Next Gen SWG

Greetings All,I’ve had a persistent issue for several months with Netskope on macOS that I wanted to throw out here to see if anyone else had come across something similar. Intermittently devices with the Netskope client installed will lose all connectivity to the internet. In the logs I see usually around 50,000 of these messages in a span of just a few seconds`critical nsDNSProcessor.cpp:149 dnsProcessor Failed to get DNS resolver values`Usually as this happens all active connections are killed, like ongoing zoom calls, even though those aren’t being steered to Netskope.Before this I see the DTLS tunnel close down with this flownpadebuglog.log```[info] npaClientHandler.cpp:748:npaClientHandlerStop():0x0 Will shutdown NPA handler and dispatch thread, tunnelId = 7f8b47.[info] tcpclient.cpp:530:shutdown():0x1086a1160 Shutdown socket fd 45[info] npaClientHandler.cpp:755:operator()():0x0 The client handler is stopping and shutting down, userId = 502.[info] tcpclient.cpp:199:handleClose():

Hi Community,Does anyone know how to make the Google Antigravity Certificate Pinned App exception for MacOS?I have the issue from the beginning like Login step. I’m try to except the process name with any domain (*)Antigravity* antigravity* language_server_macos_armBut still can’t sign-in.

Hi folks,do you know if when setting fallback action to alert, real time policies are still evaluated when a fallback action has been triggered?Use case : you don’t want to block download when file size > 400Mo (max file size analyzed by TP)1.You set fallback action to alert2.You set a RTP allow_all_vip for a VIP group to be allowed to download and surf with no exception3.You set a RTP block_dl_400 for all users to block download with constraints file size >400Mo AND specifics files typesExpected result when download a file under 400Mo, TP is applied, all users can download. when download a file great than 400Mo, fallback action is applied, then RTP is applied regarding the user’s groupIn Real life, when standard user try to download a file >400Mo, block_dl_400 is not applied, log indicate fallback action, so it seems that policies are not evaluated after fallback action.Moreover it seems that Netskope tenant is setting MIME/TYPE as application/octet-stream whatever the origin

How do I decrypt/read the TLS traffic in Advance Debug Logs while using Wireshark? 

Hello,I am running VirtualBox in NAT mode on my machine with the Netskope Client installed on the host. The VMs inside VirtualBox are failing to connect or update due to SSL/Certificate errors caused by Netskope's inspection.I want to bypass SSL Decryption specifically for the VirtualBox application, but I do not want to bypass traffic for the whole machine or use a broad IP-based exception. Thanks.

Summary.Reviewed https://community.netskope.com/casb-swg-inline-92/netskope-inline-dlp-with-microsoft-information-protect-mip-labels-6942?tid=6942&fid=92It is clear from this article, that we could label a document Confidential, put in a DLP policy that blocks the label "Confidental" into public AI sites, and that document would be prevented (when used in appropriate specific connector situations, with possible adherence to generic connectors.But the question is - if someone were to copy and paste text from a labeled document, and directly pasted it into a prompt, would the DLP block still occur?

There a lot of AI based browesrs, the likes of Comet by Perplexity, Atlas by Chatgpt etc. which have their own security parameters yet to be assessed and considered safe for use by Corporate Employees. There seem to be no pre defined category and these browsers are not yet identified as applications in Netskope. Is there a workaround to be able to block the applications?

Hi there, I want to use Workato to create an Automation with Netksope. Specifically the OTP feature for disabling internet security. Aim:1. User clicks Disable Internet Security2. Launches web page to enter email address3. Email sends OTP or next page provides OTPSomething along the lines of the above. Can someone share if they have done something similar (with another Automation platform too) or can someone share what I would need for this?

Hello Netskope Community, With the recent launch of Google’s AI mode in Google searches, I am looking for a way to block it using Netskope. I noticed that the URL pattern is different between the AI mode and the regular search results, however the wildcard matching cannot be used because of the way Netskope handles wildcards. I am not seeing an obvious way to use regex to match it, however if someone else does please let me know. I also explored matching the activity based on HTTP header and was unable to find a unique header field that I could match on (again if anyone knows different please let me know). My next plan of attack is to try making a custom CCI application using the Netskope App Activity recorder browser extension and block access to it, but I haven’t tried that yet. Does anyone have any other ideas?Thank you in advance. 

Hello All,Could someone please provide a clear explanation of the internet speed test? I’ve been troubleshooting an internet slowness issue, and while testing with Fast.com and Speedtest.net (https://www.speedtest.net/), I get impressive speeds (around 80 Mbps).However, when I test using Netskope's speed test (https://speedtest.goskope.com/), it shows much lower speeds (around 5 Mbps). This discrepancy is creating confusion about which test to trust, especially since the ISP technicians don’t use Netskope and rely on public websites to verify the speed

Hi everyone,I set the “Online Ads” category to Silent Block in our policy. It works fine on Google Search (ads are blocked silently), but when we try other search engines like Microsoft Bing, DuckDuckGo, Yahoo Search, or Yandex, the ads are still visible.Has anyone else run into this? Is this expected behavior, or did we miss a setting to make it apply across different search engines?Appreciate any insights!

 was just talking about this in another thread here. We have a URL list that resolves this. We haven't had to update it in awhile but it's easy enough if we have to.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*  so with this regex above for Microsoft Delivery Optimization what actions are you all allowing Browse, Download, Post, ect…??

