DLP

Your one stop shop for all things Netskope Data Loss Protection.

  • 63 Topics
  • 102 Replies

63 Topics

C
Chris_BowmanNew Member
asked in DLP

Tuning False Positives for Real-Time Protection DLP Policies.

We have been leveraging the inline DLP policies for over a year, and have struggled to “tune” the policies for false positives for PCI, PII, GLBA rules. Curious for feedback from the community no how you tune your rules/classifier etc to weed out false positives.. Our current route/solution we are looking at is excluding “sites” that generate the majority of the false positive hits. Example: Walmart is notorious for flagging carts with Names of brands next to the item number for SSN & US Names..Any and all feedback is welcome - thank you so much in advance!!

0
C
5 months ago
M
munster
asked in DLP

DLP Password Protected User Alert

Hi I saw this KB Alert/block upon detection of password protected files - Netskope Knowledge PortalHow can we set "user alert" action for coaching? thankMunster

1
ejang
Netskope Employee
5 months ago
Indu
Netskope Partner
InduNetskope Partner
asked in DLP

DLP: PCI & PII tests failed on netskopesecuritycheck.com

Hi Team,We configured DLP for all categories with PCI and PII DLP. However, on netskopesecuritycheck.com, DLP PCI and PII block tests are failed. Has anyone had success with these tests? Can you please share the DLP policy configuration that has passed?  Thanks & Regards,Indu

3
Indu
Netskope Partner
5 months ago
F
fbrunnerNew Member
posted in DLP

Dashboard for user USB file transfer activity (EP-DLP)

Wondering if anyone is aware of an existing dashboard to keep an eye on allowed USB file activity.  We're looking to see a line-up of the top users uploading content (regardless of it triggering a DLP event) to USB devices.  I've tried piecing something together, but the fields don't appear to be available in Advanced Analytics.

1
G
6 months ago
Natedog0024
Natedog0024New Member
posted in DLP

DLP in RTP with Traffic Direction Issue?

Hello,I have a policy setup to block uploads to a specific instance of an application when any DLP profile matches otherwise alert via the traffic direction functionality in the RTP. This has been working fine for a while. Today, I went to add additional instances and when I had the user test, it was still being blocked, completely bypassing that rule and going to my default deny, its not matching DLP because if it was, it would be blocked by the policy I am talking about, its sliding right by my rule... I tried a separate RTP at the top with just the instance configured the same way with no luck. The only way I could get it to work was to remove the DLP profiles.The specific instance I was testing with was a third instance that was sharepoint.Has anyone seen this?Nate 

2
Natedog0024
6 months ago
Edison_VaLbuena
Netskope Partner
Edison_VaLbuenaNetskope Partner
posted in DLP

DLP Regex Dictionary

Hello,Does anyone have an example in a Dictionary csv file to add to Netskope with keywords that you want to analyze?Thank you so much.

1
R
Netskope Employee
7 months ago
M
Netskope Employee
MM_NSNetskope Employee
posted in DLP

Credential detection and Netskope Predefined Identifiers.

  Netskope has various built-in (aka predefined) DLP identifiers to detect passwords, public keys, private keys and base64 encoded data.   While you can write a regex to detect passwords in your environment, I have highlighted some of the challenges here: Regexes can cause DoS and False positives (at a customer site who has a dedicated team to write regex their complain was email in a string being detected as passwords). There is no single password standard that would work for all the environments. The key sizes are varied length.   Best approach for a credential detection policy Use Exact Match capability to identify username of AD account exfiltration Use Netskope's built-in identifiers rather than writing complex regex. Use Custom Entity validator to validate your test data with a corresponding Netskope predefined identifier. Note: You do not have to create a custom entity. Just for the validation purpose call a predefined identifier under a custom entity.  

4
E
7 months ago
G
GiacomoNew Member
posted in DLP

netskope mobile with microsoft defender

Good morningI need to install on my enterprise mobile devices the Netskope client.On these devices the Microsoft Defender client is installed with VPN already active.I noticed from the logs that the netskope client fails to hook the Vpn because it sees the Defender VPN tunnel already activeCan any exceptions be set so that the two tunnels are active?Thanks

0
G
8 months ago
R
rfletcherNew Member III
posted in DLP

EDM_automation.py

Has anyone used the edm automation script that was talked about in conjunction with DLP 2.0? I've seen it referenced but i can't seem to find how to execute it. I have a daily edm file that gets uploaded and i'm looking for the best method to automate the request-ppd upload process.

0
R
8 months ago
A
amityadavNew Member
posted in DLP

Endpoint DLP suporting WIFI Printer

Hi Friends- can we utilize endpoint dlp in netskope to inspect/allow WIFI printers .

