Next Gen SWG

We started seeing safevisit.online in our reports within the last week or 2 that this site is being blocked as a security risk.  I've looked online but I haven't found any resources explaining what this site is or why its showing up.  If its a tracker, I'm guessing users are visiting a site that has it embedded.  The domain is less than a year old.

Hello Netskope community,    Customers adopt different approaches on how they manage access to Youtube, where some have a more relaxed policy and some are more strict. For customers that need more granular controls over the video giant, controlling based on channel is one of the possible solutions.    Netskope's Instance Awareness feature extracts the channel name every time you visit a page or video so if you browse to the Netskope YouTube channel and check SkopeIT you will see something like this:  (notice the instance ID field populated with "netskope" and that will be true to any other channel on YouTube)    In order to setup a Real Time policy to either blocks a channel or simply allow it, depending on your strategy, create a new instance from SkopeIT by expanding one if these Application events and clicking on "Create New Instance" and just giving it a name.    After that, go to Real Time policies and setup a policy using this newly c

Just want someone else to confirm my observation:  While what POP a client software is connecting to is available, what version of the client being used is not.   I was trying to replicate the DEM dashboard, right now I have to download devices into a spreadsheet and then chart it.

I am writing to ask that the Community contact their Netskope representative and and indicate your interest the Request to Enhancement that has been stalled:  "NPLAN-112: Apply steering configs based on priority in multi user machines. " You might not have noticed this, but if you have multiple users on one machine, Netskope may not be providing them with the correct steering config.  This is most noticeable when you are in the midst of CASB to SWG, but can occur otherwise too.  In a multi-user deployment mode, if the logged in users belongs to different OUs or user groups, the Netskope Client applies the steering configuration corresponding to the user most recently logged. Ensure all the users belong to a single OU or User Group for a multi-user machine.  https://docs.netskope.com/en/steering-configuration.html#UUID-eae29f38-85d9-fd13-74c9-077e1ef74513_section-idm4585568446828833492110209816 Here is a way to interpret this:   When the client has been installed in multi-user (peruserc

Has anyone heard how Netskope plans to deal with Windows Linux Subsystems on the Windows 10 and 11 devices. We have several users where I work that are asking question around this.  

Hi there, One of my client doesn`t want to go other way of steering traffic from Windows Server 2016 to Netskope Cloud so he wanted to use Netskope Client to steer the traffic from the Windows Server 2016. We tried to install, client stays disabled and when checked logs it says the below.Initially we thought it would UPN and EMAIL ID are not matching, but we created separate the account with the same UPN and EMAIL ID, but client still fails to download config branding file and stays disabled. What you suggest next we should do? 2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:6234 Config Branding file downloaded failed for user: Removed the user ID2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:4571 Config Failed to download branding file using UPN2023/08/09 16:49:13.570 stAgentSvc pcb0 t17b4 error config.cpp:8173 Config failed to download UPN hashing config2023/08/09 16:49:13.570 stAgentSvc pcb0 t17b4 info config.cpp:5960 Config UPN encoded for u

Hello NS community!   Currently Netskope URL categorization product has 127 categories. Some categories are meant for legitimate traffic such as Financial News, Business, Educations, and some categories are security risk related such as, Security Risk - Botnets, Security Risk - Phishing/Fraud. There are also categories that may not be allowed for work environment such as Gambling, Tobacco or Adult contents. Each customer can create their own policies to allow or block each URL category. In order to test these policies, customer needs to know the URL samples in each category and then performs the test.   Attached you can see an example of these "hardcoded" categories for all our categories so you can test your policy in real-time. Be cautious as clicking in these URLs will generate logs for the Netskope user accessing them so make sure administrators know these tests are being performed.      Update (8/14/23): Updated attachment with latest "Generative AI" categ

Dear Team, We noticed that the internet is in working condition for every other user, however, it is showing an error of the internet not working on a that particular system.After analysis, we found the below logs, we need your assistance to understand the cause. fileUtil.cpp:45 nsUtils failed to open file for reading: C:ProgramData etskopestagent/eventcache.json, err:2t40a4 info fileUtil.cpp:82 nsUtils failed to open file for reading: C:UsersAppDataRoamingNetskopeSTAgent/data/authtoken.pem, err: 2t2afc error registry.cpp:158 registry RegOpenKeyEx failed, err: 2 Best Regards.

IntroductionChatGPT and other AI chatbots have been getting a lot of attention lately.  They are extremely helpful in getting information, responding to custom queries, and can even be used to write code along with other common daily tasks.  They represent an exciting new digital frontier but from a security perspective, they also represent yet another place for your corporate data to go.  Netskope’s inline Next-gen Secure Web Gateway capabilities can block posting of sensitive data to collaboration tools such as Slack and Teams out of the box.  It got me to thinking that since ChatGPT is essentially a chat system, why can’t we use a similar capability to block posting sensitive information to ChatGPT?  As one quick tangent, I also want to give OpenAI some credit as they also warn the user that it’s not appropriate to put personal data into their platform:   That being said, this is as after I already posted the data and relies on ChatGPT recognizing the

We’re having an issue with our web server blocking Netskope IPs. Where can I find a list of IPs that I can whitelist?

Hello All,The following articles have come out re: Evasive Phishing that domain front-ends Google to protect potentially malicious or unintended traffic from being picked up by filtering or threat. The following articles address how this works:https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/https://www.malwarebytes.com/blog/news/2023/08/phishing-campaigns-found-to-be-using-amp-urls-to-avoid-detection This means if NGSWG can't categorize the URL is hiding in AMP then it will treat the site as categorized as safe (or likely safe) based on that it is hosted at google, not the real site of xxx.xxx (or whatever malicious site and path is included there). Examples:https://www.google.com/amp/s/xxxxx.xxxx/somesite.html or https://www.google.co.uk/amp/s/xxxx.xxx/badimage.img From a position of making sure this product is competitive in the market, there are some other vendor tools that can granularly expose this hidden URL and site an

We are looking to start using a knowledge sharing platform called notion.so. Does anyone have experience with setting up DLP on this platform?  I'm curious if I can just use the same web policies there.

I have a number- of applications where a corporate IP address allows access without authentication.  For the first 15 or so, we have been 100% successful in using the Forwarder back to corporate and then sending the traffic from here.  However, the most recent set, library resources works some days and don't work on other days.   Has anyone seen this behavior?  

Provisioning Users from AWS accounts (Customer manages AWS Amazon WorkMail, for their mail accounts - business mail service). Hello good afternoon, how are you doing? As always, thanks for your cooperation and support as always. I have a question, a customer X, has a mail service on AWS, no Azure AD, no local AD, no google apps. So he only has for his mail accounts AWS - Mail Account - Enterprise Service. Is Netskope compatible, for the moment I have not seen any document, do you know if it is compatible Netskope, to provision fianles users, users to Tenant, by SCIM, LDAP or IDP, against AWS, in order to provision users and groups ? Does anyone have any information, data or details regarding this scope of Netskope ? Thanks, I remain attentive Best regards

the way to see the Cloud exchange console is which? Should I open from any browser with the IP where the connector is located or do I have to do it on the client's server where the connector was installed?

VMWare's Workspace ONE platform enables IT teams to manage any app on any device by integrating access control, application management, and unified endpoint management. In this guide you will learn how to perform a completely silent installation of the Netskope Client for supported MacOS versions.   High-Level Process From a high-level, the process is as follows: Configure Device Profile to deploy Pre-requisites Configure Workspace ONE Sensor to push pre-install file Push Netskope Client   Before you start, make sure to have Access to a Netskope tenant. Access to a Workspace ONE tenant with Intelligent Hub licensing. A MacOS device running MacOS 11.x or newer that has completed enrollment with Workspace ONE and has the target user's e-mail populated accurately. Downloaded the attached .zip file and extracted the script attached to this post. Downloaded the desired NSClient.pkg file from the Netskope Support Portal (login required).   Now... onto the deploym

