Discussions

I am working on something that I my brain should be so simple but i am just missing something. We have blocked DeepSeek from our environment. What I have been asked to deliver is a 90-trending report showing Access Allowed, Access Blocked over a 90-day period in a trend line. I am using the #Blocked Events but calculating the Allowed is getting it to show the trend line is where I am having issues.  Thanks for help! 

Hello Community,is it normal that the data in AA is delayed? Sometimes the latest event is from an hour ago, sometimes two?Best regards

Has anyone had any luck with Syslog integration from Cloud Exchange into Darktrace?Darktrace describes the expected format like this:Darktrace expects the Netskope Web Gateway data to include the string "darktrace_netskope" followed by a JSON formatted representation of the Netskope logging. The order of fields within the JSON is not important. For example: darktrace_netskope {"src_time": "Fri Jan 1 00:10:00 2021","userkey": "user.name@company.com","dst_region": "Region","category": "Business","src_longitude": 52.2,"transaction_id": 0,"ur_normalized": "user.name@company.com","src_latitude": 0.12,"dst_longitude": 52.2,"domain": "www.example.org","dst_zipcode": "555555","access_method": "Client","src_timezone": "Global/UTC","ccl": "unknown","bypass_reason": "SSL policy matched","user_generated": "yes","dst_country": "ZZ","srcip": "198.51.100.1","site": "example","traffic_type": "Web","src_region": "Region","user": "user.name@example.org","appcategory": "Business","page_id": 0,"insertion_

Hi everyone,I'm reaching out to see if anyone has encountered a similar situation or has suggestions for our use case.We’re using Network Locations in Netskope to control the traffic of specific servers to the internet. These Network Locations are allowed to access only a limited set of URLs, and we apply a DND (Do Not Decrypt) policy to this traffic because we don’t want to decrypt it.The challenge we’re facing is that when the DND policy is applied, we lose visibility of the "Total Bytes" metric for all connections originating from this Network Location.Has anyone dealt with this issue before? Is there a way to retain the Total Bytes visibility while keeping the DND policy in place?Thanks in advance for your insights and help!

Hi Folks,Apologies if this is a simpleton question, however it’s doing my head in. I have the api working and am able to use the dataexport endpoint to extract malware alerts. My issue is that I only receive one record in the response and I know there is 115 in the time period of the search. The record I receive is the very first in the results. I can confirm that by checking in the console.My (hopefully simple) question is what is the format of the api query to iterate through the results so that the full list can be retrieved? I’ve tried ?operation=next&index=(the index name supplied in the first query). However that returns an empty response.I’d appreciate any guidance.Regards,Campbell

I saw the article on support for the Netskope Client on iPad. When I use the email invite though there is link for the iOS Client, only the iOS Profile. I see a note about this issue, but don’t understand what it wants me to do. How do I enable the default email template? I’m sure I changed it years ago, but can’t remember where.. Can someone clarify how I get it visible in the email invite?– If you are unable to see the link to download Netskope Client for iOS in the email invite, use the default email template that includes the link to download Netskope Client for iOS. 

We have Policy schedules set on several policies to force re-evaluation of access periodically.  Do others use these?   Has anyone created an Advanced Analytics report or alert that can be set to proactively notify you when these time windows are coming due?

Hello all,I am looking at creating reports to help identify bandwidth utilisation for customer sites.  We want to identify what applications and sites are generating the most traffic.  If the previous product it was simple to filter based on a location (which is a way to reference the IPsec tunnels used to connect a site to the cloud).  Netskope seems to be less location focused.  Ideally I would like to filter a widget or Dashboard using a filter that is a list of the IPsec Tunnels.  Is there a simple way to do this?I can filter based on countries, but the customer has multiple sites in some countries. The source locations reference towns or cities that do not match up with the customer site. In France the even have multiple sites in the same city. Filtering by IP CIDR allows only filtering by a single CIDR network. It is not possible to filter based on a defined network location. The only solution I have at the moment is the source egress public IP address.  This works as it clearly

Can the Netskope client be installed for iOS (iPad) without using Intune? I need to install it for one device. If so, are there instructions? Thanks. 

Hello Folks,  Below you can find a recap of questions asked at the August office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any recommended “getting started” dashboards for new users?A: The CASB & NG-SWG Dashboards are designed to help you maximize the ROI of your Netskope CASB investment by highlighting ways to fully utilize Netskope’s features. This dashboard includes to-do lists, recommendations, and best practices, making it valuable for leadership reporting. It also helps you understand if your controls are working effectively by showing trends and showcasing the value of your team’s work.The Security Health Check (Self-Service) Dashboard offers a comprehensive self-service tool for performing health checks and identifying security concerns or gaps in your environment. It covers two main dim

Hi, team! I created a bunch of widgets with really useful data but I'm unable to find order by fields to avoid a bar graph with a roller-coaster look. Any help would be great!

Hello Folks,  Below you can find a recap of questions asked at the July office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Are there any AI specific reports that are new in the last 2-3 months? A: The updated AI Usage Dashboard. This dashboard displays AI usage within a customer environment and highlights any controls that are in place to manage AI traffic. A major update to this dashboard includes the Application Instance widget, which uses a Sankey chart to clearly illustrate the traffic flow of AI app usage. You can dive into the widgets for more detailed insights. Q: Where is the data source of the AI Usage Dashboard residing?A: The data for the AI Usage Dashboard is sourced from Application Events, which syncs data from Netskope Skope IT. For more information, you can refer to the Application Events Intro

Has anyone else ran into issues with the Advanced Analytics attmpting to pull informaiton for 90 days?  I’m attempting to pull reports for the previous quarter, but i’m running into charts that appears to be missing information going back that far.   

Hello Folks,  Below you can find a recap of questions asked at the June office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: What are the benefits of using Advanced Analytics?A: Advanced Analytics enables you to gain valuable insights and present them effectively to your leadership. It provides visibility into your environment, helping you understand how Netskope is protecting you. With Advanced Analytics, you can identify risks in your environment and learn how to address them. To get started, refer to Advanced Analytics Training Resources. Q: How to accurately report on user activities with Advanced Analytics?A: There are several ways to do this. One effective method is to utilize the Netskope Library dashboard resources. You can search “user” in the dashboard name search bar or select the “Users” tag. The User

HiWe have users in “All Users” group in Client Configuration.  They are password protect from client installation.However, I have to issue the password to 1 user to uninstall password which means all other users can also uninstalled with this password.  Is there anyway just generate 1 time password for that user to uninstall without having to share the actual “password ptotect client uninstallation”? thx

Within AA page events, is there a way to have multiple CIDR?  I heard that commons work, I heard that you can add the field multiple times, but neither seems to work for me.  Screenshot attached.

I’m curious if Netskope platform audit log data can be exported using Advanced Analytics or put on the road map? It would be helpful to generate reports for events such as Create/Delete Admins, tunnel modifications, and other events.  This arose from a recent PCI audit (looking forward into PCI 4.) where logs related to VPN access must be reviewed (and eventually ingested into SIEM or similar platform to search for anomalies) and immediately searchable up to 90 days and stored for 1 year.  Thanks!

Does anyone know where the Netskope root certificate needs to go in Windows to use the explicit proxy? I assume it needs to go in the certificate store but is there a location? Thanks. 

In Advanced Analytics Application Events, it is possible to list out the primary category and the “other category” of sites”.However, page events does not have the “other category field” Questions: Is there any plan to bring these to into parity? Is there any other way to get the primary/secondary categories as it relates to a page events, or do I have to wait until Tenant version 116  new feature API and do a conversion manually?

Hello Folks,  Below you can find a recap of questions asked at the April office hours session and those sent in that we were not able to cover during the session. Feel free to comment and continue the discussion, as well as attend future sessions that can be found on the Community Events Calendar! Q: Can I get visibility into geolocation data in Advanced Analytics?A: Absolutely. We have 3 main use cases on geolocation data:PoP Usage Dashboard: This dashboard provides insights into Netskope Host Points of Presence (PoPs) detected in your environment, along with users connected. It helps you identify un-allowed PoP usage.  # Consecutive Days Outside a Specific Region Dashboard: This dashboard returns the number of consecutive days a user's source country is outside a designated region. Use this dashboard to monitor and manage sensitive data movement outside the user’s assigned region. Office Locations Dashboard: Use this dashboard to gain insights into whether individuals within your org