Does anyone have a Policy or Run book that utilizes Netskope to cut down Internet usage during a security incident such as ransomware?   

I am thinking that if there was an event, I would want to start individual assests- particularly remote could and could not do.  

In my mind:

• Prevent computers from accessing any sites that are not on a shortened approved list.
• Have an emergency steering config that has now Cert-Pinned Apps.
• Once an assets is determined to be infection free - or reimaged and having a certain identifier, use device classification to allow more sites.