Skip to main content

DLP

Your one stop shop for all things Netskope Data Loss Protection.

  • 85 Topics
  • 157 Replies
85 Topics
J
jschueleNew Member III
asked in DLP
Last Event time 55 years ago

Since deploying the latest golden release of the NS client (v126.0.0.2387) the Last Event field for all systems shows 55 years ago. Is this going to be fixed? 

161
V
Netskope Employee
Rohan Panda
Netskope Partner
Rohan PandaNetskope Partner
asked in DLP
File transfer limit for USB Feature request

We have created a policy for USB content control with size limit 50 mb.Issue faced here is if i share file of 40 MB and another of 15 mb it get shared.Use case is we want to restrict complete data transfer over 50 mb not file size The file size limitation is enforced per file, not per session. What we are observing is the expected behavior by design. If your expectation is for Netskope to track the cumulative file size uploaded within a session , for example, a user uploads a 40 MB file at 10:00 AM and then another 15 MB file 15 seconds later, totaling over 50 MB , this functionality is currently not supported.

180
Rohan Panda
Netskope Partner
D
deepak kashyapNew Member
asked in DLP
Challenge with Netskope DLP: Blocking Responses to External Emails

As a customer facing company, we regularly receive booking-related emails from customers and partners that contain Personally Identifiable Information (PII) such as passport numbers, ID documents, and travel itineraries. To prevent external data leakage, we’ve implemented Netskope DLP to monitor outgoing emails for PII. However, we’re facing a challenge: When our employees reply to incoming emails (even without including any PII in their response), Netskope DLP still quarantines those replies. This is because it detects the original PII from the customer’s message in the reply thread. We want to understand if there’s a way to configure DLP policies so that it only quarantines emails that are originated internally and contain PII, and not block replies to incoming messages that happen to include previously received PII. Is there a solution or best practice to achieve this behavior?

240
D
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in DLP
Understanding Netskope DLP’s Approach to Language Support and Keyword Detection

I understand that Netskope’s DLP supports multiple languages and offers high detection accuracy. Could you please share whether the keyword matching inspection is performed using external libraries, or if Netskope uses an in-house developed engine?If external libraries are being used, would it be possible for you to disclose information about them?I am particularly interested in how Netskope has addressed challenges such as multilingual support and detecting word boundaries accurately.

200
Maho Fujino
Netskope Partner
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in DLP
Unexpected Match in Email Address Detection Policy Using Regular Expression

When creating a policy to detect email addresses, I used the following regular expression:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}However, the string "csv test" triggered a detection, even though it does not contain an "@" symbol and therefore should not match the expression above.Is there any limitation or specific behavior in how regular expressions are interpreted on the Netskope side that might explain this?

532
Maho Fujino
Netskope Partner
rodborges
Netskope Partner
rodborgesNetskope Partner
asked in DLP
DLP Support for Claude.AI and Perplexity.AI

Hi, Some customers asked about DLP support for Claude.AI and Perplexity.AI.They are on the roadmap? If so, there’s any estimate on when will it be available? Regards,Rodrigo Borges

686
Rohit_Bhaskar
Netskope Employee
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in DLP
Regarding the definition of "activity"

What is the definition of "Formpost," which is one of the activity types?

382
V
Netskope Employee
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in DLP
Email Draft Activity Should be Monitored by NGSWG DLP?

Anyone concerns about Email draft can not be detected by Netskope?On App Catalog it says “Create, Edit, Post, Send” support DLP.On the Application Events, ObjectID can successfully be fetched and we also can clearly saw the activities and content through DevTools.However, DLP policy is not triggered but the action is recorded.We also created a support case on this but L3 support responded and claimed it should be related to SMTP DLP module. We are curious if anyone else has encountered this and have similar concern as we do. 

