Skip to main content
  • EN

Inside Netskope

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply zero trust principles to protect data.

  • 52 Topics
  • 37 Replies
52 Topics
J
Netskope Employee
JHawkinsNetskope Employee
published in Inside Netskope
Implementing the UEBA within the SOC

User and Entity Behavior Analytics, UEBA, is a platform used to spot anomalous actions through users behavior. This platform leverages algorithms and machine learning to continuously learn and evolve based on each behavior Our analytics program includes a wide variety of detections to help provide our analysts with the best visibility. Allowing our analyst to get more insight rather than focusing on alerts made in Security Information and Event Management (SIEMs) or Endpoint Detection and Response (EDRs), having the use of UEBA can fill in the void where visibility is lacking.  As the security team continues to integrate UEBA within the SOC, it's crucial to understand its functionality and how it operates. All of the information can be reached through Netskope’s user-interface (UI), but for more in-depth information you can check out the online reference information for it here. The benefits of Netskope using UEBA include detecting anomalous insider behavior, identifying unknown data m

260
J
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Register now! Inside Netskope: Operationalizing UEBA UCI Alerts

Inside Netskope Webinar SeriesSession 10: Operationalizing UEBA UCI Alerts Wednesday, February 268am PST |  4pm GMT |  5pm CETRegister now! Join myself, and additional members of the Customer Zer0 team, as we discuss how to utilize User and Entity Behavior Analytics (UEBA) to provide full visibility of the risks that our end-users face or perform.  Key Topics: What is User and Entity Behavior Analytics (UEBA) How does Netskope use and implement this within our SOC (Security Operation Center) Detection/Ticket Creation from UCI (User Confidence Index) Enabling user risk scores from our other applications feeding into a user's UCI  Policies within Netskope to coach users, or taking action for specific users’ depending on their UCI  Explore past webinars in the series

350
ukrishna
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Inside Netskope: Session 09 Recap—Off-boarding User Monitoring Protections in PracticeInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on off-boarding user monitoring protections in practice can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Can you go back to before the user was identified as off-boarding?A: Depending on how long you have data retention set up for your tenant, this would determine how long you can look back for some of the user's activities. When you do the look backs, the dashboards we put together will pull all that data within Netskope and give you a view of what was actually happening.  Q: Off-boarding users can be sneaky, especially those coming from a technical background. Can you suggest how Netskope can detect data exfil using common protocols, such as DNS or encrypted communication channels?A: Yes, there's definitely way

380
M
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Netskope Endpoint SD-WAN: The Unsung Hero for Tracking Netskope Client BypassesBlog

Netskope products serve the purpose of security AND as tools to troubleshoot with.  Tools that are often overlooked by everyone, including us!In this article, we are going to cover one of our newest products acquired through the purchase and partnership of Infiot’s Borderless WAN (BWAN).  BWAN is the technology commonly known as Software Defined Wide Area Networking (SD-WAN).  We will answer the questions of:How does the Netskope Endpoint SD-WAN Client become a tool to be used? How am I able to use the Netskope Endpoint SD-WAN Client for displaying bypasses in the Netskope Endpoint SD-WAN console?As a little background information, “Netskope BWAN extends the concept of network segmentation beyond traditional network perimeters, catering to the needs of a modern workforce that operates from varying locations and uses a multitude of devices. Netskope BWAN ensures network segmentation for any device by encapsulating each session in a secure and encrypted tunnel. This segmentation extends

2020
S
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Inside Netskope: Session 08 Recap—Protecting Lost/Stolen Managed Devices with Netskope ClientInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on protecting lost/stolen managed devices with Netskope Client can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Can a client be flagged as stolen via API?A: The client cannot be directly flagged as stolen via API, but you can use APIs to move users or devices between groups. This will have to be done within the Groups section and not with the client directly.  Q: How to setup monitoring and tracking of stolen devices? Also, can we pinpoint the location of the lost/stolen device?A: If the device comes back online and connects back to the tenant, we can get all of the location data (wifi connected to, geographic location, etc.). Regarding how to setup monitoring and tracking, the presentation covers quite a few use

1210
ukrishna
Netskope Employee
R
Netskope Employee
rakeshgNetskope Employee
published in Inside Netskope
Inside Netskope: Session 07 Recap—Automation of IOC Hunting and Continuous Monitoring using Cloud Threat ExchangeInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Automation of IOC Hunting and Continuous Monitoring using Cloud Threat Exchange can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Are new IOCs hunted against historic data? Or, only on new events after IOC is known?A: Yes, that's the beauty of this workflow is that it's not just updating tools with new IOCs but it's looking to determine whether we've seen that IOC before. Once we know that it is an indicator of compromise, it looks back to see if anything has happened and alerts an analyst immediately as soon as it finds something.  Q: Can you integrate Cortex XDR with Netskope? If so, how?A: Yes, via Cloud Exchange. Check out this doc for more information.  Q: Do you have SentinelOne Integration?A: Absolutely!

1020
R
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Netskope Client & Stolen Managed DevicesBlog

Netskope Client & Managed DevicesNetskope offers multiple steering mechanisms and the Netskope Client is the most recommended option due to its operating nature and the available feature list. The Netskope Client is a lightweight application which can be installed on a managed device and it can be used to steer traffic from the device to Netskope Security Cloud. It provides real-time visibility of the managed devices accessing the cloud and web from any location. The Client uses Forward Proxy Steering mechanism where the Client creates an SSL tunnel from the end device and terminates it at the Netskope forward proxy in the Cloud.So when the mode of steering is Netskope Client, all managed devices are expected to have the Netskope Client installed. In the context of this blog, a device is classified as managed if it has the Netskope Client installed. In this post, let us discuss the possible settings and changes which can be made in the Netskope tenant to accommodate a Lost/Stolen m

5270
ukrishna
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Inside Netskope: Session 06 Recap - Effective Allowlisting with Netskope DLPInside Netskope

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Effective Allowlisting with Netskope DLP can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Is advanced DLP techniques a new licensing?A: Exact Data Match and Fingerprinting are both included in the Advanced DLP license, so you only need ADLP to use these features. Q: Can you share some of the most prevalent DLP use cases that you've encountered? This will help us close any gaps that we may have overlooked.A: DLP policies are rarely a "set and forget". It's always a continuous learning and adjusting as our technology adjusts, as document formatting changes, etc. The only consistent is change, so we always go back and tune them as needed. Common use cases for Inline DLP include:1.) Block encrypted zip files with

2030
ukrishna
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
posted in Inside Netskope
Netskope Client Enforcement: A Security Practitioner's Perspective

Background Q. How do you enforce Netskope Client adherence without impacting SAML flows after authentication?A. Netskope Client Enforcement. Netskope Client Enforcement is used to “enforce” the compliance of having a Netskope client enabled and connected to a tenant for accessing SaaS applications using Identity Providers (IdP) such as Okta. This includes IdP or Service Provider initiated connections, i.e. logging into Okta to access a SaaS application or logging into the SaaS application directly. Netskope Client Enforcement should be differentiated from other methods of steering real-time traffic to the Netskope tenant for the processing of policies; policies such as Next-Generation Software Web Gateway (NG-SWG), Data Loss Prevention (DLP), Netskope Private Access (NPA), User Enhanced Behavior Analytics (UEBA), Cloud FireWall (CFW), and so on, all of which are designed to protect an organization. Netskope Client Enforcement also enables end users to protect corporate resources th

6643
S
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Best Practices for password protection using Netskope DLPBlog

