Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 292 Topics
  • 695 Replies
292 Topics
farhan
Netskope Partner
farhanNetskope Partner
asked in Next Gen SWG
Policy Migration

Hi Team, Can we have mapped categorization from Zscaler Palo alto Forcepoint Cloudflare Sky high to Netskope its very ease for the deployment prepective.

490
farhan
Netskope Partner
6 months ago
farhan
Netskope Partner
farhanNetskope Partner
asked in Next Gen SWG
Testing Threat Control

Hi team, I am Doing a Pov for one of my customer can you please provide me the list of harmful url where their i can test the Netskope is able to protect you from Threats Like Cross site scripting, Crypto mining, virus spyware Botnets. Please suggest me the website so i can show test to them also please dont suggest eicar and netskope security check. 

1064
N
6 months ago
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Next Gen SWG
installation by certificate.

Greetings, I want to manage a computer without installing the Netskope client, I understand that I can install a Netskope CA certificate but I don't know if this allows me to create a policy in real time and apply it to this machine?download from the tenant Certificates option the one that says NETSKOPE ROOT CERTIFICATE and install on the machine then create a policy in real time but it does not apply, I do not see the equipment as managed within the tenant, but perhaps that is not the procedure.Could someone help me with the step by step to manage and apply real time policies through the certificate.

1492
S
Netskope Employee
6 months ago
M
michaelhall19New Member
asked in Next Gen SWG
Traffic Steering Policy for VMs in VMWare and VirtualBox

Hi, my organization is having some certificate issues with VMs in VMWare and VirtualBox. I attempted to make a custom cert pinned application using the process seen in the NS client NSdebuglog files, which did not work as expected. I have been working with support for a solution but I am hoping the community has an idea on how to solve this. 

1251
F
Netskope Employee
6 months ago
F
focusfocusfocusNew Member
asked in Next Gen SWG
Observing DTLS SSL_write failed logs in nsdebug - SWG tunnel resetting

Hi I am seeing in our client logs a lot of DTLS disconnects, we’ve lowered the MTU to 1300 too!! 2024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1093 nsssl DTLS SSL_write failed, err: 336642382, syserr: 02024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1096 nsssl DTLS SSL_write failed, errStr: error:1410C14E:SSL routines:dtls1_write_app_data_bytes:dtls message too big2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 error tunnel.cpp:898 nsTunnel DTLS nsssl_write failed, err: -12024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:681 nsssl nsssl_disconnect enter2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:1140 nsssl DTLS SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1164 nsssl DTLS Exit SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1606 nsssl DTLS Closing sock 14202024/05/24 15:03:05.328 stAgentSvc p38ec td2c info nsssl.cpp:1905 nsssl on socket close for socket 14202024/05/24 15:0

2851
F
Netskope Employee
6 months ago
E
EPicmNew Member
asked in Next Gen SWG
User disabled the netskope client, I need to enable it back remotely

Hi,New here and I would like to ask if possible and if not where there is a wish a feature option.I had some naughty users who were  disabling the Netskope client (WISHLIST can it be disabled only by inputting a password )Under client Configuration > Tamperproof, I have selected to Hide Client Icon os system tray.Now, my question is, I would like to make sure that all my users are client-enabled on their windows computers.Is there a simple way to do it? Powershell preferably.Thanks E

4722
F
Netskope Employee
6 months ago
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
Leveraging RBI for gradual GenAI adoption

Hello Netskope Community,  You’ve probably seen some other Netskope publications around GenAI adoption but this one specifically addresses organizations that haven’t started their journey yet and want to leverage a Zero Trust approach when it comes to GenAI apps like ChatGPT and others which have been fueling a lot of development and discussion at organization of all sizes due to its innovation possibilities but also by their perceived risks.  With the recent announcement of the extended license of RBI, admins can utilize our Remote Browser Isolation technology to provide access to apps based on application tags and their observed risk translated through the CCL (Cloud Confidence Level) values. Let's explore two scenarios which are possible by using this approach: Company has currently been blocking all GenAI apps but wants to allow access to at least ChatGPT via Remote Browser Isolation so users cannot paste corporate data into it or copy from it but still interact with the Assistant.

1730
frosa
Netskope Employee
6 months ago
M
Matt_G_82New Member III
asked in Next Gen SWG
Netskope client dropping connection on Mac when idle / sleeping

Hi, i am having an issue on mac devices. When i am away from my device for a period of time (normally an hour) i will have to re authenticate via OKTA to outlook and teams, i have worked out this is because my netskope client is somehow dropping connection and as a result im coming from my home IP address which isnt allowed on the Microsoft end. Has anyone else noticed this behaviour, i have seen a battery setting on the Mac that i think will fix it but i just wondered if this was common.

5595
F
Netskope Employee
7 months ago
N
ndudaExplorer
asked in Next Gen SWG
Uptick in "Error code = 0x80010106"

Windows onlyWe noticed that starting last week we’ve been getting reports of a lot of windows agents where NPA is disabled and the Agent Config doesn’t update. A reboot solves this. We’ve never had a single issue with Windows endpoints in years, now this. We’ve opened a ticket but curious if anyone else is seeing this.2024/03/04 10:37:09.253 stAgentUI pbb4 tbc0 error osUtils.cpp:358 nsUtil Failed to initialize COM library. Error code = 0x80010106One observation we have is that when this started (last week) there was a push from our IT team to get Windows updates applied. 

1472
N
7 months ago
M
munster
asked in Next Gen SWG
Wireshark vs Netskope Packet Capture

HiIs there a difference between wireshark vs netskope packet capture when collecting trace?thank

4713
B
7 months ago
myee
Netskope Employee
myeeNetskope Employee
posted in Next Gen SWG
New Guide on Netskope SCIM API Available

Some of you may know that Netskope has a SCIM API which can be integrated with IDP's such as Okta, Azure AD, etc., to provision User's and Group's into a Netskope tenant.  This is a critical part of deploying Netskope since the User provisioning is a pre-requisite to deploying the Netskope client.   There are certain times that you may not want to integrate with the IDP or maybe you are transitioning from an on-prem Identity Store to a cloud based one and aren't quite ready, but you still want to test Netskope functionality.   The SCIM API can also be used to manually create users and groups and add the users into groups so that they can both be leveraged in Netskope real-time protection policies.  The guide provides a walk through on how to accomplish this task.   If you have some ideas on how to improve the guide or on any additions, please reach out to me to discuss.

97612
thiagofc
Netskope Partner
7 months ago
X
xstuartbarrettxNew Member III
asked in Next Gen SWG
Bulk URL Lookups

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

3214
F
Netskope Employee
7 months ago
M
munster
asked in Next Gen SWG
Captive Notification and Timeout

Hi I have questions about Captive  usageNotification - Can it be customized with our own words?   Timeout 10min -  If failed to pass captive after 10min, the traffic is blocked.   How can I re-enable again captive login?  Do I close and open the browser to have the captive login?  Do I have to reboot?  etc….  Thank

3261
F
Netskope Employee
7 months ago
Indu
Netskope Partner
InduNetskope Partner
asked in Next Gen SWG
Netskope client SSL decryption issues

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as we mention in SSL BYPASS. Same sites with SSL bypass- websites (with SSL bypass) are loading every time without intermittent issues- w

14465
B
8 months ago
M
munster
asked in Next Gen SWG
Only can access from local country IP

HiIn some countries, gov website can only access from local country IPs.  Any IP assign outside of the country will deny access.As we are using 163.116.x.x, user resides in that country was unable to access too.  How can we remediate this use case?thank

4459
S
Netskope Employee
8 months ago
K
KrugerNew Member III
asked in Next Gen SWG
FTP (TCP 21) Controls

with an inline solution that is steering all traffic to the swg. Is there any controls that can be put in place of FTP(TCP 21)traffic? DLP? Malware? etc..

3001
ejang
Netskope Employee
8 months ago
M
munster
asked in Next Gen SWG
How to tell if URL was manually access by user or refer by link?

HiHow can I tell if URL was manually access by user or refer by link?Eg,  in a webpage, there were images downloaded from S3 storage vs user goto the S3 storage. Thank

1711
F
Netskope Employee
8 months ago
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
on-demand Remote Browser Isolation - use RBI for any website!

RBI or Remote Browser Isolation is a technology that allow users to open websites on a disposable container and only get the pixels from it, like a VDI, preventing any threats from the website to ever touch the user browser. Since this technology makes use of disposable browser containers for rendering sites, it consequently makes the browsing session not only safe but also anonymous.  Normally, RBI is configured to isolate high risk categories like ‘uncategorized’ and ‘Proxy/Anonymizers’ but what if you have a website that you really want to open in isolation, regardless of what category it belongs to? This is what this article is about.  To make this work, we will be setting up a policy that activates RBI when a special header is injected into the request and then setup a browser to inject it. You can toggle this special header on/off whenever you want and expand your use-cases for RBI and consequently its value to your organization.  Follow the steps below to configure your Netskope

3502
qyost
8 months ago
A
AyyanarGNew Member III
asked in Next Gen SWG
How to test Patient Zero policy is really work or not

Hi team, We have created the Patient Zero threat protection policy in my environment, before enabling rule to wider group like to do testing that rule. could you guide me if anyway to do test in Realtime?

1313
ppasseri
Netskope Employee
8 months ago
M
MichaelLNew Member III
posted in Next Gen SWG
How to prevent use of Microsoft Copilot without commercial data protection with Netskope

Copilot with commercial data protection To help business and educational organizations protect corporate data, Copilot adds commercial data protection when eligible users sign in with their work or school accounts (Entra ID).Commercial data protection means user and organizational data are protected, prompts and responses are not saved, Microsoft has no eyes-on access, and chat data isn't used to train the underlying large language models. Unlike Copilot for Microsoft 365, Copilot has no access to organizational data in the Microsoft 365 Graph.Commercial data protection applies to users with eligible work or school accounts wherever Copilot is available. (https://learn.microsoft.com/en-us/copilot/overview#-with-commercial-data-protection) ___________________________________________________________________________________________________One way to prevent the use of Copilot without commercial data protection is to update the DNS configuration by setting the DNS entry for www.bing.com to

44922
D
9 months ago
Indu
Netskope Partner
InduNetskope Partner
posted in Next Gen SWG
Configuring CLI Tools for Netskope SSL Interpretation When encryptClientConfig Enabled

Hi Community Team, The feature flag "encryptClientConfig" is a part of client hardening and is disabled by default. When this feature flag is enabled, it will encrypt Netskope folder files in client systems (both windows and macbook).Example: Netskope adds nscacert.pem cert in "/Library/Application Support/Netksope/STAgent/data/" at the time of NS-client installation. When above feature flag is enabled, the file will be encrypted and will show as "nscacert.pem.enc". (Other files will be .enc too).This encrypt feature breaks the CLI-Tools with Netskope SSL Interception. So, following KB instructions will not work. https://docs.netskope.com/en/netskope-help/data-security/netskope-secure-web-gateway/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception/ I am reaching out to community to find a workaround for above instructions when "encryptClientConfig" is enbabled. Thanks & Regards,Indu

8071
J
9 months ago
L
ldoellNew Member III
asked in Next Gen SWG
Configuration/Audit log question

Hi. I recently came had a problem related to configuration. it had to do with making a change in the user notifcation. This was a global change. I changed a setting from browser to client which had a strange effect on our org. Normally when you make a change you generally have to “save” then click “apply” in this case you only click “save” for it to take effect. My question is why do changes not requiring “Apply” don’t show up in the audit logs?My second question is what change logs don’t show in the Audit log?   

961
edmundosammie
9 months ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
posted in Next Gen SWG
Operacional Procedure about Malware incidentes

Dear Netskope community, at the level of Malware/Malsites, there is something similar to the incident part, where the analyst can deal with the case opened by Q-Radar, like to sign the incident and classify it,  what do you do with these events or better what should I do? Another question, is it interesting to insert the hashes of Block events in IOCs lists, I ask it because the rule action is already a Block, I understand that inserting the hash already blocked in an IOC list is something redundant, right or wrong? I fully understand the possibilities of integration of Netskope Exchange with Service-Now, Siem Q-radar etc, but my question is more focused on operational procedure, the problem we find here is as to what action to take in the face of dozens of alerts forwarded to Service-now via Q-radar, and at each Malware event the Soc people keep registering hash in IoC list and it's like wiping ice,  there are dozens of events, we have this implemented for a Tenant with more than 9k u

750
thiagofc
Netskope Partner
9 months ago
M
munster
asked in Next Gen SWG
Threat Protection Scanning

Hi For the threat protection scanning,1) What is the scan policy setting?2) How do I show what are the file being scanned? thank

2396
M
9 months ago
M
munster
asked in Next Gen SWG
Block Zip File Contains Executable

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

4575
ejang
Netskope Employee
9 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings