Recently active topics

Hi Team, Can you please help to allow login to Codex Enterprise application only and block rest? I tried using the Header insertion but it's not working.

Thoughts on FWaaS Policy  This article assesses some key considerations when constructing a policy for Netskope One Firewall-as-a-Service (FWaaS/Cloud Firewall). FWaaS secures traffic destined for public IP addresses on non-web ports. It should be assumed that the real-time policy table is split into policy groups to aid administrators with the correct placement of their policies. The focus here is the implications of positional placement of policies for Layer 3/4, and Layer 7. This article assumes that the tenant has been enabled for Service and Destination profiles (the equivalent on a legacy tenant would be Custom Firewall Apps). It also assumes that non-web application firewall is enabled for app detection at L7. Netskope evaluates policies using a top-down approach, hence the first policy that matches the traffic flow criteria will apply. Key Points The following are some of the policy objects that can act on traffic processed by firewall and therefore potentially change behaviour

Hello all!Customer’s internal domain ends is customer.net. We know that’s a public domain (.net), but it predates us, and we don’t think that migrating to customer.local or something like that is viable in the given time.We are deploying NPA and, so far so good. The issue is that their domain exists on the internet, and is not owned by the customer themselves. So, if a client resides outside of the premises, they can resolve internal names to a public IP address. And since that domain seems to have some sort of catch-all resolution, everything gets resolved.The security concerns are obvious: the owner of the public domain can learn all of their internal services hostnames and then deploy phishing sites, etc.We already have blocked that IP address, but we are trying to block DNS resolution all together. Although blocking other domains works, this one doesn’t, because it is defined in many private apps.What can we do to sucessfully block these requests?Thanks.

 1. Overview This article documents the procedure to resolve Docker Engine and Docker Compose version prerequisite failures encountered during Netskope Cloud Exchange (CE) setup or upgrade on Ubuntu 22.04.5 LTS. The root causes identified are:Docker Engine: Package pinned at an older version; the official Docker apt repository not yet configured or cache outdated. Docker Compose: A manually installed standalone binary at ~/.docker/cli-plugins/docker-compose (installed July 2025) was taking priority over the updated apt plugin, causing the CE setup script to read the wrong version.!!! Important Note: Make sure you have a backup of your Cloud Exchange instance or take a snapshot before starting the upgrade process.  2. Symptoms When running the CE setup script (sudo python3 ./setup), the prerequisite check outputs one or both of the following failures:  3. Environment OS: Ubuntu 22.04 Hypervisor: VMware4. Root Cause Analysis 4.1  Docker Engine — Outdated PackageDocker Engine was install

Hello the community.I need your help.I’ve opened a high-priority support ticket separately, but I’m looking for information on how DNS works (ping / nslookup).We’re having an issue with our business applications.I have an internal application published on our DNS. I don’t have any issues at work.But outside of work, when I ping it, I get the following response:C:\Users\THOMAJULIE>ping wug.XXX.frSending a ‘ping’ request to wug.XXX.fr [100.64.0.1]  > Normal comportmentC:\Users\THOMAJULIE>nslookup wug.XXX.frServer:  UnKnownAddress:  192.168.1.254Non-authoritative answer:Name:    wug.XXX.fr.transports.comAddresses:  2a01:7e01::f03c:95ff:feeb:9d4b          2a01:7e01::f03c:95ff:fe00:2692          2a01:7e01::2000:dff:fec1:5cdb          2a01:7e01::f03c:95ff:feed:783e          2a01:7e01::f03c:95ff:fe91:5d91          139.162.181.76          172.104.149.86          172.104.251.198          139.162.174.209          172.104.203.186Is this normal behavior?Can you tell me how ping/nslookup r

Background :We have Netskope SMTP DLP, Endpoint DLP, and Microsoft Exchange integrated with Netskope. Users are currently imported via Directory Importer (LDAP/AD) with a synchronization interval of 180 minutes.Use CaseWe are implementing a Leavers Email and Endpoint Monitoring Policy (Monitor/Allow mode only). When HR raises a MyAccess request, the user is automatically added to a dedicated LDAP group. The Netskope policy is configured against this group.The challenge is that policy enforcement is delayed until the next Directory Import sync, which can take up to 60 minutes. Our requirement is for the policy to become effective immediately after the user is added to the LDAP group.  Options ConsideredSCIM Provisioning: We considered using SCIM to provision the specific leavers group and apply policies based on SCIM group membership. However, our understanding is that users already imported through Directory Importer should not also be provisioned through SCIM, as this could create ide

The Netskope Cloud R139.0.0 documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Version 139.0.0.The key new or updated features are:Netskope Client Steering Support for FIPS-140-3 compliance requirements Ability to Delete Devices AI Command Center (AICC) AI Command Center - General Availability (GA) Submit your feedback via docs.netskope.com.

🔍 Summary:Thank you to everyone who attended our  webinar, “Unlocking value from recent Netskope releases”, held on 25th June 2026.The webinar covered a recap of key technical features from recent releases that you might have missed. We hope you found it insightful and valuable. During this session, we covered the below topics :  Anthropic Claude Controls: Granular visibility and delete remediation policies for enterprise AI usage. Analytics Upgrades: A tour of the redesigned Analytics and Reports Overview dashboard layout. ZTNA Enhancements: Context-driven private access using time-of-day schedules. Threat Prevention: Blocking zero-day payloads with new HTML Smuggling detection modules. 🎥 Webinar Recording:If you missed the session or would like to revisit the content, you can watch the recording below:Customer/Partner Recording 📝 Share Your Feedback:We’d love to hear your thoughts! Please take a minute to fill out our short survey:👉 Event Short Survey LinkYour feedback help

The latest updates, resources, and events – all in one place.Hi there,As part of our ongoing commitment to helping you get the most value out of your Netskope investment, we’re excited to bring you this month’s Netskope Highlights—your one-stop roundup of the latest product updates, expert content, and upcoming learning opportunities.🚀 Product Release UpdatesRelease 139 is here!Explore this month’s key features and enhancements to ensure you’re getting maximum value from your setup.📄 Release Notes - July 2026 ✅ Pro Tip: Check for features relevant to your current configurations.✅ Features not to miss out!This section highlights key innovations from the recent Netskope release that can significantly enhance your Adoption and Value Realization journey. Top Highlights:Enhanced Third-Party App Permission Visibility (SSPM)Keeping tabs on the third-party apps plugged into your SaaS environment just got easier: SSPM now shows when each app was discovered and verified, and gives you a clear

I have Slack configured via Next Gen API connector. I have DLP policies to identify specific data types being shared externally. After opening an incident I can clearly see the channel name identified. However, I have no way of whitelisting or filtering on them. We have a channel naming convention to identify false positives, but no way to filter them out besides manual review. What can be done? 

Dear Netskope Community Members, Thank you for joining our recent webinar on “Netskope One Product Updates - Reviewing the Last 3 Months of Releases” June 2026.Missed our recent deep dive? No worries! The recording for our three-month platform recap session is officially live.Catch up on the latest administrative tools designed to protect enterprise data, streamline reporting, and level up your zero-trust access strategy.🔗 Access the Recording: Click Here Highlights include: Anthropic Claude Controls: Granular visibility and delete remediation policies for enterprise AI usage. Analytics Upgrades: A tour of the redesigned Analytics and Reports Overview dashboard layout. ZTNA Enhancements: Context-driven private access using time-of-day schedules. Threat Prevention: Blocking zero-day payloads with new HTML Smuggling detection modules. Grab a coffee, watch the replay, and let us know what you think! 

Netskope Global Technical Success (GTS)Understanding “Patient Zero” Logging Behaviour and Policy MatchingObjective If you've already configured a Patient Zero Protection policy, you may have noticed something confusing in SkopeIT: the alert doesn't always say "Patient Zero," the Policy Name doesn't always match the policy you expect, and "Block" actions for held-but-benign files can seem to disappear from your filters. This article picks up where our existing Patient Zero articles leave off. Instead of covering policy setup again, it focuses on how to read and correlate Patient Zero logs, so you can confidently confirm whether your policy is doing its job during an investigation.If you haven't yet configured a Patient Zero Protection policy, start with Netskope Cloud Sandboxing – 'Patient Zero' Real-time Protection Policy and the Netskope Knowledge Portal guide for step-by-step configuration. This article assumes that groundwork is already in place. Prerequisite Netskope Advanced Threa

The Netskope Cloud R138.1.0 hotfix documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Hotfix Version 138.1.0.Submit your feedback via docs.netskope.com.

Dear Community members,Thank you to everyone who joined us live for Session 3 of our Netskope One SSPM series! We had some fantastic discussions around locking down SaaS security risks and fixing critical misconfigurations.Whether you couldn't make it live or just want to review the key takeaways, the full recording is now available.👉 [Watch the Session 3 Recording Here] 📋 We value your feedback! Please take 60 seconds to share your thoughts in our [Quick Survey Link] so we can keep making these sessions better for you. What we covered in this session: Deep-Dive Visibility: How to surface hidden risks across your entire SaaS ecosystem. Continuous Compliance: Automating the detection of dangerous misconfigurations. Practical Steps: Best practices for immediate data risk reduction. Feel free to share this link with any members of your team who might find it valuable. If you have any questions about what we covered, just hit reply—we're here to help!Best regards,Rohit Bhaskar 

Will Endpoint DLP support Airdrop as a device control in the future?

how to bypass loom desktop  application ?

Hello Everyone,I have a query regarding Netskope with Sensitivity Labels for Email DLP.We have integrated Netskope with the "Sensitivity Label" feature and successfully published all labels into Netskope. Using this integration, our Endpoint DLP, Cloud and Web DLP label‑based policies are working as expected.However, for SMTP Email Proxy, labeled attachments (Secret, Top Secret, Restricted) are getting bypassed. We tested multiple approaches:GUID‑based method: Extracted GUIDs from the MIP Compliance Portal and created custom regex entities (e.g., MSIP_Label_<GUID>_Name These did not trigger in SMTP DLP. Metadata extraction workaround: For Word files, we extracted metadata via File → Info → Properties → Advanced Properties → Custom and used regex ( ClassificationContentMarkingHeaderText.*Restricted This works only for Word attachments. Excel do not expose metadata in the Custom tab.its empty. Service account permissions: Assigned EXPORT role to the service account used for Sensiti

Dear Community Members,We are excited to announce the beta release of the Netskope Identity Dashboard, your new unified entry point for the Netskope applications and services your organization uses. The Identity Dashboard brings application access, profile management, and user administration together in a single, streamlined interface — making it easier than ever to get to the resources you need.As a user of the platform, your feedback is invaluable in helping us shape the experience. If you encounter any issues or have suggestions, please reach out to ciam@netskope.com.What Is the Netskope Identity Dashboard?The Identity Dashboard provides a single sign-on experience across connected Netskope platforms, including:Notification Portal Academy Support Community Partner PortalsSign in once at id-dashboard.netskope.com and access any connected application throughout your session — no repeated logins required. What's NewUnified Application AccessOne launchpad for Netskope applications avail

In our environment, we found that M365 Copilot Cowork is not working when user’s connection is protected behind Netskope. Other customers using Netskope seems to be reporting the same issue as well.Microsoft’s documentation on network requirements for Copilot Cowork has been published here Cowork network endpoints (Frontier) | Microsoft Support and they cited requirements around supporting long-lived connection. Microsoft support has also shared an internal document that mentioned about the use of Server-Sent Events--which based on Internet research is not something SASE/SWG products support by default.Do you have a recommended configuration that we can use to make Copilot Cowork to work behind Netskope? Any plan to make this configuration to be part of the standard M365 policy from Netskope so that we don’t need to request a configuration change in our company? 

Dear Partner fellows,We have been informed by the Support team that if you create cases on behalf of customers, the SLA associated with the customer’s purchased support level will not be honored.Quoted from Support, with company information masked:“Also, regarding the SLA request, the reason is that the case was raised by a vendor account rather than the customer.Please sync with your account team for any further queries.”

Netskope Global Technical Success (GTS)Anthropic Claude - Access to Corporate Instance Only (via Instance Detection) Netskope Cloud Version - 135 ObjectiveAnthropic Claude - Access to Corporate Instance Only (via Instance Detection) PrerequisiteNetskope Next-Gen SWG license ContextCustomers licensed to use Anthropic Claude may require that access be restricted to users authenticated with approved corporate domain accounts. Any attempts to access Anthropic Claude using accounts from non-corporate or unauthorized domains should be blocked.This knowledge base article explains how to achieve this use case using Netskope CASB Instance Detection. Author NotesIf the core business objective is to allow access only to the Corporate Anthropic Claude instance and block all other instances, please follow the KB articles listed below.However, if the business objective is to allow access to the Corporate Anthropic Claude instance while permitting a few exceptions for specific users, please continue