Hello, I am implementing a new proposal for Real Time Policies for Netskope, to follow best practices and reduce the number of polices to the minimum possible. Currently, I propose a structure similar to this (+ other specific policies of allow, block, dlp, threat protection etc..):Allow corporate App InstancesAllow "Sanctioned" AppsBlock not allowed CategoriesAllow allowed Categories But there are webpages that belong to a non-permitted category, but to which access must be allowed. The problem is they are webpages and not applications, I can't apply the "Sanctioned" tag. If I create a custom app with the URL of the webpage, it also does not allow adding the "Sanctioned" tag. What is the best practice recommendation to resolve the situation? I can only think of creating a new policy that is allow access to a custom URL List, but it doesn't seem like a maintainable option over time, if the URL list grows too much. Thank you so much!

Netskope Secure Web Gateway provides next generation secure web gateway (NG SWG) capabilities to prevent malware, detect advanced threats, filter websites by category, protect data, enable remote browser isolation, and control apps and cloud services for any user, location, or device. Netskope offers multiple traffic steering options to steer traffic to the Netskope Cloud: Netskope Client IPSec GRE Explicit Proxy Proxy Chaining For customers that want to leverage IPSec tunnels to steer traffic to the Netskope Cloud, Netskope strongly recommends the following:  Configure IPSec tunnels from the supported router/firewall to two different Netskope POPs (primary and backup). If the customer has multiple routers/firewalls then each should be configured with primary and backup Netskope POPs.  Configure tunnel monitoring by referring to the router/firewall configuration manual. Configure failover to backup tunnels to ensure minimal interruption in the event of primary tunnel failu

The Quick UDP Internet Connections (QUIC) protocol is a transport layer protocol created by Google.   If you are interested in learning more about the inner workings of QUIC, you can look at the Chromium Project.   Netskope recommends blocking QUIC to force a fallback to traditional HTTPS.  This allows for SSL inspection and applying Netskope’s activity, instance, and other advanced controls to traffic that would traditionally utilize QUIC.  In most Netskope configurations, no additional configuration is required.  See the sections below based on your Netskope deployment.    Client Using Secure Web Gateway, CASB, or Cloud Firewall Steering No configuration is needed in most cases. The Netskope client will automatically block QUIC traffic from the “google chrome” and “google chrome helper” processes on Mac and Chrome.exe processes on Windows.  The Netskope client also blocks QUIC from other common browsers such as Edge and Firefox.   &nb

I have one configuration, tied to an AD group, where people can disable Netskope to troubleshoot.  Occasionally I have people forget to enable.  I also want to track how long between enable and disable.     Is there a way to get these events in Advanced Analytics? 

Hello dear,In my company we use cisco sdwan to have high internet availability using two isps.However, as we use netskope, when Isp 1 has connectivity problems to the netskope cloud, I need to trace or change provider, so the only way cisco sdwan allows me to do this is by indicating a public ip with the port 80 open. To which public ip/port 80 I can now point the track to make my change of isp. Thanks and regards

to restart the netskope service so that it sends the events to the Qradar Siem, what would be the command or the options?

Hello Team, Hope you're doing fine. Could anyone please help me to get the URL with all the List of the Netskope POP accompanied with region, Public IP addresses, Development Status, ....Thank you in advance. Warmest Regards,Ali

Hey folks, has anyone tried to inspect ngrok traffic before? The ngrok config file has the option to include root CAs, which I have pointed to the usual nscacert_combined.pem but it still doesn't seem to work...any thoughts welcome!

Hello Netskope community members!   For those of you who ever wondered what the "Blocked Events" dialog from the Netskope Client is actually tracking - I'll try to explain in a couple of words.         In the Steering Configuration Exceptions (Settings > Security Cloud Platform > Steering Configuration > tenant config > Exceptions) you will find the exceptions that are active for your specific tenant configuration. By default, they are filled up with exceptions that we know can be useful because of TLS decryption issues (certificate pinned apps). Note that these exceptions usually are configured with action "Bypass".     Once you change this action from "Bypass" to "Block" - that's when you tell the client not to Bypass these connection attempts, but actually block them from establishing on the client. And we have no means to track that in the NewEdge DP, since the connection will never reach us as it's already blocked locally. So