Recently active topics

OverviewA continuation of Sending Alerts and Events to Microsoft Sentinel using the Codeless Connector Platform.The first article set up the Codeless Connector for a single Netskope tenant. This post extends it. It sends alerts and events from several Netskope tenants into one Microsoft Sentinel workspace, and it labels each record so you can tell the tenants apart.If you have not read the single-tenant article, start there. The base ideas carry over: the Codeless Connector Framework, the RBACv3 service-account token, and the REST API index. Architecture Each Netskope tenant sends alerts and events to the same connector. The connector posts the data to one Data Collection Endpoint. A separate Data Collection Rule for each tenant adds a TenantSource value and writes the record to the shared tables. The result: all tenants share the same tables, and the TenantSource column tells you which tenant a row came from.This template supports up to five tenants.What is different from the single-t

We are facing one issue where users are sharing google docs from external domains eg: gmail.com to nykaa.com, and nykaa.com users are able to access the google docs or sheets on which they can paste /write the sensitive information.So how do we block this transaction with Netskope

HI Team,We are currently receiving 24-hour scheduled reports for USB activity from Netskope; however, this does not fully meet our organization’s monitoring requirements.We would like to highlight a specific requirement from our end:• Whenever USB access is granted to any user, we need the ability to capture and receive activity details immediately (near real-time or on demand).• The report/log should include:o User detailso Device informationo Type of activity (Allow/Block/Alert)o Files accessed or transferredo Accurate timestamp of the activityAt present, while these activities are visible in the Alerts/Events section, the scheduled 24-hour reports do not provide complete visibility, especially for all actions (Allow/Alert/Block) in a timely manner.Therefore, we request you to:1. Validate this requirement from a product capability standpoint.2. Confirm whether real-time or near real-time reporting/export for USB (Device Control) activity is feasible.3. Advise on any configuration cha

Netskope Global Technical Success (GTS)Anthropic Claude - Block Google SSO for login Netskope Cloud Version - 135 ObjectiveAnthropic Claude - Block Google SSO for login PrerequisiteNetskope CASB Inline & SWG license is required ContextAnthropic Claude provides Single Sign-On (SSO) integration with Google accounts “Continue With Google”. This knowledge base article focuses on preventing end-users from utilizing Google SSO to access Anthropic Claude.Do You Know?The mechanism that works behind this Continue With Google is called OAuth (Open Authorization) is an industry-standard security framework that allows apps to access your data or interact with other services on your behalf without you having to share your password. You have likely used OAuth if you have ever clicked a button that says "Sign in with Google," "Continue with Apple," or "Log in with Facebook" when using a new app or website. When an end user selects "Continue with Google" on the Claude webpage, the authentication r

After 4 months, is there any updates on Google search AI detection and how to practice a better protection method to prevent potential data breach with this interaction.  

OverviewThis guide shows how to stream Netskope alerts and events into Microsoft Sentinel.The connector is called Netskope Alerts & Events Connector (via Blob Storage). Netskope publishes it. It ingests alerts and events logs from Netskope Log Streaming into Microsoft Sentinel via Azure Blob Storage, using the Microsoft Sentinel Codeless Connector Framework (CCF).The data flow does not push logs straight into Sentinel. Netskope Log Streaming writes logs to an Azure Blob Storage container. Sentinel then reads those blobs and writes the records into the Log Analytics table NetskopeAlertEvents_CL.This article is based on the connector's own deployment template (netskope_alert_events_log_streaming.json). UIs in Netskope and Azure change over time, so verify each screen against current documentation as you go.How it works (architecture)The pipeline has three stages.Netskope Log Streaming sends Alerts & Events logs to an Azure Blob Storage container. Azure infrastructure signals new

Hear from our security engineers as we share how Netskope moved beyond blanket restrictions to a more adaptive, context-aware approach that lets us safely say “yes” to SaaS and GenAI. We’ll highlight real-world patterns of risky usage, common blind spots across managed and unmanaged apps, and the unique data exposure risks posed by GenAI assistants and copilots. Learn how to:Discover and continuously assess SaaS and GenAI usage across your environment Protect sensitive data with granular, inline, and context-aware controls Apply consistent policies to managed, unmanaged, and AI-powered applications Partner with business stakeholders to securely accelerate SaaS and GenAI initiativesFor more information, check out our blog post.    View past events in this series! Check out some customer questions below, or feel free to comment and continue the discussion!  Q: Can you share best practices for GenAI apps control in RTP policy structure given new app connectors and capabilities?A: Discover

I am experiencing intermittent periods when I am unable to update incidents (In Progress/Resolved/False Positive) which last for hours at a time. Is it possible that another user making changes is causing this?

This is not an improvement for administrators, in my opinion.The Last Event filter used to have “Admin disabled” and “User Disabled” making it easy.Now one has to select “Actor” and “Status disabled”

Hello.Netskope was installed to replace a competitor product and I have been having intermittent issues ever since. Sometimes the laptop can be up for days without issue - sometimes I have to reboot multiple times in a day. - I cannnot replicate this issue at will.After a reboot the laptop Non-Paged Pool is approximately 1.2GB - that looks high but I had no reason to look at this before the Netskope client was installed.Usually the first I am aware of an issue is in a Teams call - when it becomes unresponsive - but not every Teams call.When I look at the non-paged pool size it is up to about 26GB. at this point nothing much works and I have to Hard reset the laptop (Hold the power button down for 20 seconds),I have a higher end DELL laptop with 32GB of Physical memory installed (the standard is 16GB).I now find myself camped in Task Manager watching the value to see if it is rising - and rebooting the laptop before every important eams call, just in case.Using tools I cannot attribute

 This document outlines the integration of Netskope Web Transaction Logs with Microsoft Sentinel on Azure US Government cloud using the Codeless Connector Framework (CCF). Separate templates are provided for comma-delimited and space-delimited blob data. This native integration provides near real-time visibility for effective threat hunting and incident management. To configure Netskope Log Streaming to send logs to your Blob storage please go through the article: https://docs.netskope.com/en/stream-logs-to-azure-blob ⚠️ Important: You can't restrict network access to your Azure Blob Storage account as per the official guidance from Microsoft.🏗️ Integration Architecture OverviewThe integration leverages several Azure services to ensure reliable and scalable log delivery: Netskope to Azure Storage Blob: Netskope pushes Web Transaction Logs into a customer-owned Azure Storage Blob Container (as gzipped CSV files). Event Grid Notification: Every time a new file (blob) is written, an auto

Hi all: Is anyone out there running WSL Version two and using Netskope? 

Thank you to everyone who joined us for the kickoff of our SSPM Webinar Series!In this introductory session, we broke down how Netskope One SSPM simplifies this complexity, helping organizations gain total visibility and drastically reduce risk.🎥 Watch the RecordingWhether you couldn't make it live or just want to review the key takeaways, you can access the full session on-demand here:👉 Watch the Netskope One SSPM Webinar Recording 📋 Key Highlights & TakeawaysHere is a quick recap of what we covered during the session: The "Why" Behind SSPM: Why SaaS Security Posture Management is critical in today’s SaaS-first environment. Netskope One Capabilities: A deep dive into how the platform unifies and strengthens your governance. Visibility & Control: Practical steps to uncover hidden risks and misconfigurations across your SaaS apps. Real-World Value: Concrete use cases demonstrating how security leaders and IT admins drive business value with SSPM. 💬 We Want to Hear From

Hello fellow Skopers,if you are like me, you sometimes struggle analyzing Netskope client logs because they are so noisy, span multiple files, and are difficult to filter. Especially if you are faced with a problem where you’re not quite sure what to look for. The fact that there is no reference guide available for these logs complicates things further.That’s why I built a little CLI tool to help me analyze the logs and separate the signal from the noise.It’s very early in its development, but it can already do these things:Output a chronological, scoped timeline of high-signal events, showing errors and client status changes Filters relevant events like client lifecycle and UI status, config and update activity, tunnel and gateway events, DNS/proxy/PAC problems, Fail Closed and captive portal signals, NPA connection events, and TLS/certificate issues Analyze and inventory client log bundles (the zip files) with useful informationMuch more is planned, like an interactive dashboard in t

In our environment, we found that M365 Copilot Cowork is not working when user’s connection is protected behind Netskope. Other customers using Netskope seems to be reporting the same issue as well.Microsoft’s documentation on network requirements for Copilot Cowork has been published here Cowork network endpoints (Frontier) | Microsoft Support and they cited requirements around supporting long-lived connection. Microsoft support has also shared an internal document that mentioned about the use of Server-Sent Events--which based on Internet research is not something SASE/SWG products support by default.Do you have a recommended configuration that we can use to make Copilot Cowork to work behind Netskope? Any plan to make this configuration to be part of the standard M365 policy from Netskope so that we don’t need to request a configuration change in our company? 

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

Anthropic’s Claude has gone from "the AI tool a few teams were experimenting with" to mission-critical infrastructure: Developers ship code with Claude Code. Analysts build entire workflows on Claude Projects. Platform teams run inference at scale through the Claude Platform. But here's the uncomfortable question: Do you have the same security governance over Claude that you have over Slack, Google Workspace, or Salesforce? If the answer is "not yet" — this post is for you.Netskope has built an integration with the Claude Compliance API, giving security and compliance teams visibility into Claude usage directly within the Netskope One Platform. This brings Claude Enterprise and Claude Platform activity under the same security umbrella as every other application in your stack.No new tools. No separate dashboards. The same console your team already uses. Let me walk you through what this looks like — and more importantly, why it matters.The Problem: AI Apps Are the New Shadow IT When

We are currently observing multiple “Compromised Website” alerts in Netskope for several local news websites and some insurance company websites that users frequently access.These appear to be legitimate websites, but Netskope is flagging them as compromised or malicious. We would like to understand: What threat intelligence source/classification is being used for these detections? Has anyone else experienced similar alerts with legitimate local news websites? Could this be related to shared hosting reputation or a temporary website compromise? What is the best approach to validate whether these are true positives or false positives? We are trying to determine whether the websites are genuinely compromised or if additional tuning/exclusions may be required.Any guidance or similar experiences would be appreciated. 

There is currently no available RTP App for the AI platform Draftwise. This makes it very difficult to bypass all Draftwise traffic.

In some organizations it is important to understand what new applications users are using in the environment. New applications can pose certain risks (e.g. new apps used for PDF conversion or translation could inadvertently cause data loss), and they may also introduce redundancy and inefficiency (e.g. if someone starts using a new collaboration app, but the organization already has a company sanction app that is being paid for).  The dashboard attached helps organization identify new apps and ones no longer in use.  It consists of 2 view, one for new applications in the last 30 days:  and one for application not used in the last 30 days:  Important Notes: Advanced Analytics has a 5000 row limit. In organizations with more than 5000 applications, results will be unreliable. The general recommendation would be not to use this dashboard. If you have a high need for this information and have over 5k apps, please reach out to us for an alternate solution.  For this dashboard, to give relia

Hello Everyone,I have a few questions regarding  Reverse Proxy as a Service (RaaS) configuration with Microsoft Entra ID.We have configured Reverse Proxy as a Service (RaaS) with Microsoft Entra ID by following the official Netskope documentation below:Reference Document:https://docs.netskope.com/en/reverse-proxy-as-a-service-with-microsoft-entra-id-1 Configuration Summary Created an Enterprise Application in Microsoft Entra ID for Reverse Proxy Exchanged all required URLs and certificates between Entra ID and Netskope Configured SAML Reverse Proxy on Netskope and selected “Reverse Proxy as a Service” as the application type Shared the required URLs with the Entra application and completed Reverse Proxy configuration Reverse Proxy redirection is working as expected Created a DLP policy to block upload, download, and post actions for source code DLP policy is enforced successfully when traffic goes through Reverse Proxy for Cloud apps Observed Behavior From a managed device (w

I would like to find out whether the Netskope POP IP addresses change frequently.We currently have a cloud-hosted application that only permits access from our organization’s public internet IP address. However, the monitoring TVs are connected to the same LAN as the User LAN and their traffic is routed through the Netskope tunnel.Due to this setup, the source public IP seen by the cloud application may become the Netskope tunnel IP instead of our normal internet public IP.Kindly advise on the following:Should we whitelist the Netskope tunnel/POP IP addresses on the cloud application side?Is there a way within the Netskope proxy configuration to bypass the Netskope tunnel for this specific application or traffic, so that it uses our normal public internet IP instead?If bypass is possible, what would be the recommended approach or best practice? 

Hello TeamI'm setting up the Log Shipper plugin in Cloud Exchange and I'm getting the error shown in the attached image. Steps taken:I've already updated the API token generated in the Netskope tenant (with the necessary permissions for integration with CE).I have verified connectivity between Cloud Exchange and the tenant.Despite this, the system won’t let me complete the plugin creation. Has anyone experienced a similar issue, or do you know if there are any additional settings in the Log Shipper configuration that I should check?Best regards :)

From the investigation:The primary application itself is not being blocked. During the session workflow, the application initiates requests to external third-party tracking/analytics domains. Netskope identifies the traffic under the application context, but the actual blocked request is towards a third-party analytics/tracking endpoint. The current policy categorizes the request under a risk/control policy and blocks it, resulting in a user-facing warning/interstitial.Requirement:Allow the application workflow to continue without user interruption. Avoid broadly allowing all third-party tracking traffic globally. Maintain the existing security posture and policy controls.Questions:What is the recommended Netskope approach for handling embedded third-party analytics/tracking requests initiated from applications?  embedded third party urls are connect.facebook.net/log/error , facebook.com/tr & www.facebook.com/privacy_sandbox/pixel/register/trigger/ Is there a best practice to suppr