How are others solving for this? 

I was wondering if there is any documentation on what this page returns for sites visited. I find that some sites users visit will show here but the majority will not. I cannot find a difference between the sites that show here and ones that do not.. Like the sites are not blocked etc.. what is Netskope using to determine what gets presented to the “Websites:” Thanks

I recall stumbling upon a Community article a while back for a regex chrome / edge pattern match used in app definition for a steering bypass.  For the life of me i cant find it, was looking to create a steering bypass for all processes except for Chrome, Edge , Safari and Firefox.anyone done this? (useful to have in some heavy dev environments for a limited group of folk)

Hi there We use MacOS in our estate. I want to build an automation with a tool like Tines or Workato whereby, when a user clicks the Disable Client/Internet Security option, the automation will run a workflow that gets the OTP via an API request.How can I go about doing this please?

Can anyone confirm whether Netskope enforces restrictions that prevent a Mac laptop from connecting to public Wi-Fi networks, while allowing successful connections to private Wi-Fi networks? If such a restriction exists, could you please advise which specific Netskope logs should be reviewed to verify whether the Mac laptop's access is being blocked or restricted on public Wi-Fi?

Yes, I am  going to create a case, but on the chance I can shortcut the process I thought I would ask here. Has anyone developed a solution for the AI chatbot at help.salesforce.com?We know we are going to have to SSL bypass, we just having figured out what URLs yet.  

Hello everyone,We've seen a few questions lately about the best way to handle Netskope Client upgrades when you have a mixed environment of non-persistent VDIs and traditional laptops. A common challenge is that the same user might use both, but the upgrade strategy needs to be different for each.Let's break down the problem and the best-practice solution. The Challenge: Different Needs for Different Devices  Non-Persistent VDIs: You can't use the standard auto-upgrade feature from your Client Configuration. Any update applied during a session gets wiped when the VDI reverts to its golden image. Upgrades need to be manual and controlled. Laptops: You want them to auto-upgrade. It’s the easiest way to keep your users on the latest client version and maintain your security posture with minimal effort. So, how do you disable auto-upgrades for VDIs while keeping them enabled for laptops, especially when the same user logs into both? The Solution: The autoupdate=off Installer Flag is Key!

2025/12/23 Issue is fixed. Currently Netskope supports to apply Post Activity applied DLP profile to trigger user alert when the real-time policy is applying to all predefined categories.* With description written: Not all activities are supported by selected apps & categories View activity supportWe tested the user alert feature and noticed that when a DLP profile is applied to the user activity 'Post' for all web access, the user alert option cannot be selected.However, once we changed the policy to apply only to specific categories, such as cloud storage, the user alert option became available.We also observed that user alerts work if no DLP profile is applied but the 'Post' user activity is regulated across all web access. App Category - Profile - Activity - Action(1) Specific Category - DLP - Post - User Alert ✅(2) All Web - DLP✅ - Post - Alert/Block(3) All Web - No Profile ❌ - Post - User Alert ✅Does anyone know the mechanism behind this behavior?

OK, I am sure it will be obvious when someone tells me, but I walked trough what I think is every Settings spot and cannot find the Enrollment Token Section.  The Docs start out saying “Click Create TokenSet to create a new token set on the webUI. “ but not where it is!     It feels like it should be in the “Client Configuration”…….

Hello Netskope Community,One of our customers has a requirement where a specific role should have the ability to create policies and apply global/general settings, but not be able to delete any policies or settings due to compliance reasons.Currently, this level of granularity is not supported. The available permission levels—None, View, Manage, and Manage and Apply—provide either read-only or full read-write access to a specific feature or function. However, there is no built-in option to restrict only the delete action for a role.We would like to know if there are any known workarounds or if this capability is being considered for a future release.

Alternatives - Deployment/Enrollment with UPN - Based on Postman-SCIM - Users - GroupsHello community, how's it going? Good afternoon, I hope you're all well. I have a specific case to discuss:In a scenario where we have a complete refusal to touch anything in Azure AD or AD-onprem (nothing at all, no way - no agent, no directory import, no enterprise app, no ID entry, etc., nothing at all, it's not possible because there's absolutely no option), here we already know, we use our beloved Postman to use SCIM and start generating users/groups, so to speak, "manually." Then we have the AD users with UPNs, everyone happy without touching AD but with the AD-onprem UPN users, already in the Tenant using the Postman SCIM API.We can deploy with tools like System Center, DesktopCentral, or anything else for .msi files with UPN values. Everything's OK here too. We install, the Windows users of the AD domain start, and the UPN registration and enrollment are OK, as expected. Now, here's my big que

Are there any recommended guidelines to indentify and filter out known org AWS S3 traffic, and then enforce Netskope policy on only external S3 traffic? 

When creating a coaching policy, when the user enters a justification reason, where is this captured in the admin portal?