1218
AllenWu
Netskope Partner
J
jschueleNew Member III
asked in DLP
Data Classification integration with Cyera

Are there any planned integrations with Cyera for data classification label usage in DLP policies?Does anyone have experience with this product and use case?Thanks

301
S
Netskope Employee
J
Jason_grochowskiNew Member
asked in DLP
Manual Actions taken on DLP incidents dashboard

Is it possible to create a dashboard representing what actions an analyst has taken on a DLP “file” incident?The analyst can “Change File Permissions” with a dropdown of actions and/or “Contact Users”.Our analysts don’t assign the incidents or resolve them they just take actions since we use a separate case management system.  I’d like to report on actions taken and the incidents/files that were associated to the action.

663
J
S
SakeeNew Member III
asked in DLP
DLP for Outlook Desktop App

When we first evaluated Netskope, visibility into non-org accounts within the Outlook desktop application was a known gap due to the application being certificate pinned. I recall that other vendors we evaluated were able to enforce DLP controls on other Outlook accounts, but these vendors often excelled in Endpoint DLP and leveraged more “legacy” approaches as opposed to Netskope’s reliance on the forward proxy.We currently block non-org accounts in the Outlook desktop app, but the allowance of client accounts within Outlook is a frequent request from our team users. With Netskope’s newer ventures into the Endpoint DLP space, are there any new or future-anticipated abilities to enforce DLP controls over these Outlook accounts/other certificate-pinned applications? 

1852
T
C
crimsonNew Member
asked in DLP
Default Global DLP Policies Best Practice?

Hello all,I’m looking for recommendations/examples of global default DLP policies.Currently, my organization has a default block policy at the bottom of the tenant for categories that we’ve deemed to have no business use case (weapons, security risk, etc) or to be risky for usage (cloud storage, social media, etc.).In a similar fashion, I’d like to have DLP rules at the bottom of the tenant to act on web traffic before Netskope allows it through. I’ve done some testing with just outright blocking any activities that could be used to exfil data (upload, post, send, edit, etc.) and very quickly ran into issues, and example being background traffic for the Microsoft Edge browser being classified as upload and resulting in a large number of user notifications. I’m currently working through using app tagging to exclude any standard user applications from this policy.Given that not all websites have support for DLP, I’d ultimately like the behavior to be “If the website supports DLP, check t

2030
C
Leandro Timotio de Lima
Netskope Employee
Leandro Timotio de LimaNetskope Employee
published in DLP
(VIDEO) Block Source Code Upload to Email

Policy:Block Upload DLP Source Code Description:In this example we will prevent sending emails (Gmail) with files that contain "source code" in their content. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

2101
A
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in DLP
Device Control: Printer Identifier Format

Saw this but it doesn’t have clear info on how we can set identifier for different attributes of printer. https://docs.netskope.com/en/constraint-profile/ Does anyone know how to regulate the printer yet?

933
AllenWu
Netskope Partner
Leandro Timotio de Lima
Netskope Employee
Leandro Timotio de LimaNetskope Employee
posted in DLP
(VIDEO) Prevent Sensitive Data From Being Sent to ChatGPT

Policy:Block Confidential Word ChatGPT Description:Policy to prevent sensitive data from being entered into ChatGPT Video:Leandro Timotio de LimaCustomer Success ManagerLinkedin

2060
Leandro Timotio de Lima
Netskope Employee
aplaza
Netskope Employee
aplazaNetskope Employee
posted in DLP
Demo - Train Your Own Classifier

Chief Evangelist, Bob Gilbert, performs a live demo of Train Your Own Classifier, which is Netskope’s groundbreaking solution that puts the power of AI in the hands of customers. Anyone deployed on the Netskope platform with advanced data protection can now train AI/ML models using their own unique corpus of data.  

3381
A
K
kdibbleNew Member III
asked in DLP
Not Near Best Practices

We are working towards implementing a rule that looks for plaintext credentials within shared documents. In doing so, we’ve utilized the Passwords (contextual) pre-defined entity. We’ve noticed that this entity is catching teams and zoom meeting passcodes. We do not want to catch these passcodes in the rule and are trying to create a “not near” advanced expression. I’m looking for guidance on how to perform this. For example here is what we have: P1 = Passwords (Contextual)D5 = Custom Dictionary of words like “meeting”, “teams”, “zoom”, etc… Both options we’ve tried: 1.) ( P1 AND ( NOT ( P1 NEAR D5 ) ) )2.) (P1 AND NOT (P1 NEAR D5)) Any help would be appreciated.  

