Skip to main content

Netskope Global Technical Success (GTS)

App Instance Awareness: How to Restrict Public Access for Generative AI Apps

 

Netskope Cloud Version - 122

 

Objective
This document provides step-by-step instructions to help our customers block public app instances for different Generative AI apps.

 

Details

When configuring app instances for cloud applications, ensure that Netskope supports app instance awareness, as it does not support instance awareness for all Gen AI applications.

 

Steps to Configure

Please follow the instructions for each step to better understand the implementation.

Step 1: Need to Create App Instance

Step 2: Verify App Instance Awareness

Step 3: Create App Instance

  • Create App Instance (Manually)
  • Create App Instance (Automatically)

Step 4: Block Public App Instance

Step 5: Allow Corporate/Specific App Instances

Step 6: Result

 

Step 1: Need to Create App Instance

To meet the requirement of controlling access to generative AI applications, you need to create an app instance in Netskope and configure specific access policies. The goal is to block all public instance IDs, such as Gmail.com, Yahoo.com, Outlook.com, Hotmail.com, and iCloud.com, which are associated with widely accessible generative AI tools. This ensures that users cannot interact with these external, potentially unsecured applications. Instead, you will allow only corporate-approved instance IDs, eg:- netskope.com, to be accessible. This can be done by setting up an app instance for the corporate instance in the Netskope platform and applying security policies to block traffic to the public instances

 

Step 2: Verify App Instance Awareness

  1. Select category “Generative AI” to view all the supported Gen AI applications.

Path: Netskope UI Home >>> CCI >>> Cloud Apps >>> Category Generative AI] >>> “Search”

 

AD_4nXeMMKG9wn1ApRORBh_jkbInxjTQn5jyw7OV4O8Ym5nNP7u18O5nlVsZ5KZgL3xdf5rxAV6RPvG0DSgrZBRLVU0Q4dFnvnvm7Mv-tw_p3YaBQbbeYtQNsLJjxWanFqRhw2tTykYXUA?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

You will find the List of generative AI Applications.

AD_4nXckUDoSdikIOhypSZmivUHHjGuG0zMRsuAZUaj9-LpayWMep9lG65bbWgcPYwNDrTHjUol2V0DMTXYFts7NTS3vlGiDzSpQuA2HOtyEcKYSi-rPgOOmTi_eXxZc-PbzajM6-EPxyQ?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Or, simply search for the app name you are looking for eg - ChatGPT, Google Gemini etc.

 

  1. Select the appropriate app - In our example we will take Google Gemini, ChatGPT & OpenAI

Search for the above app and confirm the app instance support by viewing the details.

 

AD_4nXcVVpeXSA50BidgEipDXE0BautMVYkj27EkGVbWbM1lcmyj79By93QERFEV_x11XUaUo5XZsorLmS00gNfgPkFjzq55eTNGU4mJqLYSxs-C8jRYS2MD_2lpdOl8R61gc5pFVJXaqQ?key=EYDf0_-KVlKIj-Y2TfBanlIW


In our example - All the three Applications (Google Gemini, ChatGPT & OpenAI) support App Instance Awareness.

 

Step 3: Create App Instance

  1. Create a new custom app instance 

Path: Netskope UI Home >>> Policies >>> Profiles >>> App Instance 

Netskope offers two options to create an app instance:

  • New App Instance - Manually
  • From Skope IT - Automatically

AD_4nXfHT_lHT3OlILvDbqgG6-gljlY912xYK4P0jKRg_jyV2RGCMdj24Mbh6CR6L8qx5wamVfgyulCvut-eSGvGoXfFlD4XV9jT-_0dY4R83YQjFhg7FKCqwIBghNxT1p1y2lRApE8n?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Create App Instance (Manually)

Select “New App Instance”, you will need to provide the following information:

  • Application
  • Instance ID
  • Instance Name
  • Instance Tag

AD_4nXemyZySDF7xcGV__eD2LNqHlkoRYUSDoHK_krtqzZIpVjR7etmQVizQ0vm3qseQMDCA8aA1h2Tzh9AhEs5lTxddwVkZRdhWd1CppEOfnazwbwOvng1vZqAP9kUIhEzkdH2qQw3XrA?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Create App Instance (Automatically)

Select “From SkopeIT” a screen prompt will be show: “TAKE ME TO APP EVENTS”

AD_4nXfmu7VW_HvCcasDnkyCoiW6PKJUaWa21LKGrLxZSZfVj6-tFPoyOmidgXbVOx-GF_QpqMUcaV5iOC5kTCXe-ytn2NmtsXlZqiNtHGF8BD2c0swd4XXVjmBV91CJ0f0IB3ouX8UY?key=EYDf0_-KVlKIj-Y2TfBanlIW 

 

This will take you to the Application events where you can filter the traffic for an application to find the corporate instance.

Example: Google Gemini application which shows is being accessed from “netskope.com” which is a corporate instance ID.

AD_4nXewM7MinY8qrgEdbOO8vZwK3adLVUvXEw9d5nTdk2i9uTnRTioP8cZn7JJqyly-1C8eZqYnejQHXLT-fRYN6Y1-K5wYagt6Rgb_SwwgPQNd411fX3Co-LYFu-ST4zs_E-mPxk1s?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Viewing the details for this event will show you an option to create an instance automatically after detection.

AD_4nXeeExeyIBOEghtfZ5iINjbeHi08lhsos_goqjqXSeIR5VwLGOP56WgkPpHy9qg89TBqLUXqbkwOlPbLYRzYckvEKHNCp3txpszNCe-cL_yIvDUjttiswz1eQ-BJtMGD0e_bncP0?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

After selecting the “New App Instance”

You only need to provide the following information (the rest will auto-populate):

  • Instance Name
  • Instance Tag

 

AD_4nXcJl44QZWB4MibVJPICPSCZmSjCkPl28_tFBwY3UafdpcjcJ92AMbGyTL68fxyxcoPnwC1AYlZ4bqhpB9Op22sJwFQ5u9YyuuqBn80ttKvvWwpCnPpeBVmrpPZ68aEHY12rtJvelw?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Your corporate instance for Google Gemini has been successfully created. Similarly, you can review application events for other applications and create new app instances as needed.

 

Step 4: Block Public App Instance

To restrict the access for the public app instance you will need to create a block policy  for the Gen AI applications:-

Navigate:
Path: Netskope UI Home >>> Policies >>> Real Time Protection >>> New Policy >>> Cloud App Access

Select all the cloud applications you wish to restrict and map the associated activities.

 

Note: You can expand "View Activity Support" by clicking, to get clarity on which activities are supported by each selected application when multiple applications are chosen.

 

Set Action to “Block”

AD_4nXfYkwCJYsHkwGE1ARjE44LT4e-GAjv9CcO6ckLvDfOT3Qy8HN0Zj3dc0EpoYi7Fn9JfbvLLO8y7ChsEdIYIWyS_g060OYVB2Fk5rdW7_E2KcH5JxuYqtOQsGKx-hbPFTyVbs7IsNg?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

 

Step 5: Allow Corporate/Specific App Instances

To allow access through a specific app instance to the blocked Gen AI applications, you will need to create a new policy above the block policy created in the previous step.

 

Navigate:
Path: Netskope UI Home >>> Policies >>> Real Time Protection >>> New Policy >>> Cloud App Access 


AD_4nXejmtCU4mMKd1q_GHtxG9GtLLhEo_ujgcM6Qw1kyou7y8W5Znv5KhoW7BshYmkBIAKT4Nt2DwBIbGLsq8YZpjGVRmvlN7nYyDdIq-x7Uao7PTsysWyy_faMwYGUv8FrhqgeGnBFRg?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Destination: 

  • Select App Instance
  • Add App Instances created in previous steps.
  • Select the desired activities.

 

Action:

  • Set to “Allow”

The Generative AI Allow policy - Which allow only specific App instances and activities.

AD_4nXc92JCtGL4n59NyNS3uoNJ5YYrealFWPh9-cDvJiUjuTxxQKG5n8Di1wk5gZwBNbrFrjNM0jckBot3i2KeQ0T__LgTB5TkwfzYPVrsPSwpbEuIVCh5Pzw7MbHSVhR8uZUsBfF3nwQ?key=EYDf0_-KVlKIj-Y2TfBanlIW

Results

We can notice that access is restricted in such a way that only a specific, pre-defined app instance is permitted to function. All other app instances that are not defined (i.e., random or public instances) are blocked, ensuring that only authorized and controlled instances are allowed access to Gen AI Applications. This helps secure the environment by limiting potential risks from unknown or untrusted sources.

 

ChatGPT

AD_4nXcojuHeV0S4CgG_WXmeTLBedFG_nBhvq6_JueyysNK1Qvt_5qJRnZB0F3dt9S4pH2HPFci72ENIlmem62DAXTZK-Gtft0Nm47L1v7t3K9CrTfh09QbzmYSGIyxco47N2AiglYChWw?key=EYDf0_-KVlKIj-Y2TfBanlIW


 

Google Gemini

AD_4nXcmFtxfWhUjxtmVLXGzwT7wyABWtOWMLRu-ytbutQBDdHejvkjFSQlcnzKLhleEondnol62Xf_Z5iv3LHL19-JFAXMTp7v8kTGa3jpaP84S1UwijTeDe2B9XtE7vhC-hzc7cOWY?key=EYDf0_-KVlKIj-Y2TfBanlIW

 

Terms and Conditions

  • All documented information undergoes testing and verification to ensure accuracy.
  • In the future, If any such platform changes are brought to our attention, we will promptly update the documentation to reflect them.

 

Notes

  • This article is authored by Netskope Global Technical Success (GTS).
  • For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.
  • You can follow the same approach to create instances for other applications and manage access restrictions.