Discussions

I am using out of the box AA reports and i have no idea what this is trying to tell me:  

Merge Query allows you to combine data from different data collections, which helps you perform advanced analysis based on different data sources.Let’s take a look at a sample use case - identifying the device info of users triggering DLP alerts. While DLP alert data is stored in our Alerts data collection, device info is stored in a different place, the Devices data collection. To combine data from these two different data collections, Merge Query can help. To get started, simply create a widget that lists users triggering DLP alerts.  Once the widget is saved to the dashboard, select “Explore from here.” This will direct us to the “explore” mode of this widget.On the top right corner, click the gear button and select “Merge results.” We will then be able to select a second data collection. Let’s select “Devices.”    Next, let’s pick the data fields we need. Since we’re looking to combine DLP alert data with device info based on users, we select “User,” “Device ID,” and “Hostname” her

There are 4 typical types of widget errors in Advanced Analytics Type 1: Incompatible DataWhen the data type selected is not supported by the visual type, this error shows up. For example, when “# Users” is selected with the “Google Maps” visual, the widget cannot be loaded since this visual does not work without a “location” data field.To fix this, simply add a “location” data field, e.g. “Source Location,” to the widget. Type 2: Incompatible Visual TypeWhen the visual type selected cannot render the data, this error shows up. For example, if we use a pie chart to show a list of users based on their event count, the widget cannot be loaded since this visual can only display a maximum of 50 rows of data.To fix this, simply switch to a different visual type, e.g. table. Type 3: Query ErrorWhen your custom fields are misconfigured, a query error shows up.To fix this, check your custom fields and make sure they are configured correctly with no error message showing up. Type 4: Server/Plat

Hello,I’m having an issue with a Netskope Client on a windows machine and I would like to reinstall the agent but unfortunatelly I don’t remember the password configured for antitampering. As the NsClient is not connecting to the tenant changing the antitampering password is not an option. What else could I do to reinstall the NsClient on the user machine. 

OverviewThe integration of Netskope SD-WAN with Microsoft's SSE solution facilitates inspection of internet bound originating from SD-WAN branches/VNETs destined for internet applications routed through Microsoft's SSE solution.This guide encompasses a step by step guide to connecting Netskope SD WAN appliances to Microsoft's SSE solution, specifically for SaaS/internet applications. Microsoft Entra Internet Access traffic, alongside Microsoft Entra Access, are integral components of Microsoft's SSE solution: Global Secure Access. Microsoft Entra Internet Access ensures secure access to internet and SaaS apps, providing robust protection for users, devices, and data against internet-borne threats. This document focuses on the Internet Access use case. In this guide, you will be creating an Internet Protocol Security (IPSec) tunnel between a Netskope SD WAN Appliance, at your remote network and the nearest Global Secure Access endpoint. All internet-bound traffic is routed through the c

I had a user change her last name which changed her email address. It appears the JAMF “plist” is not updating. I checked Netskope and her updated name and email address is synced with SCIM. I can manually send the Netskope client invite to the user and everything works as expected. When the Netskope client is deployment through JAMF it appears the “plist” has the users previous email address which will not work. It appears everything on the Netskope side is updated and correct. Has everyone experience this issue? Is there a JAMF “plist” reset? Thanks.

We’ve observed that several websites either take a long time to load or fail to load entirely when Netskope is enabled. However, the same sites work smoothly once Netskope is disabled. Since the issue is intermittent and not easily reproducible, identifying the root cause has been challenging.A recent example involved LinkedIn Sales Navigator, where some users reported the site not loading. Upon analyzing HAR logs, we noticed that the licdn.com domain was significantly delayed when Netskope was active.We tested a couple of solutions, both of which proved effective for different user sets: Implemented an SSL Do Not Decrypt (DND) rule for the licdn.com domain Assigned a client configuration policy with MTU set to 1494 for affected users We’ve encountered similar issues with other services such as AWS S3, MoveInSync, and Box Notes (for box we have identified boxcdn  domain that is taking time).How can we systematically troubleshoot and resolve such issues where Netskope inspection inter

Cloud security is a shared responsibility, and for organizations leveraging both Netskope and Amazon Web Services (AWS), the synergy between these platforms creates a robust defense. A significant advancement in this partnership lies in plans for Netskope to ingest OCSF-formatted, cloud security findings directly from AWS Security Hub. This integration is pivotal, as it allows Netskope to correlate its determination of user risk and access and the workloads they use to then unleash its inline protection capabilities when called for. By understanding the security posture of AWS environments through Security Hub's comprehensive insights, Netskope can dynamically adjust its enforcement, preventing access to compromised resources and ensuring that only secure interactions occur within the cloud. Netskope's Zero Trust Network Access (ZTNA) solution plays a critical role in this dynamic security model, providing a secure and adaptive way to connect users to workloads and services hosted in A

