Additional Discussions

Overview Cloud Exchange CTE’s integration with Trend Micro Vision One gives you the ability to bilaterally share indicators of compromise (IOCs) in the form of URLs and file hashes. For example, if Trend Micro Vision One detects a suspicious object, you can configure an action to add it to Netskope’s blocked URL or file list.    Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CTE Trend Micro Vision One Setup Steps Trend Micro Vision One Find Region URL Create API Token Netskope Cloud Exchange Setup Netskope Plugins Netskope CTE Plugin Trend Micro Vision One CTE v1.0.1 or greater Create a Cloud Exchange Business Rule Create Sharing Configuration Sharing Hashes to Netskope Netskope  Create File Profile Policy Create New Malware Detection Profile Add file list to Netskope Real-time Protection Policy Verify Integration Verify Sharing of IoCs Trend Micro Vision One setup steps Fin

Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS) Netskope provides rich logs for all aspects of security and connectivity but sometimes you may not want so much detail on things like the device type or OS. For example, in our DLP logs, this is the information you would get on the device.             "category": "Cloud Storage",            "ccl": "low",            "device": "iPhone 6S Plus",            "os": "iOS  9.6",            "owner": "dte3831@test.netskope.com",            "policy": "policy_ga32",            "request_id": "2459149802892628500",            "scan_type": "Ongoing",            "site": "Verizon Media", Maybe you just need one of those fields.  In Cloud Log Shipper we can control which information is sent on to the destination by editing the mapping file. You can even have two destinations one with the full logs that you can send somewhere like an AWS S3 bucket for long term storage and then another one that you can send on to your SIEM that trims dow

Hello, we are attempting to enable/disable Netskope using the command line on MacOS and Windows. Previous discussions surrounding this provided solutions that are not working in my environment: For Windows:Restart the Netskope client through Task manager or ServicesFrom cmd (as admin): stagentsvc -stopFrom cmd (as admin): stagentsvc -start For Mac:Restart the Netskope client from a Mac terminal window> sudo launchctl unload /Library/LaunchDaemons/com.netskope.stagentsvc.plist> sudo launchctl load /Library/LaunchDaemons/com.netskope.stagentsvc.plist When running these commands in my environment, I'm met with the following errors in Windows and Mac respectively: Windows: "Command not found" or  'stagentsvc' is not recognized as an internal or external command, operable program or batch file.  Mac:   /Library/LaunchDaemons/com.netskope.stagentsvc.plist: No such file or directory Unload failed: 2: No such file or directory &

Using the LogShipper to send logs to my SIEM.  One application in particular is very chatty and the logs it sends are not that important.   I am trying to create a business rule that will exclude that application from sending logs.   Right now, I have the default rule and one additional rule: Query: NOT (app Like "My App").  This does not work, do I have to use Regex for this?  Documentation for business rules are really poor.

SentinelOne Netskope Direct Integration There are a few ways to integrate SentinelOne and Netskope. Netskope can send them logs with Cloud Log Shipper, Cloud Threat Exchange can pull URLs and IoC hashes from SentinelOne into Netskope, and with this direct integration. You can use the Netskope application in the Singularity Marketplace for enrichment. I will be going over this last one in this document.  Taken from https://community.sentinelone.com/Configure the Netskope App to enrich threats to centralize data into one threat and accelerate investigations. Correlate your Netskope alert data and user risk scores into the SentinelOne threat enrichment view. This lets you easily ingest events from Netskope into Singularity™ Data Lake.You can also trigger XDR Manual Response Actions in Netskope to minimize the potential expansion of an attack or compromise. These actions are available in the SentinelOne threats in the Management Console for a one-click response.PrerequisitesA Netskope Tena

Hello every one. One of my user concerned that the NS client log was keep getting created repeatedly.I found out when enter shortkey the client log bundle was created. In MAC OS, the short key that create log bundle is“COMMAND + CONTROL + L”  I tested myself that every time i press “COMMAND + CONTROL + L”  the client log is created in Desktop folder  But the difference between the user and me was that for my instance, entering shortkey with selecting something related to Netskope Client (like NS client configuration browser) create log bundle. The user was able to create log bundle with selecting something that is not related to NS Client. (enter shortkey when working in eclipse or chrome browser) Wondering why the user was able to create log bundle without selecting browser that is realted to NS client. Also i’m having difficulties to find how to disable/edit Netskope Client’s short key. 

With the updates to RBACv2 within the Netskope console, it adds Policy Groups.  As we investigate this feature and how best to utilize it, we are wondering how other Netskope teams are using them especially when you already have a fully developed policy list.

Hello everyone,I have a very annoying problem with my Netskope Steering configuration.Domain bypass exceptions don't work.For example, I need to access a site under development, which allows access via IP filtering. As this site is in our exceptions, we're normally supposed to be able to access it with our classic public IP, so I've added it to the exceptions.But despite this, we arrive on the site with a netskope IP (163.x.x.x), which prevents access to the site.I'm a bit stumped at this point...Do you have any ideas?Thanks!

HiFor the product update, were there recorded demo how those new features can be setup and tested?    There were 3 demos use cases, how about the rest features?  

Hello everyone,I've been pondering over a particular aspect of our SAML - Forward Proxy configuration and would appreciate some insights from the community. Specifically, I've noticed that the SAML Entity ID remains the same across all methods, whether it's IPSEC, GRE, Cloud Explicit Proxy, or Client Enrollment.This uniformity in SAML Entity ID across various methods has raised some concerns for me, particularly in relation to compatibility with Azure AD. As some of you may already know, Azure AD supports only a unique SAML Entity ID for each Azure AD tenant.Given this limitation, I'm curious about the rationale behind having a single SAML Entity ID for all methods within our SAML - Forward Proxy configuration. Has anyone encountered similar challenges with Azure AD integration due to this setup? If so, how have you addressed or worked around it?The goal is to only allow for the method “Client Enrollment” a specific Azure AD group. For that i will have two Enterprise Apps “Netskope Use

Did you know that using Netskope's powerful Cloud DLP and Microsoft Information Protection you can scan your M365 instance and identify sensitive data in order to classify it and label (or re-label) it to add the right context to the file metadata.   The high-level process to set up Netskope and MIP to label documents as sensitive is as follows:   In the MIP tenant, go to Classification and create a new label you want to apply to files with sensitive content. Publish the label to all users and groups. Select All under Users and groups. In the Netskope tenant, create a new API-enabled Protection policy. Under Actions choose IRM Protect > MIPand then the label you want to use. Alternatively if you wish to revise a MIP label based on the content, files that are already labeled by MIP can be scanned by the Netskope API-enabled Protection policy for sensitive content. If the policy detects sensitive content in the files, then the policy replaces the file label wit

We are looking for a way to deploy the Netskope Client for Windows using Jumpcloud and Okta as our IDP source. We’ve found a few articles for how to do this for macOS with Jumpcloud as the IDP but nothing for Okta.We’d like to set this up similar to our Kandji deployment for macOS where Okta serves as the identity provider. Has anyone had success with this? 

Can Someone Help We have a client Netskope installation v91.0.6.812 which i need to remove I have the password but the installer seems to be broken as it askes for the STAgent.msi "The Feature you are trying to use is on a network resource that is unavailable" I have tried other versions of the msi file but all fail.   Even the new installer we have gets stuck on removal of the old software, Tried all sorts, but cant get it off. Anyone have an idea or have the original v91.0.6.812 STAgent.msi to allow me to remove it ?   Derek  

It is often necessary to disable private app steering when a user is on premises. This can be accomplished by using Dynamic steering as documented https://docs.netskope.com/en/dynamic-steering.html   On-premises detection is required for Dynamic steering and the Netskope client can detect that it is on-premises either by resolving a DNS A record to IP address or by probing an HTTP server.   NOTE: The host probed by on-premises detection should never be steered through Netskope Private access neither explicitly or by wildcard. This will result in unwanted behaviour.   In this article I will explain how you can use nginx to host a service which can be probed for on-prem check. As per the Netskope documentation for HTTP, the HTTP server must return 200 OK response code to determine if the device is on-premises.   nginx is an open source highly performant and scalable HTTP and reverse proxy server which can easily be used to perform this function. There are ma

Hi all,After a couple years, we finally finished revamping most of our Traffic Steering documentation making them more user friendly! The revamp project consisted of:Adding missing content Updating any best practices, guidelines, and requirements Breaking up articles Fixing content structure for usability Adding new screenshots and network diagramsPlease let us know if you have any feedback.You might be wondering, what about the IPSec and GRE integration guides? Those are next!Thank you to everyone who has sent feedback on these articles!

Registration links to join Netskope Cloud Exchange 5.0 webcast that will air in different global time zones Feb 27-29.Join next week’s webcast on Netskope Cloud Exchange for your Zero Trust JourneyLeverage Your IT Security Stack with Netskope Cloud Exchange 5.0Come learn how the Netskope Technical Alliance team has improved our technology partner integration platform, Cloud Exchange. The new capabilities further extend the value of the security ecosystem at stopping threats together.Great work by David Willis, Gary Jenkins, Agasthiamani Sankaran NAM - February 27th - 10am EST | Noon CST | 1pm ESTEMEA  - February 28th - 10 am GMT | 11 am CETAPAC - February 29th - 10:30 am IST| 1:00 pm SGT | 4:00 pm AEDT

With dynamic steering and on-premise detection enabled, I want the ability to see who is reporting as “remote” vs “on-premises” from the tenant/console. This would be good data for tracking, incident response, troubleshooting, etc.  I’ve been unable to find a data point in the tenant in relation to this. Does anyone know if it is available (short of having end-users manually confirm via Configuration)?

HiIn the Steering Configuration and Client Configuration, I can only select OU or AD User Group.Using OU or AD User Group are inflexibleExample for testing purpose, unable to select AD users from different AD user group for testing since there was no AD user group for these selective users. can’t just test for 1 user.  WIll have to create AD user group for for 1 user Select by device.  I may have multiple devices login using the same account.  I will want the test steering and client configuration for test devices.  My corp device will not take effect.Is it possible to select by individual AD user or by device?  thank

PLS ASSIGN ASE TO APAC TSE FOR SAME TIMEZONE======================================================= HiWe encountered lot of device having upgrade and rollback error.  How do I remediate the issue back to usable state?thankMunster

Hi All. We are trying to setup SCIM  with netskope and facing below error:-If we unbind the idp group from Netskope SSO app, the user is removed from Netskope but the idp group remains in Netskope and is orphaned with no association.Binding the idp group to SSO app again,this association doesn't work but user is synced over to Netskope with no group assignments.If we remove all the members from a group provisioned by idp in Netskope(via GUI) .Again provisioning that group gives a error saying (group already exists ) .(groupid being returned is different)Do we have any limitation from Netkope such as idp provisioned groups should not be managed through Netskope GUI?Could anyone help me this. 

Hello, I am looking for the hardware requirements for the Netskope client. For PCs, and mobile devices. how much memory?how much drive space? CPU? etc. Can anyone assist ?

When I go to the Community Events page, anyone else getting a calendar that just hangs trying to list events? Stay current on Netskope's events lineup. 

Hello, I have a rather annoying problem with my Netskope Windows and MAC OS clients: the configuration update is done randomly. On the clients, the config update sometimes happens, only to fail.Looking in the DEBUG log, and running nsdiag -u in the STAgent, I get these errors: 2024/01/23 09:52:52.456 nsdiag p5684 t58fc info ConfigSync.cpp:32 CConfigSync check for configuration update started 2024/01/23 09:52:52.472 stAgentSvc p1c08 t23e8 error config.cpp:8081 Config failed to download config version 2024/01/23 09:52:52.472 stAgentSvc p1c08 t23e8 error config.cpp:9509 Config [sessId 1] failed to download config version. 2024/01/23 09:52:52.472 nsdiag p5684 t58fc error nsdiag.cpp:1707 CNSDiag Failed to check for configuration updates. I have no output firewall filtering, and I have no proxy or PAC proxy in my environment.Do you have any suggestions for me? Thanks!

Hi Team, Can we configure the NS agent with PAC where PAC file automatically updated in to the user machine or is there any manual work we need to do. Please let me know the architecture for both On-premise and roaming user We need NS with PAC or anything NS with E proxy or workaround. i know explicit proxy over client./Netskope Client Split proxy with EPOC. Please let me know how i can and what are there pre-requisites.

Does anyone know if after install, the client can be changed to not update from the Portal?During install the switch autoupdate=on was used and now we would like to revert to "off". Is there a way to do it other than reinstall the agent? I know how to limit from the Portal itself but for my needs I want to know if there is a way to revert the autoupdate=on feature after installed.