Skip to main content
Solved

Crowdstrike MacOS exclusions

  • February 13, 2024
  • 3 replies
  • 531 views

Forum|alt.badge.img+12

Crowdstrike customers, how are you doing the exclusions for MacOS listed here, https://docs.netskope.com/en/netskope-help/netskope-client/netskope-client-interoperability/antivirus-applications/exceptions-for-anti-virus-applications/

Specifically, I’d be curious to see what your exclusion patterns are. For paths with spaces (i.e. /Library/Application\ Support/) are you using “/Library/Application\ Support/” or “/Library/Application Support/”. Crowdstrike documentation states we shouldn't need the \ but does that work in practice?

Best answer by sshiflett

@TKO3Sons the every 15 minutes aligns with the interval for updating the client’s SRP.  I’m wondering if something is resetting our connection or if we are having an issue writing the new SRP to the client.  Have you already opened a support case with Netskope?  If so, please DM me the case number and I am happy to review. 

 

This topic has been closed for replies.

3 replies

  • New Member III
  • September 11, 2024

I'm currently dealing with a similar issue. If you find a solution, please let me know. The Crowdstrike support team had me add the following Sensor Visibility Exclusions: 

- /Library/Application Support/Netskope/STAgent/*
- /Applications/Netskope Client.app/**

However, I don't think this completely resolves my problems. The Netskope client keeps resetting the connection every 15 minutes for some of my users, which is causing disruption to SSH sessions with the ZTNA. This is unacceptable.

Hang in there and good luck!


Forum|alt.badge.img+16
  • Netskope Employee
  • Answer
  • September 12, 2024

@TKO3Sons the every 15 minutes aligns with the interval for updating the client’s SRP.  I’m wondering if something is resetting our connection or if we are having an issue writing the new SRP to the client.  Have you already opened a support case with Netskope?  If so, please DM me the case number and I am happy to review. 

 


  • New Member III
  • September 13, 2024

@sshiflett I have a support case (00465654) opened up an currently being investigated. Thanks.