The Data Loss Prevention product at Netskope offers a wide variety of options to customize and deploy rules that can be used in Realtime, API protection, SMTP proxy and Endpoint policies. The granular level of detailing helps information security engineers to fine tune the rule as much as possible to avoid false positives and false negatives. The same approach applies for password protection too. Passwords act as the first line of defense against unauthorized access. Strong password protection is essential for safeguarding company data, maintaining compliance, and preventing unauthorized access. In the customer zero program at Netskope, our team has been extensively working on training the DLP rules, analyzing the false positive incidents, ensuring that the DLP rules cover different types of passwords (common, contextual, secure and so on) by actively collaborating with the relevant product teams. After some intensive training and testing, here’s the recommended DLP rule for password p

8742
M
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
How to get to an excellent posture score for a SaaS app with Netskope Security Posture ManagementBlog

A best practices recommendation guide from Netskope’s Customer Zero teamIt brings the Customer Zero team great joy in connecting with the security community with some best practices of how we do what we do at Netskope to protect critical applications and data. In this blog post, let us look at how we have achieved to bring the security posture score of some SaaS apps to an excellent level with regard to Netskope’s Security Posture Management product offering. SSPM performs continuous evaluation of connected SaaS applications for security posture, and ensures that these applications are configured securely and in compliance with regulatory requirements such as GDPR, ISO, NIST, CSA and so on. Step 1 - Set up the SSPM policiesThe Netskope Security administrators can set up policies under Security Posture based on the configurations and settings to assess. The product comes with a predefined set of policies which can be used as a baseline to start the process as well.  Step 2: Establish co

1610
M
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Inside Netskope: Session 05 Recap - Using Layered Protections for SaaS Applications

In case you missed the latest webinar in our Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Using Layered Protections for SaaS Applications can be found below. Feel free to comment and continue the discussion!  📽 Watch on-demand 🍿 Q: Do you have any book or links for reading materials needed to perform at my duties professionally?A: In relation to this topic specifically, we have a corresponding Community post for the three products we discussed during the presentation that talk about how we use layered protections for SaaS Applications as well as recommendations.Security posture for Workday application at Netskope Security posture for Github application at Netskope Security posture for Salesforce application at NetskopeDocs.Netskope is also a great place to get additional information and use cases. Q: Can Netskope be applied together with SI

890
M
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
posted in Inside Netskope
Security posture for Github application at Netskope

GitHub is a web-based platform that provides hosting for software development projects utilizing the Git version control system. It serves as a collaborative platform for developers to work together on code, track changes, manage projects, and host their code repositories. GitHub allows developers to create and maintain repositories, which are containers for code and related resources. These repositories can be either public, allowing anyone to view and contribute to the code, or private, restricting access to a selected group of individuals or organizations.   There are some security challenges that we as the Customer Zero team are trying to address for Github. The premise behind the security posture is considering sensitive data movement, malicious repositories, code injection and leakage, ensuring appropriate access controls and permissions. We are currently monitoring and securing access to Github internally with a breadth of products that are developed and maintained by the d

4925
T
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Salesforce Reverse Proxy Using Okta as the IDP

A Security Practitioner's PerspectiveThis article will walk you through the setting up of Reverse Proxy(RProxy) for Salesforce (SFDC) using Okta as the Identity Provider (IDP). There are RProxy limitations which should be noted as it will greatly affect its use within the organization and subsequent effective use within Real-Time Policies (RTP). For example, RProxy might appear to function correctly but activities with desktop applications might be restricted or bypass RProxy altogether.Since RProxy is meant to provide another real time steering method for machines or devices which do not have the Netskope client enabled, it is imperative to understand its limitations and plan accordingly.Additionally, RProxy should be implemented as the last method of deploying other real time access methods since it sits between the IDP and the application. The exception to this is implementing RProxy as a Service (RPaaS). RPaaS is an application that sits in an SaaS service that also has a built in

3070
S
Netskope Employee
E
erwingdavidNew Member
asked in Inside Netskope
syslogs on fowarder

can i send syslog to a forwarder who is on premise?

1081
Rohit_Bhaskar
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Making Netskope Cloud Exchange Highly AvailableBlog

The Netskope Cloud ExchangeNetskope offers an interesting solution to solve this use case and that is the Netskope Cloud Exchange (also referred to as Netskope CE). It is a free offering from Netskope with which organizations can share their IoC information between their security tools using the Threat Exchange, use the Log Shipper to import transaction logs from Netskope, use the Ticket Orchestrator to relay alerts to ticketing services and use the Risk Exchange to exchange risk scores between multiple sources. It can be installed and run in a Linux Docker environment by each customer on their own. You can read more about Netskope Cloud Exchange here. As mentioned above, there are four main modules offered with the Netskope Cloud Exchange: the Log Shipper, Ticket Orchestration, Threat Exchange, and Risk Exchange. All the modules are hosted and run in a single docker environment. Make sure you go through the system requirements once before you provision your infrastructure for the Clou

2660
ukrishna
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Access Control based on OS & Browser Versions using HTTP HeadersBlog

Why control access based on versions?In recent times, it’s well known that there are multiple vulnerabilities cropping up every single day for different applications and operating systems. Applications and operating systems creators are trying their best continuously to patch these vulnerabilities with newer and updated versions of their softwares. In an enterprise defensive setup, making sure that all applications and operating systems are up to date has become more important than ever. The two main entities which need to be monitored for updates aggressively should be Browsers and Operating Systems as a lot of internet access for users traverses via Browsers and every user would be on a machine which has to run an Operating System. There are several tools which help an organization to force-update their browsers and operating systems within a specific time & date. The forced-update method is an effective solution but is kind of an aggressive route as it might lead to unintentiona

9783
ukrishna
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Inside Netskope: Session 04 Recap - Using the Netskope Client to Enforce Browser Updates

In case you missed the fourth webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Using the Netskope Client to Enforce Browser Updates can be found below. Feel free to comment and continue the discussion!  📽 Watch on-demand 🍿 Q: What about other browsers such as brave or duckduckgo? Do you guys lay down the law and block those for your org?A: There's a sizable list of supported browsers. If you hit your real-time policy and select "criteria" > select browers, you can see all the browsers that are currently supported.  Q: Is this a subscription service?A: If you are a Netskope customer and utilize SWG with real-time policies, there's no additional fees for this.  Q: Can you make it any website, not just specific GitHub or something?A: Yes, we can do this for any website.  Q: Would it be possible to add enterprise browsers like

1920
ukrishna
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Inside Netskope: Session 03 Recap - Netskope Client Enforcement for Secure Access to SaaS Applications

In case you missed the third webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on Netskope Client Enforcement for Secure Access to SaaS Applications can be found below. Feel free to comment and continue the discussion!  📽 Watch on-demand 🍿 Q: Is it Multi-Cloud/Multi-Vendor compatible or is integration available?A: We are able to apply a Network ACL within those sign on policies within Okta. If it supports applying an ACL or you can define a custom SAML 2.0 application, yes it is compatible.  Q: How about for Contractors who are not issued a laptop but need to access Okta?A: We do not block the initial access to Okta because there are some use cases where we may have former employees or even new hires that need to access Workday to set up some information. Once those persons are onboarded, we require them to use the Netskope client

2010
S
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Using Netskope’s Proactive Digital Experience Management to identify network experience trendsBlog

Netskope’s proactive & advanced Digital Experience Management (DEM) uses several metrics from Netskope client endpoint and Netskope proxy services to holistically compute the user experience score for users, based on the user-device-application combination. The user experience score provides insights for Netskope Cloud Security administrators to proactively identify network latency issues and trends, which can help avoid widespread impact on user productivity if any, well in advance. At Netskope’s Customer Zero team, where Netskope products are implemented to improve the security posture of enterprise data and applications, we actively monitor the user experience scores to identify potential network latency issues if any. This is done by adding the filter of user experience score between 0 & 30. This would provide some insights of users with poor experience scores, their locations, and so on. Using user-device combination in P-DEM, we can get critical insights about the hop by

1650
M
Netskope Employee
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Gen AIBlog

In today’s fast paced life we are being inundated with advances in technology which sometimes outpace our ability to process and keep up with. In this article we are going to:Discover the use of Generative AI within our organization; Influence Real-time Policy creation to promote user adherence and behavior to policies; Guide Generative AI Vendor/Application requirements; Build reports and dashboards that help identify and prioritize security risks; and,. Help us build a better product through self-reporting within the platform.*augmented with the assistance of Generative AIThe use of Generative AI has become extremely pervasive and grown at a rate that has left a lot of us wondering where it came from and how we got along without it in the past. A great example of this are the bullet points listed above.I got to thinking about using Gen AI to augment the bullet points and a title slide for a presentation on uncovering the insights of Gen AI. I realized the irony of the situation. It d

6461
M
S
Netskope Employee
stevanNetskope Employee
published in Inside Netskope
Inside Netskope: Session 02 Recap - Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI

In case you missed the second webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to Uncover Insights and Mitigate Risk with Netskope Advanced Analytics & Generative AI can be found below. Feel free to comment and continue the discussion! 📽 Watch on-demand 🍿 Q: Are there any templates for allowing access to controlled AI tools like corporate Copilot and Copilot Designer while blocking outside AI tools?A: We recommend taking the client and start to interact with the copilot to see if you're able to pick up some of those activities with the predefined connectors and potentially even developing a custom connector. We are currently working on the consumer version of the Copilot for O365 and then eventually the professional version.   Q: How can AI in Netskope help business to grow?A: We can analyze the traffic we are seeing w

2070
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Inside Netskope
Dropbox

It is necessary to install the Dropbox desktop application, download the executable from the official website, at the time of installation it does not finish the installation.In the Steering Configuration EXCEPTIONS option, the application is bypassed but it still does not allow the installation, how can I remedy it?

1322
Rohit_Bhaskar
Netskope Employee
ukrishna
Netskope Employee
ukrishnaNetskope Employee
published in Inside Netskope
Sanitized HAR File Detection using NetskopeBlog

What are HAR files and why detect them?HAR stands for ‘HTTP Archive’ format and it is a file used to store the interactions between a particular Website and the Browser. These files are used to troubleshoot issues that a particular user might be facing with a website and the issues could be related to performance, page elements, cookies, HTTP headers, page rendering, etc. Large organization’s support and technical teams use the HAR files in order to understand what kind of issues the user should have faced when they inspect the HAR file related to the transaction. HAR files can be used for debugging as they present a clear picture of the transaction between the Browser and the Web server. This also presents a gaping hole as HAR files also record sensitive transactional information like cookies, authentication tokens, etc. It has become crucial to make sure the HAR files are not mishandled. There are sanitization tools available to make sure that all sensitive information for a particul

3660
ukrishna
Netskope Employee
M
Netskope Employee
madhurasridharNetskope Employee
published in Inside Netskope
Recap: Inside Netskope Session 01 - Coaching Users into Compliance

In case you missed the first webinar of our new Inside Netskope series—where Netskope experts show you how we protect our users, applications, and data using our own cloud-based architecture—a recording and recap of our recent session on how to coach users into compliance can be found below. Feel free to comment and continue the discussion! Watch on-demand Q: What is the Block restriction action for those that have not been able to complete the training in time?A: We take a gradual approach to the notification system, so there are different levels of restriction. Once the completion deadline has passed, users receive a similar message but they do not have the option to provide justification to do the training later. Their only option is to complete the training now or ignore the message which will follow them on all applications other than the required ones (Okta, LearnUpon, and Slack). Q: What has been the user experience/feedback from the users as you've deployed this notification sy

2670
M
Netskope Employee

Badge winners

Show all badges
Terms & ConditionsCookie settings