I have just started a new company.We have brand new Cisco Cat 9500 and 9300 MGig switches. With Netskope installed on our computer have run a speed test and getting 100Mbps connected to the Internet with Netskope enabled.  With Netskope disabled we are getting speeds of up to 700Mbps connected to the internet. Is there a reason why this is so slow, has it got to do with deep packet inspection? Can anything be done to speed this up? I am new to Netskope and our security team are in charge of this. 

Seamless Log Shipping: Unlocking Netskope’s Native Integration with Microsoft SentinelIn today’s security landscape, visibility and real-time insights into your organization’s data are critical for effective threat hunting and incident management. To meet these needs, Netskope has developed a native integration with Microsoft Sentinel using the Codeless Connector Platform—allowing organizations to easily stream all CASB alerts, DLP incidents, and threat logs into Microsoft’s cloud-native SIEM. This blog explores how this new integration simplifies log shipping and delivers a scalable, cost-efficient way to leverage Microsoft Sentinel without deploying additional infrastructure like Cloud Exchange. Why This Matters for Security TeamsSecurity teams are constantly battling an increasing volume of threats while juggling multiple tools and platforms for managing data and incidents. Many enterprises use Microsoft Sentinel for incident response and threat hunting, but previously, getting comp

 Basically I want to write a report for the # of users of AI applications, including public Chat GPT  vs the Corporate ChatGPT (which is only available via authentication but on the Internet) I have added it as an app in the Steering Configurations and it shows up separately as an App in SKOPEIT, but I can’t add it to the catalog category.  Is the answer to add a custom web Category and generating enough traffic for page events?

Hi all,While attempting to install the Netskope agent using the provided BAT file, I encountered the following error:"Failed to save enrollment tokens"In addition, when retrying the process, I also receive the following error in the enrollment window:"Configuration download failed. Please authenticate again."Steps I have already taken: Ran the BAT file as Administrator Verified proper network connectivity Attempted the installation on a different machine  note:install mode IDP thanks

Hello,As part of an initiative to raise awareness of the digital impact within our organisation, we would like to set up a Netskope dashboard to identify web uses with a high carbon impact.Objective:To produce consumption indicators relating to user access to sites considered to have a high environmental footprint, including:Video streaming platforms, Social networks, Sites with high bandwidth or high data consumption rates.Do you already have dashboards on this topic?How can we do this? Identify the categories of applications/sites available in Netskope that correspond to these uses; Create or adapt a dashboard enabling us to: Monitor consumption (time, data volume, frequency of access, etc.) by site category; Isolate uses with a presumed high environmental impact; 

HiAnyone has issue with Device “Last Event” status not up-to-date despite it was ONLINE 24x7?The only time the status get updated when windows reboot.  Then the status again never get updated.All the windows systems have this issue.  Thank  

Hello  I’m trying to workout the impact of enabling RBI for the following categories uncategorised, New registered Domain, no content but need to workout how many alerts these categories have triggered to assess the risk on enabling RBI. Anyone have a AA Dashboard on users alerts/ domainsThank you 

When using Advanced Analytics, you don’t have to create everything from scratch. Our existing dashboards are always great starting points for your use cases. You can easily save widgets from existing dashboards to your own dashboards by following these steps:Step 1: Find the widget you need from the existing dashboard Step 2: "Explore" the widget Step 3: Save the visual to an existing dashboard Or save it as a new dashboard 

Seamless Log Shipping: Unlocking Netskope’s Native Integration with Microsoft SentinelIn today’s security landscape, visibility and real-time insights into your organization’s data are critical for effective threat hunting and incident management. To meet these needs, Netskope has developed a native integration with Microsoft Sentinel using the Codeless Connector Platform—allowing organizations to easily stream all Netskope Web Transaction Logs into Microsoft’s cloud-native SIEM. This blog explores how this new integration seamlessly pulls in near real time all of your organizations Web Transactions to a single Log Analytics table.  Architecture In this architecture data is pushed from Netskope to the customer Storage Blob Container. Every time a file is written either containing Web Transactions or Netskope Alerts and Events a blob notification is sent to Event Grid. Once the notification is seen by Event Grid, the blob URI is then sent to a storage Queue so the Scuba workers (Microso

How to Download all Marketplace Apps grouped for Teams