1
jwilson
Netskope Employee
8 months ago
hhamza
Netskope Partner
hhamzaNetskope Partner
posted in DLP

Telegram and Whatsapp for DLP Alerts

Hi,  We have a real time policy to trigger alerts for any DLP violations for Chat & Other IM Categories. We have however not been successful in getting any alerts with DLP profiles on. I would like to know if DLP works on Telegram and Whatsapp for users that's accessing these apps via browser. I have noticed from the CCI that some of the activities are not supported. Happy to hear your thoughts on the same if you had a similar use case. Thanks!

1
qyost
8 months ago
R
rfletcherNew Member III
asked in DLP

SMTP DLP

Anyone using the new SMTP DLP functionality? If you are, how are you doing your alerting to users about blocking/intercepting emails? 

7
R
8 months ago
A
Alan4NetskopeNew Member III
asked in DLP

YouTube In Bytes Uploaded

We are just getting started with the Advanced Analytics and one of the 1st reports we were asked to run is Top Uploads for the past 7 days.  Report ran great and is full of useful data.  One area I cannot figure out though is Uploads to YouTube.While I do not believe we have "content creators" uploading while at work, the data is still questionable.  Searching the web for info all leads back to uploading a video.  I did find YouTube does have tracking capabilities beyond cookies. Looking at just one user at our corporate office, showed only around 1Mb of data uploaded.   This is more inline with what I found online with the tracking.  The top user for the week was around 805Mb.  So not  “content creator” I would think, but makes me wonder just how much tracking is going on.This top user also had 60 hours of viewing time.  (To be addressed separately) But could the tracking account for 805Mb?Anyone else seeing this an

2
A
9 months ago
F
Netskope Partner
Felipe_PachonNetskope Partner
posted in DLP

DLP profiles for LATAM

Hello,We’re looking for some information regarding PII regulation profiles equivalent to GDPR but customized for the LATAM requirements or regulations.Do we have predefined profiles for this region?

2
A
10 months ago
aplaza
Netskope Employee
aplazaNetskope Employee
posted in DLP

Demo - Train Your Own Classifier

Chief Evangelist, Bob Gilbert, performs a live demo of Train Your Own Classifier, which is Netskope’s groundbreaking solution that puts the power of AI in the hands of customers. Anyone deployed on the Netskope platform with advanced data protection can now train AI/ML models using their own unique corpus of data.  

0
aplaza
Netskope Employee
10 months ago
M
MmaroofNew Member
posted in DLP

Questions on MIP Labelleling for One Drive

I have a few questions related to Netksope MIP integration. I looked around but did not get any concrete answers. Does Netskope require the customer to provision an Azure subscription or similar services when applying MIP labels to OneDrive files?  From what i understand , we only need the M365 licence ? Is the timestamp of a OneDrive file altered when Netskope applies a label? - This is important for our org to ensure that we dont modify the file timestamp. Is Netskope's file labeling service charged separately, or is it included with the standard Office 365 protection license? - I'm guessing there is no extra charge. Are there any restrictions on the number of files that can be labeled within a specific period by Netskope? - This is something our security team is asking and would love to know if there are any known limitations 

1
M
Netskope Employee
10 months ago
F
freestlzExplorer
posted in DLP

We have been unable to deploy Endpoint DLP

We have been unable to deploy Endpoint DLP. Having the same issues with different versions and the newest 1408. A good number of Managed devices on reboot disable the usb devices like mouse, keyboard, and printers. Has anyone been able to successfully deploy Endpoint DLP protection?I currently don't have any device control policies but do have quite a few Content Control policies.Any help would be appreciated.

6
C
10 months ago
T
Netskope Partner
thomasmichaelNetskope Partner
posted in DLP

Netskope DLP when posting on ChatGPT

I have few alerts triggered for the policy that I have created for DLP related policy when user post on ChatGPT.However, I am unable to know the exact reason why the alert was flagged. Also, I cannot view the content/part of the content of the post that was considered as a DLP violation. How and where can I view these details? Regards,Thomas

4
S
Netskope Employee
11 months ago
V
vramnarayanNew Member
posted in DLP

DLP policy flow - Continue Policy Evaluation

Netskope's real-time protection provides a plethora of access-controls to enforce data security. Starting from R96, Netskope has standardized the function of "Alert and Continue policy evaluation" on all tenants. This feature would allow Netskope Cloud to continue evaluating Real-time policies for additional DLP violations, instead of terminating and exiting policy evaluation after a match.   This function would help influence the sequential processing of real-time protection policies based on specific configuration and thereby evaluating & matching against multiple DLP profiles and rules.Refer to the PDF document to know more about the policy flows and behavior.   https://docs.netskope.com/en/netskope-help/netskope-release-notes/netskope-cloud-release-notes/netskope-release-notes-hotfix-version-96-1-0/new-features-and-enhancements-in-hotfix-release-96-1-0/#UUID-76b0e39c-45b3-eb8c-0049-b6222ae411e5_section-idm4583494220057633155495922816 Document Authors - @vramnarayan &a

0
V
11 months ago
farhan
Netskope Partner
farhanNetskope Partner
posted in DLP

Email DLP flow

Hi Team I want to ask some Netskope question I just checked one configuration of Netskope SMTP proxy where we can see there are two connector connector 1 office 365 to partner and the second connector from your organization to O365. So why we required your organization in second connector. Also from MS team when they are tried to select Your organization they get and error of licensing but same licensing part is working for another please let us know.

0
farhan
Netskope Partner
11 months ago
Indu
Netskope Partner
InduNetskope Partner
asked in DLP

DLP is not working for CSV, TXT, JPG & PNG

Hi Community Team, A DLP policy with PCI-DSS profile is placed as top-rule to identify sensitive information in upload & download activities. It is working as expected only with DOCX files. This policy is not working with CSV, TXT, JPG & PNG files. When uploading CSV/TXT files, the policy is not even being hit. I would like enquire with Netskope community if anyone has noticed such issue and how they fixed it. Thanks.

5
R
Netskope Employee
11 months ago
Indu
Netskope Partner
InduNetskope Partner
posted in DLP

DLP with Facebook Messages IS NOT Working

Hi Community Team,Working Scenario: When we upload or download sensitive data (Credit card, CVV & email) with TXT, CSV & DOCX files to Facebook & LinkedIn, then Netskope DLP is alerting fine with PCI-DSS, DLP-PCI & DLP-PII profiles.Working Scenario: when we type & send sensitive data (Credit card, CVV & email) in LinkedIn Messages, then that message is being alerted (fine). LinkedIn Message DLP alert is showing Activity as POST and Object type as Message.Failed: However, When we type & send sensitive data (Credit card, CVV & email) in Facebook Messages, then it is not being blocked or alerted. We are expecting the action to be POST and activity should be Message or anything. However, Facebook Message sensitive data share action is not visible in Application Events, Alerts and Page Events.Below screenshot is the policy. Has anyone noticed this issue? If yes, please suggest the fix.Thanks. 

0
Indu
Netskope Partner
11 months ago
M
Netskope Employee
MM_NSNetskope Employee
posted in DLP

Resolve Multiple DLP Incidents using Netskope Incident Dashboard

Did you know that you can use Netskope DLP Incident dashboard to manage up to 100 Incidents at a time?   -Incident Dashboard allows you to use SkopeIT query to find Incidents by status or date range or severity or even incident number. (Sample query at the bottom of this page)   -You can change status of all incidents displayed on the page at once (You can expand page size to up to 100 per page from the drop down at the bottom right of the dashboard) Steps to find and resolve multiple incidents:   1. In the incident dashboard menu click the "Filter Search" funnel icon. (this icon switches between normal and query mode)   2. Enter a query using the "in" operator as shown for 2 incidents below. You can also add a custom status for filter e.g. if you want to omit incidents with status 'Resolved - Policy Updated' from the search. Note that incident numbers are included in single quote separated by comma) SkopeIT query: (dlp_incident_id in ['863060765611108610','82034833

0
M
Netskope Employee
1 year ago
Indu
Netskope Partner
InduNetskope Partner
asked in DLP

SMTP Relay Backend Error On Verifying Email Domain

Hi Netskope Community,We are following below admin guide & KB (both are same) for configuring Netskope SMTP proxy with MS O365 exchange.https://support.netskope.com/s/article/Configure-Netskope-SMTP-Proxy-with-Microsoft-O365-Exchangehttps://docs.netskope.com/en/configure-netskope-smtp-proxy-with-microsoft-o365-exchange.htmlWe encountered a backend error and see the attachment for error message screenshot.1. Has anyone encountered the same issue?2. What is the root casue for this issue?3. What is the fix to get rid of the error message?Thanks & Regards,Indu

3
msouza
Netskope Employee
1 year ago
F
Fao55New Member
posted in DLP

Netskope DLP Multi-language Detection

Hello All,I'm hoping someone can help me. I am just trying to find out if Netskope has a language pack (Spanish, French, etc...) or the capability to detect DLP incidents in various languages, similar to how Symantec/Broadcom can. If so, can someone point me in the right direction of the setting in the tool? If not, can someone tell me if this capability is on the Netskope roadmap for the future? Thanks in advance! 

3
msouza
Netskope Employee
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings