Next Gen SWG

Hello All,   I was wondering if it is normal for Netskope to go into disabled and then into Fail close if the user account in AD gets locked out.  I don't see anything in our agent arguments that would imply it is installed with fail close.  As well, I have the fail close option unchecked on our client configuration.  The only thing I have read is that I have a password set for tamper proofing, which is a prerequisite for fail close.    Has anyone come across this situation before?

Hi team,We migrating policies from Zscaler to Netskope NGSWG with file type url filtering  and cloud apps control. As the categorization is totally different can you please help me out with this migration of policy I need to know the category fall in Zscaler which is fall in Netskope or any docs from your end will help thank you.

How is license consumption worked out for the SWG product? We're currently just syncing groups from Azure AD that contain users based on their office location and the total number of members in those groups is just under what we're licensed for, but want to ensure that we aren't missing anyone. If we sync a catch all group from Azure AD that contains about 3 times as many accounts as we have Netskope licenses what happens to our license consumption? Do we consume licenses equal to the total number of AD accounts that are synced, total number of enabled AD accounts, total Netskope clients seen over a time period, max concurrent connected clients, or something else?

Good afternoon,Many of our users on Chromebook/Chrome OS (differents constructors and differents "versions" like "Nami", "Zork", "Octopuss", "Hatch"...) experiment frequent disconnections since earlier version (actual latest version for ChromeOS via Playstore is 107.1.0.1529, published on 2023/08/23), tunnel going up/down in logs, this is very embarrasing for our users. Fixes have been deployed until the latest stable version mentioned above, but the disconnections are persistent, and seems more frequent when users are in homeworking. Does anyone encounters the same kind of issue, please ?Thank you if you can help me. I precise Netskope official support have already been contacted and is aware of this problem.Best regards. 

Hello, we have disabled unenroll from client UI through client config. But in some instance need this operation  [eg: IT accidentally enrolled while troubleshooting under user's windows session]. Wondering if this can be done from CLI or manually deleting user level files. 

The Netskope clients have not been able to update configuration since September 1st for my tenant.  Netskope said its a known issue. Is there a reason why https://trust.netskope.com/ does not reflect this yet? Thank you. 

Hello,  We configured a URL list to allow certain github repositories and noticing netskope is processing the list in case sensitive mode. Is this the default behavior? Can we have it process in case insensitive mode?  eg: github.com/Azure vs github.com/azure

We started seeing safevisit.online in our reports within the last week or 2 that this site is being blocked as a security risk.  I've looked online but I haven't found any resources explaining what this site is or why its showing up.  If its a tracker, I'm guessing users are visiting a site that has it embedded.  The domain is less than a year old.

Hello Netskope community,    Customers adopt different approaches on how they manage access to Youtube, where some have a more relaxed policy and some are more strict. For customers that need more granular controls over the video giant, controlling based on channel is one of the possible solutions.    Netskope's Instance Awareness feature extracts the channel name every time you visit a page or video so if you browse to the Netskope YouTube channel and check SkopeIT you will see something like this:  (notice the instance ID field populated with "netskope" and that will be true to any other channel on YouTube)    In order to setup a Real Time policy to either blocks a channel or simply allow it, depending on your strategy, create a new instance from SkopeIT by expanding one if these Application e

Just want someone else to confirm my observation:  While what POP a client software is connecting to is available, what version of the client being used is not.   I was trying to replicate the DEM dashboard, right now I have to download devices into a spreadsheet and then chart it.

I am writing to ask that the Community contact their Netskope representative and and indicate your interest the Request to Enhancement that has been stalled:  "NPLAN-112: Apply steering configs based on priority in multi user machines. " You might not have noticed this, but if you have multiple users on one machine, Netskope may not be providing them with the correct steering config.  This is most noticeable when you are in the midst of CASB to SWG, but can occur otherwise too.  In a multi-user deployment mode, if the logged in users belongs to different OUs or user groups, the Netskope Client applies the steering configuration corresponding to the user most recently logged. Ensure all the users belong to a single OU or User Group for a multi-user machine.  

Has anyone heard how Netskope plans to deal with Windows Linux Subsystems on the Windows 10 and 11 devices. We have several users where I work that are asking question around this.  

Hi there, One of my client doesn`t want to go other way of steering traffic from Windows Server 2016 to Netskope Cloud so he wanted to use Netskope Client to steer the traffic from the Windows Server 2016. We tried to install, client stays disabled and when checked logs it says the below.Initially we thought it would UPN and EMAIL ID are not matching, but we created separate the account with the same UPN and EMAIL ID, but client still fails to download config branding file and stays disabled. What you suggest next we should do? 2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:6234 Config Branding file downloaded failed for user: Removed the user ID2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:4571 Config Failed to download branding file using UPN2023/08/09 16:49:13.570 stAgentSvc pcb0 t17b4 error config.cpp:8173 Config failed to download UPN hashing config2023/08/09 16:4

Hello NS community!   Currently Netskope URL categorization product has 127 categories. Some categories are meant for legitimate traffic such as Financial News, Business, Educations, and some categories are security risk related such as, Security Risk - Botnets, Security Risk - Phishing/Fraud. There are also categories that may not be allowed for work environment such as Gambling, Tobacco or Adult contents. Each customer can create their own policies to allow or block each URL category. In order to test these policies, customer needs to know the URL samples in each category and then performs the test.   Attached you can see an example of these "hardcoded" categories for all our categories so you can test your policy in real-time. Be cautious as

Dear Team, We noticed that the internet is in working condition for every other user, however, it is showing an error of the internet not working on a that particular system.After analysis, we found the below logs, we need your assistance to understand the cause. fileUtil.cpp:45 nsUtils failed to open file for reading: C:ProgramData etskopestagent/eventcache.json, err:2t40a4 info fileUtil.cpp:82 nsUtils failed to open file for reading: C:UsersAppDataRoamingNetskopeSTAgent/data/authtoken.pem, err: 2t2afc error registry.cpp:158 registry RegOpenKeyEx failed, err: 2 Best Regards.

IntroductionChatGPT and other AI chatbots have been getting a lot of attention lately.  They are extremely helpful in getting information, responding to custom queries, and can even be used to write code along with other common daily tasks.  They represent an exciting new digital frontier but from a security perspective, they also represent yet another place for your corporate data to go.  Netskope’s inline Next-gen Secure Web Gateway capabilities can block posting of sensitive data to collaboration tools such as Slack and Teams out of the box.  It got me to thinking that since ChatGPT is essentially a chat system, why can’t we use a similar capability to block posting sensitive information to ChatGPT?  As one quick tangent, I also want to give OpenAI some credit as they also warn the user that it’s not appropriate to put personal data into their platform:

We’re having an issue with our web server blocking Netskope IPs. Where can I find a list of IPs that I can whitelist?

Hello All,The following articles have come out re: Evasive Phishing that domain front-ends Google to protect potentially malicious or unintended traffic from being picked up by filtering or threat. The following articles address how this works:https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/https://www.malwarebytes.com/blog/news/2023/08/phishing-campaigns-found-to-be-using-amp-urls-to-avoid-detection This means if NGSWG can't categorize the URL is hiding in AMP then it will treat the site as categorized as safe (or likely safe) based on that it is hosted at google, not the real site of xxx.xxx (or whatever malic

We are looking to start using a knowledge sharing platform called notion.so. Does anyone have experience with setting up DLP on this platform?  I'm curious if I can just use the same web policies there.

I have a number- of applications where a corporate IP address allows access without authentication.  For the first 15 or so, we have been 100% successful in using the Forwarder back to corporate and then sending the traffic from here.  However, the most recent set, library resources works some days and don't work on other days.   Has anyone seen this behavior?  

Provisioning Users from AWS accounts (Customer manages AWS Amazon WorkMail, for their mail accounts - business mail service). Hello good afternoon, how are you doing? As always, thanks for your cooperation and support as always. I have a question, a customer X, has a mail service on AWS, no Azure AD, no local AD, no google apps. So he only has for his mail accounts AWS - Mail Account - Enterprise Service. Is Netskope compatible, for the moment I have not seen any document, do you know if it is compatible Netskope, to provision fianles users, users to Tenant, by SCIM, LDAP or IDP, against AWS, in order to provision users and groups ? Does anyone have any information, data or details regarding this scope of Netskope ? Thanks, I remain attentive Best regards

the way to see the Cloud exchange console is which? Should I open from any browser with the IP where the connector is located or do I have to do it on the client's server where the connector was installed?

VMWare's Workspace ONE platform enables IT teams to manage any app on any device by integrating access control, application management, and unified endpoint management. In this guide you will learn how to perform a completely silent installation of the Netskope Client for supported MacOS versions.   High-Level Process From a high-level, the process is as follows: Configure Device Profile to deploy Pre-requisites Configure Workspace ONE Sensor to push pre-install file Push Netskope Client   Before you start, make sure to have Access to a Netskope t

Hello, I am implementing a new proposal for Real Time Policies for Netskope, to follow best practices and reduce the number of polices to the minimum possible. Currently, I propose a structure similar to this (+ other specific policies of allow, block, dlp, threat protection etc..):Allow corporate App InstancesAllow "Sanctioned" AppsBlock not allowed CategoriesAllow allowed Categories But there are webpages that belong to a non-permitted category, but to which access must be allowed. The problem is they are webpages and not applications, I can't apply the "Sanctioned" tag. If I create a custom app with the URL of the webpage, it also does not allow adding the "Sanctioned" tag. What is the best practice recommendation to resolve the situation? I can only think of creating a new policy that is allow access to a custom URL List, but it doesn't seem like a maintainabl

Netskope Secure Web Gateway provides next generation secure web gateway (NG SWG) capabilities to prevent malware, detect advanced threats, filter websites by category, protect data, enable remote browser isolation, and control apps and cloud services for any user, location, or device. Netskope offers multiple traffic steering options to steer traffic to the Netskope Cloud: Netskope Client IPSec GRE Explicit Proxy Proxy Chaining For customers that want to leverage IPSec tunnels to steer traffic to the Netskope Cloud, Netskope strongly recommends the following:  Config