2189
A
EsraDemircioglu
Netskope Partner
EsraDemirciogluNetskope Partner
asked in DLP
I want to hide some parts of datas

Hello Team, I want to set a policy which can hide some parts of datas (for example credit card numbers) during download/upload processes. (For example If I download document, I want card numbers become like 1111 xxxx xxxx xxxx )Is Netskope able to do this?Note: My question is not answered in this link  https://docs.netskope.com/en/dlp-entity/#entity-obfuscation-1  Thank you in advance,

852
N
S
SakeeNew Member III
asked in DLP
AND Operator Value in DLP Rules

I am trying to determine when a DLP Rule needs to leverage the NEAR operator versus the AND operator. In one example incident, a DLP Rule defined as (P1 NEAR P2) appears to have been triggered when the two entities were over 10,000 characters apart.What is the default value of the AND operator, is it truly more than 10,000 characters?

842
S
Netskope Employee
V
vedNew Member
asked in DLP
OCR DLP Detection

 Hello everyone! I hope you're all doing well. I'm currently exploring how to set up an OCR DLP detection policy on Netskope for our organization's security needs. Could anyone provide guidance or step-by-step instructions on configuring such a policy? Any insights, tips, or best practices would be greatly appreciated. Thanks in advance for your help!

11262
AllenWu
Netskope Partner
F
fbrunnerNew Member III
asked in DLP
Netskope SMTP Proxy - Scanning O365 Email Body contents

I have been digging through documentation but have been unable to find an answer on this specific SMTP Proxy DLP issue.  We currently use Netskope DLP to cover network exfiltration and endpoints (USB, etc), and we’re testing Netskope’s SMTP Proxy DLP.  For some reason, we’re unable to get Netskope to trigger on DLP violations in the message body.  It always catches content in attachments, but if I paste the exact same test content in the message body (SSN, CC, etc) it fails to trigger a violation.  Is this by design, or am I missing something in the config?  Thanks

661
F
A
ArijNew Member
asked in DLP
DLP - Detect IP addresses in a log file

Hello, I have a file containing records in this format: 2022.03.18 11:46:45 DEBUG web[XXXXXXXX][auth.event] login success [method|BASIC][provider|REALM|ldap][IP|10.10.10.10|10.10.10.10:55637][login|XXXXXX]I used this regular expression to detect private IP addresses: (10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.1[6-9]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.2[0-9]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.3[0-1]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(192\.168\.[0-9]{1,3}\.[0-9]{1,3})Using this regular expression, I can't detect any IP addresses in the file sent through netskope. What can I do and where is the problem?

715
S
Netskope Employee
EsraDemircioglu
Netskope Partner
EsraDemirciogluNetskope Partner
asked in DLP
How do I create a policy for data masking?

Hello Team,I read Netskope has data masking ability but I couldn’t find enough details about it. Is there any detailed document about this feature? And how can I create a policy about data masking? Thank you in advance! 

1532
EsraDemircioglu
Netskope Partner
J
jschueleNew Member III
asked in DLP
sync_item_content not in activity list

I see application events pertaining to Cloud Storage with an Activity of sync_item_content, but I can’t filter on that activity, or see it in the list of all activities. Am I missing something?What I would like to do is use it in a DLP policy to identify files being synced to personal cloud storage instances. Thx  

950
J
1
11qwerty22New Member
asked in DLP
Detection of DLP post in Windows 11 / Copilot

Has anyone been successful in making the DLP work while using preview Copilot in the Windows 11? I don’t see the traffic alerts/page events in the SkopeIT. My assumption is it is using msedgewebview2.exe websocket which means Netskope is not capable of doing MiM inspection? Thanks.

5786
1

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings