Additional Discussions

"How should we communicate security controls and changes to our users? How do other Netskope customers do it?" These are questions we hear a lot, and the answer often is, "It depends."Here are some key factors to consider:Impact on Daily Operations: Will the change affect users' daily activities? Access Restrictions: Will users lose access to something they previously had? Policy Flexibility: Is your default policy open or restrictive, and how will this change affect the user experience—positively or negatively?It’s important to strike a balance between inundating users with minor regular change announcements, and notifying them when an impactful change is incoming. Many small changes won’t need this level of awareness.However, when users have access to something one day and lose it the next without warning, it can lead to frustration and a flood of support tickets—neither of which you want!So, how does Netskope handle it?At Netskope (Customer Zero), we notify our users about security

Hiv118 was available. How frequent will the client check of newer version? How can I manually trigger upgrade?thank

I recently encountered the below mentioned issue and would like to have better understanding of the same.I have collected advanced debugging logs from the users system, where in the option of “Start” for outer capture was disabled, still I collected the logs and those were as expected.However when I tried collecting the same logs from the tenant for that user, I observed the logs were different and some of the captures which were present in the previously collected advanced debugging logs from the system were missing in the logs collected from the tenant.Attaching the screenshots for reference:Events triggered for the date and time : 2024/07/17 14:47:00.213Logs collected from the tenant :Advanced debugging logs collected from the device for the same time :Need to understand why the captured even for the same timestamp are different.

If you work with Security Architects, SOC Engineer, or a SOC Analyst, all of them will tell you one thing “Send me ‘ALL’ the logs!” because their ability to find threats or investigate incidents is reduced without the log data or if the required log data is dispersed in various log data stores. If your chosen partner for cloud is Microsoft, then they will also tell you one more thing “Send it to Microsoft Sentinel!” If you happen to be a person responsible to fetch these logs from Netskope then it’s okay to establish feeling where you think the whole world is working towards making your life difficult. I can tell you one thing – I’m not one of them so let me explain why I think I’m the angel 👼 out there to save you ....! Let’s get some fundamentals out of our way: Cloud Exchange – it’s our integration platform to enable third party partner integrations. Packaged as a multi-container application. Modules - Cloud Exchange (CE) comes with four primary modules: Log Shipper, T

Hello,Driven by Netskope’s enrolment vulnerability, we want/need to move our Windows endpoints from UPN to IdP mode. Does anyone know if there is a way to use a script to change the existing configs of the already installed agents? Before we plan to uninstall and re-install all 10k agents, we would like to elaborate if there is another way by eg deleting/modifying an existing config file.Appreciate any feedback. Thanks,Nadja

The Netskope Client it password protected. Looking to see if any one has success with uninstaller scripts that will allow you to add those parameters to the scripts and do a clean uninstall

Overview Cloud Exchange CTE’s integration with Trend Micro Vision One gives you the ability to bilaterally share indicators of compromise (IOCs) in the form of URLs and file hashes. For example, if Trend Micro Vision One detects a suspicious object, you can configure an action to add it to Netskope’s blocked URL or file list.    Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CTE Trend Micro Vision One Setup Steps Trend Micro Vision One Find Region URL Create API Token Netskope Cloud Exchange Setup Netskope Plugins Netskope CTE Plugin Trend Micro Vision One CTE v1.0.1 or greater Create a Cloud Exchange Business Rule Create Sharing Configuration Sharing Hashes to Netskope Netskope  Create File Profile Policy Create New Malware Detection Profile Add file list to Netskope Real-time Protection Policy Verify Integration Verify Sharing of IoCs Trend Micro Vision One setup steps Fin

Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS) Netskope provides rich logs for all aspects of security and connectivity but sometimes you may not want so much detail on things like the device type or OS. For example, in our DLP logs, this is the information you would get on the device.             "category": "Cloud Storage",            "ccl": "low",            "device": "iPhone 6S Plus",            "os": "iOS  9.6",            "owner": "dte3831@test.netskope.com",            "policy": "policy_ga32",            "request_id": "2459149802892628500",            "scan_type": "Ongoing",            "site": "Verizon Media", Maybe you just need one of those fields.  In Cloud Log Shipper we can control which information is sent on to the destination by editing the mapping file. You can even have two destinations one with the full logs that you can send somewhere like an AWS S3 bucket for long term storage and then another one that you can send on to your SIEM that trims dow

Hello, we are attempting to enable/disable Netskope using the command line on MacOS and Windows. Previous discussions surrounding this provided solutions that are not working in my environment: For Windows:Restart the Netskope client through Task manager or ServicesFrom cmd (as admin): stagentsvc -stopFrom cmd (as admin): stagentsvc -start For Mac:Restart the Netskope client from a Mac terminal window> sudo launchctl unload /Library/LaunchDaemons/com.netskope.stagentsvc.plist> sudo launchctl load /Library/LaunchDaemons/com.netskope.stagentsvc.plist When running these commands in my environment, I'm met with the following errors in Windows and Mac respectively: Windows: "Command not found" or  'stagentsvc' is not recognized as an internal or external command, operable program or batch file.  Mac:   /Library/LaunchDaemons/com.netskope.stagentsvc.plist: No such file or directory Unload failed: 2: No such file or directory &

Using the LogShipper to send logs to my SIEM.  One application in particular is very chatty and the logs it sends are not that important.   I am trying to create a business rule that will exclude that application from sending logs.   Right now, I have the default rule and one additional rule: Query: NOT (app Like "My App").  This does not work, do I have to use Regex for this?  Documentation for business rules are really poor.

SentinelOne Netskope Direct Integration There are a few ways to integrate SentinelOne and Netskope. Netskope can send them logs with Cloud Log Shipper, Cloud Threat Exchange can pull URLs and IoC hashes from SentinelOne into Netskope, and with this direct integration. You can use the Netskope application in the Singularity Marketplace for enrichment. I will be going over this last one in this document.  Taken from https://community.sentinelone.com/Configure the Netskope App to enrich threats to centralize data into one threat and accelerate investigations. Correlate your Netskope alert data and user risk scores into the SentinelOne threat enrichment view. This lets you easily ingest events from Netskope into Singularity™ Data Lake.You can also trigger XDR Manual Response Actions in Netskope to minimize the potential expansion of an attack or compromise. These actions are available in the SentinelOne threats in the Management Console for a one-click response.PrerequisitesA Netskope Tena

Hello every one. One of my user concerned that the NS client log was keep getting created repeatedly.I found out when enter shortkey the client log bundle was created. In MAC OS, the short key that create log bundle is“COMMAND + CONTROL + L”  I tested myself that every time i press “COMMAND + CONTROL + L”  the client log is created in Desktop folder  But the difference between the user and me was that for my instance, entering shortkey with selecting something related to Netskope Client (like NS client configuration browser) create log bundle. The user was able to create log bundle with selecting something that is not related to NS Client. (enter shortkey when working in eclipse or chrome browser) Wondering why the user was able to create log bundle without selecting browser that is realted to NS client. Also i’m having difficulties to find how to disable/edit Netskope Client’s short key. 

With the updates to RBACv2 within the Netskope console, it adds Policy Groups.  As we investigate this feature and how best to utilize it, we are wondering how other Netskope teams are using them especially when you already have a fully developed policy list.

Hello everyone,I have a very annoying problem with my Netskope Steering configuration.Domain bypass exceptions don't work.For example, I need to access a site under development, which allows access via IP filtering. As this site is in our exceptions, we're normally supposed to be able to access it with our classic public IP, so I've added it to the exceptions.But despite this, we arrive on the site with a netskope IP (163.x.x.x), which prevents access to the site.I'm a bit stumped at this point...Do you have any ideas?Thanks!

HiFor the product update, were there recorded demo how those new features can be setup and tested?    There were 3 demos use cases, how about the rest features?  

Hello everyone,I've been pondering over a particular aspect of our SAML - Forward Proxy configuration and would appreciate some insights from the community. Specifically, I've noticed that the SAML Entity ID remains the same across all methods, whether it's IPSEC, GRE, Cloud Explicit Proxy, or Client Enrollment.This uniformity in SAML Entity ID across various methods has raised some concerns for me, particularly in relation to compatibility with Azure AD. As some of you may already know, Azure AD supports only a unique SAML Entity ID for each Azure AD tenant.Given this limitation, I'm curious about the rationale behind having a single SAML Entity ID for all methods within our SAML - Forward Proxy configuration. Has anyone encountered similar challenges with Azure AD integration due to this setup? If so, how have you addressed or worked around it?The goal is to only allow for the method “Client Enrollment” a specific Azure AD group. For that i will have two Enterprise Apps “Netskope Use

Did you know that using Netskope's powerful Cloud DLP and Microsoft Information Protection you can scan your M365 instance and identify sensitive data in order to classify it and label (or re-label) it to add the right context to the file metadata.   The high-level process to set up Netskope and MIP to label documents as sensitive is as follows:   In the MIP tenant, go to Classification and create a new label you want to apply to files with sensitive content. Publish the label to all users and groups. Select All under Users and groups. In the Netskope tenant, create a new API-enabled Protection policy. Under Actions choose IRM Protect > MIPand then the label you want to use. Alternatively if you wish to revise a MIP label based on the content, files that are already labeled by MIP can be scanned by the Netskope API-enabled Protection policy for sensitive content. If the policy detects sensitive content in the files, then the policy replaces the file label wit

We are looking for a way to deploy the Netskope Client for Windows using Jumpcloud and Okta as our IDP source. We’ve found a few articles for how to do this for macOS with Jumpcloud as the IDP but nothing for Okta.We’d like to set this up similar to our Kandji deployment for macOS where Okta serves as the identity provider. Has anyone had success with this? 

Can Someone Help We have a client Netskope installation v91.0.6.812 which i need to remove I have the password but the installer seems to be broken as it askes for the STAgent.msi "The Feature you are trying to use is on a network resource that is unavailable" I have tried other versions of the msi file but all fail.   Even the new installer we have gets stuck on removal of the old software, Tried all sorts, but cant get it off. Anyone have an idea or have the original v91.0.6.812 STAgent.msi to allow me to remove it ?   Derek  

It is often necessary to disable private app steering when a user is on premises. This can be accomplished by using Dynamic steering as documented https://docs.netskope.com/en/dynamic-steering.html   On-premises detection is required for Dynamic steering and the Netskope client can detect that it is on-premises either by resolving a DNS A record to IP address or by probing an HTTP server.   NOTE: The host probed by on-premises detection should never be steered through Netskope Private access neither explicitly or by wildcard. This will result in unwanted behaviour.   In this article I will explain how you can use nginx to host a service which can be probed for on-prem check. As per the Netskope documentation for HTTP, the HTTP server must return 200 OK response code to determine if the device is on-premises.   nginx is an open source highly performant and scalable HTTP and reverse proxy server which can easily be used to perform this function. There are ma

Hi all,After a couple years, we finally finished revamping most of our Traffic Steering documentation making them more user friendly! The revamp project consisted of:Adding missing content Updating any best practices, guidelines, and requirements Breaking up articles Fixing content structure for usability Adding new screenshots and network diagramsPlease let us know if you have any feedback.You might be wondering, what about the IPSec and GRE integration guides? Those are next!Thank you to everyone who has sent feedback on these articles!

Registration links to join Netskope Cloud Exchange 5.0 webcast that will air in different global time zones Feb 27-29.Join next week’s webcast on Netskope Cloud Exchange for your Zero Trust JourneyLeverage Your IT Security Stack with Netskope Cloud Exchange 5.0Come learn how the Netskope Technical Alliance team has improved our technology partner integration platform, Cloud Exchange. The new capabilities further extend the value of the security ecosystem at stopping threats together.Great work by David Willis, Gary Jenkins, Agasthiamani Sankaran NAM - February 27th - 10am EST | Noon CST | 1pm ESTEMEA  - February 28th - 10 am GMT | 11 am CETAPAC - February 29th - 10:30 am IST| 1:00 pm SGT | 4:00 pm AEDT

With dynamic steering and on-premise detection enabled, I want the ability to see who is reporting as “remote” vs “on-premises” from the tenant/console. This would be good data for tracking, incident response, troubleshooting, etc.  I’ve been unable to find a data point in the tenant in relation to this. Does anyone know if it is available (short of having end-users manually confirm via Configuration)?

HiIn the Steering Configuration and Client Configuration, I can only select OU or AD User Group.Using OU or AD User Group are inflexibleExample for testing purpose, unable to select AD users from different AD user group for testing since there was no AD user group for these selective users. can’t just test for 1 user.  WIll have to create AD user group for for 1 user Select by device.  I may have multiple devices login using the same account.  I will want the test steering and client configuration for test devices.  My corp device will not take effect.Is it possible to select by individual AD user or by device?  thank

PLS ASSIGN ASE TO APAC TSE FOR SAME TIMEZONE======================================================= HiWe encountered lot of device having upgrade and rollback error.  How do I remediate the issue back to usable state?thankMunster