Skip to main content
  • EN

Additional Discussions

Welcome to our Additional Discussions Forum! Here, you can engage in lively conversations and exchange ideas on a wide range of topics that go beyond the scope of our product forums

  • 193 Topics
  • 439 Replies
193 Topics
Lionel
Netskope Partner
LionelNetskope Partner
asked in Additional Discussions
On-Premise Detection

Hello,In the context of On-Premise detection, it is currently possible to use a DNS/http request. To validate detection, it is necessary to depend on the tested resources.The slightest network disturbance can lead to poor detection of the user's location Is it possible to use the Public IP to identify the user's locality? This IP is visible to the agent.

3411
Rohit_Bhaskar
Netskope Employee
A
AlfaBaneExplorer III
posted in Additional Discussions
Single mode -vs- Multi-user mode installation

Hello all,    I wanted to see if anyone had any use-case, pros/cons, intent, etc information in terms of client installations. Beyond "Optional parameter. Use this parameter when installing in a multi-user system", I've been unable to find any additional information or context.    For reference, when we deploy the client or provision devices, the Netskope client MSI is installed with a mode=peruserconfig parameter. While our devices can be used by any user in our environment with appropriate access, there are next to no devices that are intended to be regularly used by multiple users.    I just wanted to reach out and see what your experiences have been. 

28245
monika
Netskope Partner
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
published in Additional Discussions
Netskope Sentinel One Device ClassificationNetskope, Sentinel One, Device Classification

Integrating SentinelOne and Netskope to leverage threat detection and enforce device classification provides a robust endpoint-to-cloud security approach.This integration facilitates effective device classification and management, enabling consistent security policies across both cloud and endpoint environments. Requirements:SentinelOne Admin Access Netskope Tenant Implementation:SentinelOne ConfigurationConfigure the script on SentinelOne Tenant > Remote Ops > Create New Click on Upload New Script and provide the script details Upload the script Script content:This script will create an empty file with a specific file name in a specific directory that Netskope's client will look at and It will be created when there is high risk as determined by SentinelOne - and when the Netskope client sees this, it will be able to match on the device and respond appropriately. # Define the directory and file path$targetDirectory = "C:\ProgramData\Sentinel\Addons\SentinelRSO"$filePath = Join-Pa

2420
Kmaheshwari
Netskope Employee
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Cribl Netskope Events and Alerts Integration

Cribl Netskope Events and Alerts Integration Netskope’s Events and Alerts can be pulled into Cribl via the Netskope REST v2 APIs. You can use Cribl Stream to filter and redirect to the destination of your liking. Note: Netskope Steaming Events (WebTx) aren’t supported currently. RequirementsNetskope tenant with API v2 enabled Cribl Stream accountSetup StepsNetskope Generate API token CriblCreate Data Source VerifySave and Run NetskopeGenerate API tokenIn your Netskope tenant go to Settings > Tools > REST API v2 > New Token  Add permission scopes to the token. You will need to add all scopes that you want to pull. In my example, I am going to grab all Events and Alerts. Give your token a name, and expiration period. Use the following scopes Events/api/v2/events/dataexport/events/application/api/v2/events/dataexport/events/audit/api/v2/events/dataexport/events/incident/api/v2/events/dataexport/events/infrastructure/api/v2/events/dataexport/events/network/api/v2/events/dataexport

28094
Gary-Jenkins
Netskope Employee
S
smzothoNew Member III
posted in Additional Discussions
Netskope randomly disabling

Hi Team I'm really happy to be part of this wonderfully community, my name is Simphiwe.We have many of our users whose Neskope gets disabled randomly and when this happens they lose access to a number of important applications within the organization. The only way to temporarily fix this is to restart the Netskope service or to completely restart the computer. However this is a short-time fix. I just want to know what are the main causes of Netskope getting disabled and how to fix this ? Thank you  

42345
M
W
wdeguaraNew Member III
asked in Additional Discussions
Netskope and Docker

Just wondering whether any community members who are Docker users have been able to get Netskope working with it ?

58983
J
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
published in Additional Discussions
Netskope CloudExchange CREv2 CrowdStrike CNAPP Workload QuarantineKnowledge Base Article,

The integration between Netskope CE CREV2 and CrowdStrike CNAPP (Cloud-Native Application Protection Platform) combines Netskope's ZTNA with CrowdStrike’s cloud workload protection capabilities to provide a seamless solution for securing cloud environments, particularly by enabling workload quarantine. Using this integration we can quarantine all the risky workloads via the Netskope CREv2The workload quarantine feature ensures that in the event of a security incident or detection of a compromised workload by CrowdStrike CNAPP, the affected instance or service is quickly isolated from Netskope Tenant for the users, limiting the spread of threats across the cloud environment. This capability helps in rapid incident containment and response. RequirementsCloud Exchange-5.1.0 Netskope Risk Exchange Plugin CrowdStrike Cloud Protection Plugin CrowdStrike CNAPP  Netskope Tenant ImplementationConfigure the Netskope Risk Exchange Plugin Configure the Entity Sources for the Netskope Risk Exchan

680
Kmaheshwari
Netskope Employee
Kmaheshwari
Netskope Employee
KmaheshwariNetskope Employee
published in Additional Discussions
Automating VPN Failover with AWS Lambda for Netskope PoP ConnectionsKnowledgebase, FAQ

This article outlines a solution for automating VPN failover using an AWS Lambda function, triggered by an Amazon CloudWatch event rule. The function monitors IPsec tunnel status changes for VPN connections to the Netskope Point of Presence (PoP). The automation ensures seamless failover to alternative PoPs in case of VPN failure, enhancing network resilience.  Overview The solution deploys an AWS Lambda function that automatically responds to changes in VPN tunnel status for connections to the Netskope PoP. Triggered by an Amazon CloudWatch event rule, the function checks if both VPN tunnels to the Netskope PoP are down. If they are, the function scans all AWS Transit Gateway (TGW) route tables and replaces routes pointing to the downed VPN connections with static routes to a designated failover PoP.This solution can be deployed in any AWS region and integrates with the AWS Global Network, utilizing Transit Gateway Network Manager to monitor and manage VPN connections. Key Features: P

1190
Kmaheshwari
Netskope Employee
J
juanmNew Member III
asked in Additional Discussions
SCIM-Based User Provisioning with GSuite

Hi all! It is supposed that Netskope can import the OUs and User Groups from GSuite user platform directly using SCIM but, I couldn't find the way to do it. In addition, all the documentation I find is related to SCIM integration with Azure AD and Okta. I've been looking for a way into GSuite Admin Console and there is nothing similar. Anyone here has had the same issue? Thanks!

4335
maheshchavan
Netskope Partner
KyleCabral
Netskope Partner
KyleCabralNetskope Partner
asked in Additional Discussions
Policy Email Notification Schedule

Currently there is no ability to schedule a policy email notification for a specific time.   The time the report is sent is fixed on the back end.  Would be nice to have the ability to change to a specific time.  

353
Rohit_Bhaskar
Netskope Employee
prajakta.yadav
Netskope Partner
prajakta.yadavNetskope Partner
asked in Additional Discussions
Netskope Reverse Proxy

Hello, What are the applications that can be covered in reverse proxy on Netskope? What are the limitations of reverse proxy?

2201
V
Netskope Employee
A
Netskope Partner
AllenWu
asked in Additional Discussions
Data Retention of Audit Log

Hi there, Does anyone know for how long Netskope will keep admin’s audit log on the console?Failed to find more info from kb and not sure if purchasement of extended data retention or AA will cover this and extend the data retention period of audit log to at least 1 year.https://docs.netskope.com/en/audit-log-1/ Thanks

1871
S
Netskope Employee
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Additional Discussions
Hub - Spoke gateway - Dynamic Public IP - Spokes-branchs

Hub - Spoke gateway - Dynamic Public IP ( Spokes-branchs )  Hello community, good afternoon.  I have a question regarding the sdwan borderless wan part of Netskope. Understanding a Hub-Spoke architecture Where I have one or a few SDWAN Gateway in Hub mode and other Spoke branches with their corresponding gateways. My doubt is the following. If I have Spoke/BranchOffice sites, where eventually there is a need for some other connection from the other branches to some particular resource of that branch, I would understand that it is not necessary that my Gateway - Spoke sdwan does not have static public IP, but dynamic either by 4G/5G or some high quality ADSL connection and / or public IP links Dynamics, for the Gateways / Spoke would not be critical to have static public IP where if in the case of the Hub if you have preferably static Public IP and / or port forwarding to the IP of the gateway-sdwan. Hub, but if it could allow and set up the tunnels and according to the policies would a

1181
MetgatzNK
Netskope Partner
B
brohanFTFCUNew Member III
posted in Additional Discussions
Netskope Splunk dashboards

Has anyone created any useful Splunk dashboards from the Netskope Splunk Add-on that they are willing to share with the community?

551
J
N
nadkickNew Member III
asked in Additional Discussions
Identify mode of enrollment (UPN vs IdP)

Hello,Is there a way in the tenant to identify on how a user has been enrolled (UPN vs IdP)? In preparation for mitigating Netskope’s enrolment vulnerability, we need to find a way to identify users/devices that are affected as they have been enrolled using UPN mode (we starting with UPN and switched to IdP for new subsidiaries). In addition, this might be a way to identify devices that should not be there (aka exploited the vulnerability).Thank you!Regards,Nadja

8891
ns-ssalomon
Netskope Employee
prajakta.yadav
Netskope Partner
prajakta.yadavNetskope Partner
asked in Additional Discussions
Remediation profile

Hi, We want to integrate CrowdStrike for EDR with Netskope using the link- “https://docs.netskope.com/en/integrating-crowdstrike-for-edr/#integrating-crowdstrike-for-edr-1”As per the document I understand that Netskope pushes the malware hash file to CrowdStrike, endpoints are checked to see if that malware hash file exists. If so, Netskope retrieves the identity of the endpoints and captures the details in a Skope IT alert. If no endpoints have the malware hash file, Netskope publishes the Indicators of Compromise IOC into CrowdStrike’s Custom IOC repository.  But I have few questions here as- 1. When NS pushes malware hash file to CS, if there is any active detection occurs we will get alert on NS under remediation alert type. But will we get the detection alert on CS for the same? For this same scenario, when we are getting the remediation alert on NS, it will be block from NS. But will it be block from CS also and in this case will it be added under IOC of CS? 

410
prajakta.yadav
Netskope Partner
B
BrianThomasNew Member III
posted in Additional Discussions
Obtain Group Members via SCIM

I am using the SCIM API with Swagger to pull information down from our tenant but I could not see how to pull all members of a group. The Admin UI has no option to export group memberships so I figured the SCIM API could do this but I don't see how to get anything other than SCIM ID and External ID via the API.  Is there a way to do this via SCIM or if not, how can I obtain group memberships in a programmatic way? 

3722
T
jsaunders
Netskope Employee
jsaundersNetskope Employee
posted in Additional Discussions
How Do You Educate Your Users About Security Controls?

"How should we communicate security controls and changes to our users? How do other Netskope customers do it?" These are questions we hear a lot, and the answer often is, "It depends."Here are some key factors to consider:Impact on Daily Operations: Will the change affect users' daily activities? Access Restrictions: Will users lose access to something they previously had? Policy Flexibility: Is your default policy open or restrictive, and how will this change affect the user experience—positively or negatively?It’s important to strike a balance between inundating users with minor regular change announcements, and notifying them when an impactful change is incoming. Many small changes won’t need this level of awareness.However, when users have access to something one day and lose it the next without warning, it can lead to frustration and a flood of support tickets—neither of which you want!So, how does Netskope handle it?At Netskope (Customer Zero), we notify our users about security

410
jsaunders
Netskope Employee
M
munster
asked in Additional Discussions
Manual Trigger Netskope Client Upgrade

Hiv118 was available. How frequent will the client check of newer version? How can I manually trigger upgrade?thank

6531
V
Netskope Employee
Iftesam
Netskope Partner
IftesamNetskope Partner
asked in Additional Discussions
Difference between Advanced debugging logs and logs collected from tenant.

I recently encountered the below mentioned issue and would like to have better understanding of the same.I have collected advanced debugging logs from the users system, where in the option of “Start” for outer capture was disabled, still I collected the logs and those were as expected.However when I tried collecting the same logs from the tenant for that user, I observed the logs were different and some of the captures which were present in the previously collected advanced debugging logs from the system were missing in the logs collected from the tenant.Attaching the screenshots for reference:Events triggered for the date and time : 2024/07/17 14:47:00.213Logs collected from the tenant :Advanced debugging logs collected from the device for the same time :Need to understand why the captured even for the same timestamp are different.

1672
Iftesam
Netskope Partner
S
Saif-ChaudhryNew Member
posted in Additional Discussions
Can you send me all Netskope log data in Microsoft Sentinel?

If you work with Security Architects, SOC Engineer, or a SOC Analyst, all of them will tell you one thing “Send me ‘ALL’ the logs!” because their ability to find threats or investigate incidents is reduced without the log data or if the required log data is dispersed in various log data stores. If your chosen partner for cloud is Microsoft, then they will also tell you one more thing “Send it to Microsoft Sentinel!” If you happen to be a person responsible to fetch these logs from Netskope then it’s okay to establish feeling where you think the whole world is working towards making your life difficult. I can tell you one thing – I’m not one of them so let me explain why I think I’m the angel 👼 out there to save you ....! Let’s get some fundamentals out of our way: Cloud Exchange – it’s our integration platform to enable third party partner integrations. Packaged as a multi-container application. Modules - Cloud Exchange (CE) comes with four primary modules: Log Shipper, T

9514
M
Netskope Employee
N
nadkickNew Member III
asked in Additional Discussions
Switch from UPN to IdP mode

Hello,Driven by Netskope’s enrolment vulnerability, we want/need to move our Windows endpoints from UPN to IdP mode. Does anyone know if there is a way to use a script to change the existing configs of the already installed agents? Before we plan to uninstall and re-install all 10k agents, we would like to elaborate if there is another way by eg deleting/modifying an existing config file.Appreciate any feedback. Thanks,Nadja

2400
N
I
ITGuy1New Member III
posted in Additional Discussions
Uninstall Netskope Client on Mac: A Simple Tutorial

The Netskope Client it password protected. Looking to see if any one has success with uninstaller scripts that will allow you to add those parameters to the scripts and do a clean uninstall

31076
J
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Netskope Cloud Threat Exchange Trend Micro Vision One

Overview Cloud Exchange CTE’s integration with Trend Micro Vision One gives you the ability to bilaterally share indicators of compromise (IOCs) in the form of URLs and file hashes. For example, if Trend Micro Vision One detects a suspicious object, you can configure an action to add it to Netskope’s blocked URL or file list.    Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CTE Trend Micro Vision One Setup Steps Trend Micro Vision One Find Region URL Create API Token Netskope Cloud Exchange Setup Netskope Plugins Netskope CTE Plugin Trend Micro Vision One CTE v1.0.1 or greater Create a Cloud Exchange Business Rule Create Sharing Configuration Sharing Hashes to Netskope Netskope  Create File Profile Policy Create New Malware Detection Profile Add file list to Netskope Real-time Protection Policy Verify Integration Verify Sharing of IoCs Trend Micro Vision One setup steps Fin

3192
S
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS)

Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS) Netskope provides rich logs for all aspects of security and connectivity but sometimes you may not want so much detail on things like the device type or OS. For example, in our DLP logs, this is the information you would get on the device.             "category": "Cloud Storage",            "ccl": "low",            "device": "iPhone 6S Plus",            "os": "iOS  9.6",            "owner": "dte3831@test.netskope.com",            "policy": "policy_ga32",            "request_id": "2459149802892628500",            "scan_type": "Ongoing",            "site": "Verizon Media", Maybe you just need one of those fields.  In Cloud Log Shipper we can control which information is sent on to the destination by editing the mapping file. You can even have two destinations one with the full logs that you can send somewhere like an AWS S3 bucket for long term storage and then another one that you can send on to your SIEM that trims dow

2450
Gary-Jenkins
Netskope Employee

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings