using CASB or there is any other way to resolve this issue .

While accessing any sites on incognito mode is very slow for initial time. Once the page is loaded, all the sites are loading normally on new tabs. Once we reopen the browser with incognito mode again, the same issue happening again for initial time.any suggestions?

Netskope Global Technical Success (GTS)Microsoft Edge - Blocking Browser Extensions Netskope Cloud Version - 133 ObjectiveBlock Microsoft Edge extensions and add-ons. PrerequisiteNetskope Next-Gen SWG license ContextThe business use case is to prevent users from installing browser extensions and add-ons in Microsoft Edge Do You Know?Microsoft Edge does offer a dedicated platform called the Microsoft Edge Add-ons, where users can discover, download, and manage extensions and add-ons. Microsoft Edge extensions are packaged in the .CRX (Chrome Extension) file format. One thing to note is that Google Chrome and Microsoft Edge are built on the same platform: Chromium ConfigurationTo block Microsoft Edge Add-ons extensions, you need to do two things:Block access to the Microsoft Edge Add-ons – This stops users from browsing and installing extensions directly from the official site. Block .CRX file downloads – Since Chrome extensions can also be installed from other websites, blocking .CRX fi

I am writing to inquire about the current roadmap and support for Manus AI within the Netskope NewEdge network. As Manus AI gains traction as a powerful general-purpose AI agent, our organization needs to ensure robust data protection and visibility over the sensitive information being shared with this platform.1. Current Status Inquiry: Does Netskope currently have a functional Cloud App Connector for Manus AI? Specifically, are the activities (such as "Post" or "Upload") already being indexed in the CCI (Cloud Confidence Index)?2. Development Suggestion (DLP Integration): If full support is not yet available, I would like to suggest the development of specific DLP controls for Manus AI, focusing on: Prompt Protection: Real-time inspection of text inputs to prevent the leakage of PII, PHI, or source code. File Transfer Control: Monitoring and blocking sensitive documents uploaded to the Manus AI interface. Activity Monitoring: Granular visibility into user sessions to distinguish

Team,Good morning. Is there a reason I'm getting DNS Leakage? Did I forget something in my configuration  See screenshots below.  All "DNS Traffic" is enabled in the steering configuration. DNS Profile is configured with resolver IP of 162.10.1.1 Real-Time Policy is configured. Thanks.  Expand Post

Hello,Is there a way we can create dashboard to track all the endpoints that are enabled vs disabled and the observed trend on how often does a user disable the client and enable it again (for example)? Thank you,Jennifer

The Netskope Cloud R133.1.0 hotfix documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Hotfix Version 133.1.0.Submit your feedback via docs.netskope.com.

I am struggling with the props.conf setup to pull web transaction logs via S3 bucket. I have set up per Stream Logs to Splunk - Netskope Knowledge Portal .This would replace my setup for using REST API v2 for transaction logs eventually.  I currently have logs going in parallel into a temp index for validation before cut over.I am using queries below to validate time stamp detection and proper data parsing. If you have this setup to your satisfaction, Can I request you to share your props.conf? Validation queries: #Check if _time matches x-cs-timestampearliest=-10mindex=nsweb_temp sourcetype="netskope:web:test"| eval payload_time = tonumber(coalesce('x-cs-timestamp','x_cs_timestamp'))| eval splunk_time  = _time| eval diff_seconds = splunk_time - payload_time| eval status = if(diff_seconds==0, "PERFECT", "OFFSET")| eval diff_abs_s = abs(diff_seconds)| eval diff_hms   = tostring(diff_abs_s, "duration")| table _time payload_time splunk_time diff_seconds diff_hms status| sort - _time| head

Does NS Client upgrade cause any impact on end user running traffic, especially on active web sessions, Audio/Video calls ? Version 132.0.7.2513_Windows 

User case :   Git Pull/Push basic commands does not work and throws connection timeout error when i enable NPA and even i have whitelisted git hub web site with ports 22,443 but when i disable NPA and use AOVPN it works . so need some advice ?Note: even i have enabled virtio proxy enabled at wsl setting but no luck 

We are supporting a client with two separate Azure tenants and using Netskope SSE for secure access. Our configuration allows certain Azure base URLs via NPA for PaaS services, while the Azure portal routes through SWG. We use the same client and steering configuration for users accessing both tenants.Observed Behavior:When accessing via GUI/browser, traffic is correctly segregated per tenant.When using CLI, traffic always routes to the primary tenant, even when attempting to access resources in the secondary tenant.CLI-based operations cannot properly enforce tenant-specific routing.Impact: CLI operations on the secondary tenant fail or incorrectly use the primary tenant context

Hello,We are looking to control access to a social media site with cloud app access real time policy. However, the site doesn’t exist as a selectable CASB cloud app today and we have to fall back to using SWG policy instead.The site in question is www.weddingpro.com.Can we get a new cloud application created for this website?Thanks,Nick 

Just wanted to see if any of you are servicing customers that have recently implemented NinjaOne for endpoint management and patching. If so, how have you approached the third-party patching? cert pinned app bypass?  domain bypasses? ssl no decrypt policies?  mix of all of the above? We have our endpoint management team working but we just foresee a massive maintenance task in the future for the needed and potentially changing domains? A wildcard approach seems like too much of a security hole. 

We had integrated Netskope and Azure/O365 services and we are facing issues sometimes as We add the user to the security group which is added to an NPA but at the user end it takes time longer than usual and sometimes it required manual entry to share/extend access Need more information on it

Happy New Year ~We’re ringing in the new year by launching our brand-new, fully responsive mobile experience—designed and built from the ground up! 

Thank you for joining our Customer Success Webinar: Netskope Client – Installation and Troubleshooting. We appreciate you taking the time to attend and engage with our Technical Experts. During the session, we focused on providing practical, real-world guidance to help ensure a smooth and reliable Netskope Client deployment experience. Here’s a quick recap of what we covered: Key Highlights from the Session A step-by-step walkthrough of best practices for Netskope Client installation across different environments Live demonstrations and expert insights into common client installation and troubleshooting scenarios Proven tips on leveraging Netskope resources to identify and resolve client-related issues faster An interactive Q&A session addressing real customer questions and deployment challenges If you missed any part of the session or would like to revisit the content, we encourage you to watch the recording and explore the shared resources (linked below). 👉 [Watch the reco

Hi team,Can we use  New Policy Group based on location and move all private access Policies on this group?  Example: Site A Private Access ( Group Name)          Site A Private Access Policy 1( Example Policy Name :File Server Site A Access)          Site A Private Access Policy 2 ( Example: Private Web Application Site A Access)         Site A Private Access Policy 3   ( Example: Backup Server Access Site A Access) Site B Private Access( Group Name)         Site  B Private Access Policy1 ( Example Policy  : File Server Site B Access)          Site B Private Access Policy 2  ( Example Policy: Private Web Application Site B Access)         Site B Private Access Policy 3   ( Example Policy: Backup Server site B Access) Challenge what I am trying to solve here is that group policy based on Physical location of offices, so that i dont need go through long list of Policy and navigating through this policies is difficult. So if we arrange the Policies based on locations , we know that this p

Your Netskope Monthly Highlights – January 2026The latest updates, resources, and events – all in one place.Hi there,As part of our ongoing commitment to helping you get the most value out of your Netskope investment, we’re excited to bring you this month’s Netskope Highlights—your one-stop roundup of the latest product updates, expert content, and upcoming learning opportunities. 🚀 Product Release UpdatesStay relaxed! Release 134 will be available in February 2025. ✅ Features not to miss out!This section highlights key innovations from the recent Netskope release that can significantly enhance your Adoption and Value Realization journey.Top 5 Highlights:Application Firewall 2 : The new enhancement in Application Firewall 2 allows you to add real time policies based on IPs, ports and domains.  Email DLP : Delete action for recipients : A new action called “Remove Recipients” is added to the Email Outbound policies. The action removes the restricted recipients from the email so that it

Curious if anyone has successfully triggered compromised credential alerts in recent months.We've noticed that there have been no detections of compromised credentials for several months. We've reached out to support and the L3 team, but no test samples have been provided to demonstrate the functionality in the console.We're wondering if anyone has observed any related events that could confirm this feature is functioning as expected.

Why sometimes on-premise detection shows “remote" and sometimes it shows “off-premise” when users are not in intranet, such as office environment.

It seems that users under SkopeIT are only displayed when accessing Cloud Apps or the Web.Events from Cloud Firewall or Private Apps are not included, resulting in limited visibility.Do you have any suggestions on how we can monitor user activity in these cases?