DLP

Anyone concerns about Email draft can not be detected by Netskope?On App Catalog it says “Create, Edit, Post, Send” support DLP.On the Application Events, ObjectID can successfully be fetched and we also can clearly saw the activities and content through DevTools.However, DLP policy is not triggered but the action is recorded.We also created a support case on this but L3 support responded and claimed it should be related to SMTP DLP module. We are curious if anyone else has encountered this and have similar concern as we do. 

Are there any planned integrations with Cyera for data classification label usage in DLP policies?Does anyone have experience with this product and use case?Thanks

Is it possible to create a dashboard representing what actions an analyst has taken on a DLP “file” incident?The analyst can “Change File Permissions” with a dropdown of actions and/or “Contact Users”.Our analysts don’t assign the incidents or resolve them they just take actions since we use a separate case management system.  I’d like to report on actions taken and the incidents/files that were associated to the action.

When we first evaluated Netskope, visibility into non-org accounts within the Outlook desktop application was a known gap due to the application being certificate pinned. I recall that other vendors we evaluated were able to enforce DLP controls on other Outlook accounts, but these vendors often excelled in Endpoint DLP and leveraged more “legacy” approaches as opposed to Netskope’s reliance on the forward proxy.We currently block non-org accounts in the Outlook desktop app, but the allowance of client accounts within Outlook is a frequent request from our team users. With Netskope’s newer ventures into the Endpoint DLP space, are there any new or future-anticipated abilities to enforce DLP controls over these Outlook accounts/other certificate-pinned applications? 

Hello all,I’m looking for recommendations/examples of global default DLP policies.Currently, my organization has a default block policy at the bottom of the tenant for categories that we’ve deemed to have no business use case (weapons, security risk, etc) or to be risky for usage (cloud storage, social media, etc.).In a similar fashion, I’d like to have DLP rules at the bottom of the tenant to act on web traffic before Netskope allows it through. I’ve done some testing with just outright blocking any activities that could be used to exfil data (upload, post, send, edit, etc.) and very quickly ran into issues, and example being background traffic for the Microsoft Edge browser being classified as upload and resulting in a large number of user notifications. I’m currently working through using app tagging to exclude any standard user applications from this policy.Given that not all websites have support for DLP, I’d ultimately like the behavior to be “If the website supports DLP, check t

Policy:Block Upload DLP Source Code Description:In this example we will prevent sending emails (Gmail) with files that contain "source code" in their content. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Saw this but it doesn’t have clear info on how we can set identifier for different attributes of printer. https://docs.netskope.com/en/constraint-profile/ Does anyone know how to regulate the printer yet?

Policy:Block Confidential Word ChatGPT Description:Policy to prevent sensitive data from being entered into ChatGPT Video:Leandro Timotio de LimaCustomer Success ManagerLinkedin

Chief Evangelist, Bob Gilbert, performs a live demo of Train Your Own Classifier, which is Netskope’s groundbreaking solution that puts the power of AI in the hands of customers. Anyone deployed on the Netskope platform with advanced data protection can now train AI/ML models using their own unique corpus of data.  

We are working towards implementing a rule that looks for plaintext credentials within shared documents. In doing so, we’ve utilized the Passwords (contextual) pre-defined entity. We’ve noticed that this entity is catching teams and zoom meeting passcodes. We do not want to catch these passcodes in the rule and are trying to create a “not near” advanced expression. I’m looking for guidance on how to perform this. For example here is what we have: P1 = Passwords (Contextual)D5 = Custom Dictionary of words like “meeting”, “teams”, “zoom”, etc… Both options we’ve tried: 1.) ( P1 AND ( NOT ( P1 NEAR D5 ) ) )2.) (P1 AND NOT (P1 NEAR D5)) Any help would be appreciated.  

Hello Team, I want to set a policy which can hide some parts of datas (for example credit card numbers) during download/upload processes. (For example If I download document, I want card numbers become like 1111 xxxx xxxx xxxx )Is Netskope able to do this?Note: My question is not answered in this link  https://docs.netskope.com/en/dlp-entity/#entity-obfuscation-1  Thank you in advance,

I am trying to determine when a DLP Rule needs to leverage the NEAR operator versus the AND operator. In one example incident, a DLP Rule defined as (P1 NEAR P2) appears to have been triggered when the two entities were over 10,000 characters apart.What is the default value of the AND operator, is it truly more than 10,000 characters?

 Hello everyone! I hope you're all doing well. I'm currently exploring how to set up an OCR DLP detection policy on Netskope for our organization's security needs. Could anyone provide guidance or step-by-step instructions on configuring such a policy? Any insights, tips, or best practices would be greatly appreciated. Thanks in advance for your help!

I have been digging through documentation but have been unable to find an answer on this specific SMTP Proxy DLP issue.  We currently use Netskope DLP to cover network exfiltration and endpoints (USB, etc), and we’re testing Netskope’s SMTP Proxy DLP.  For some reason, we’re unable to get Netskope to trigger on DLP violations in the message body.  It always catches content in attachments, but if I paste the exact same test content in the message body (SSN, CC, etc) it fails to trigger a violation.  Is this by design, or am I missing something in the config?  Thanks

Hello, I have a file containing records in this format: 2022.03.18 11:46:45 DEBUG web[XXXXXXXX][auth.event] login success [method|BASIC][provider|REALM|ldap][IP|10.10.10.10|10.10.10.10:55637][login|XXXXXX]I used this regular expression to detect private IP addresses: (10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.1[6-9]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.2[0-9]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(172\.3[0-1]{1}[0-9]{0,1}\.[0-9]{1,3}\.[0-9]{1,3})|(192\.168\.[0-9]{1,3}\.[0-9]{1,3})Using this regular expression, I can't detect any IP addresses in the file sent through netskope. What can I do and where is the problem?

Hello Team,I read Netskope has data masking ability but I couldn’t find enough details about it. Is there any detailed document about this feature? And how can I create a policy about data masking? Thank you in advance! 

I see application events pertaining to Cloud Storage with an Activity of sync_item_content, but I can’t filter on that activity, or see it in the list of all activities. Am I missing something?What I would like to do is use it in a DLP policy to identify files being synced to personal cloud storage instances. Thx  

Has anyone been successful in making the DLP work while using preview Copilot in the Windows 11? I don’t see the traffic alerts/page events in the SkopeIT. My assumption is it is using msedgewebview2.exe websocket which means Netskope is not capable of doing MiM inspection? Thanks.

I have request from customer to limit file size for upload in WeChat Windows desktop up. Limit size is 25 MB. I created File profile for File Size and include all Types, but doesn’t work well, I have notification action is blocked, but file is uploaded. If someone have idea how to solve that problem, please help me.

Seeking some assistance with API Data Protection Policies.Looking to leverage ‘User Profiles' so that API policies will only trigger on a subset of users. From what I can see, user profiles only allows importing the full user identity. Is there a way to set up domain wildcards so that it trigger for all users of a domain e.g. *@domain.com? Note: Currently using Classic API data protection policies for M365.Is this something that will be addressed with the Nextgen API? 

we are planning to migrate existing proxy solution of an organization from  McAfee to Netskopeif any one have any prerequisite please suggest  

Can we set policy like before sending the sensitive data across the other domain get a approval notification to manager , and if manager approves it then user can share the data?? 

Hello, i was informed that to utilize the Netskope Endpoint DLP protection, it is required to have SWG Professional license as well to use with Endpoint DLP. I’ve been looking for a statement for the requirement but unable to find out. I just would like to understand why it is required such combination? One reason that i can think of (correct me if im wrong) is due to communication to the tenant would require SWG license.

Wondering if anyone has taken advantage of a synthetic data generation tool like K2View or Gretel and integrated with Netskope for use in identifying and whitelisting synthetic data elements versus production data? This comes into play with companies developing code and processing sensitive data types. Thx

We want to trigger different action f for medium and HIgh Severity  for a UK NINO ProfileFor Medium   we want user justification need to be triggered and for high we want to block need to be triggered