Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 285 Topics
  • 668 Replies
285 Topics
M
Matt_G_82New Member III
asked in Next Gen SWG
Netskope client dropping connection on Mac when idle / sleeping

Hi, i am having an issue on mac devices. When i am away from my device for a period of time (normally an hour) i will have to re authenticate via OKTA to outlook and teams, i have worked out this is because my netskope client is somehow dropping connection and as a result im coming from my home IP address which isnt allowed on the Microsoft end. Has anyone else noticed this behaviour, i have seen a battery setting on the Mac that i think will fix it but i just wondered if this was common.

4895
F
Netskope Employee
6 months ago
N
ndudaExplorer
asked in Next Gen SWG
Uptick in "Error code = 0x80010106"

Windows onlyWe noticed that starting last week we’ve been getting reports of a lot of windows agents where NPA is disabled and the Agent Config doesn’t update. A reboot solves this. We’ve never had a single issue with Windows endpoints in years, now this. We’ve opened a ticket but curious if anyone else is seeing this.2024/03/04 10:37:09.253 stAgentUI pbb4 tbc0 error osUtils.cpp:358 nsUtil Failed to initialize COM library. Error code = 0x80010106One observation we have is that when this started (last week) there was a push from our IT team to get Windows updates applied. 

1282
N
6 months ago
M
munster
asked in Next Gen SWG
Wireshark vs Netskope Packet Capture

HiIs there a difference between wireshark vs netskope packet capture when collecting trace?thank

4303
B
6 months ago
myee
Netskope Employee
myeeNetskope Employee
posted in Next Gen SWG
New Guide on Netskope SCIM API Available

Some of you may know that Netskope has a SCIM API which can be integrated with IDP's such as Okta, Azure AD, etc., to provision User's and Group's into a Netskope tenant.  This is a critical part of deploying Netskope since the User provisioning is a pre-requisite to deploying the Netskope client.   There are certain times that you may not want to integrate with the IDP or maybe you are transitioning from an on-prem Identity Store to a cloud based one and aren't quite ready, but you still want to test Netskope functionality.   The SCIM API can also be used to manually create users and groups and add the users into groups so that they can both be leveraged in Netskope real-time protection policies.  The guide provides a walk through on how to accomplish this task.   If you have some ideas on how to improve the guide or on any additions, please reach out to me to discuss.

92612
thiagofc
Netskope Partner
6 months ago
X
xstuartbarrettxNew Member III
asked in Next Gen SWG
Bulk URL Lookups

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

3114
F
Netskope Employee
6 months ago
M
munster
asked in Next Gen SWG
Captive Notification and Timeout

Hi I have questions about Captive  usageNotification - Can it be customized with our own words?   Timeout 10min -  If failed to pass captive after 10min, the traffic is blocked.   How can I re-enable again captive login?  Do I close and open the browser to have the captive login?  Do I have to reboot?  etc….  Thank

2721
F
Netskope Employee
6 months ago
Indu
Netskope Partner
InduNetskope Partner
asked in Next Gen SWG
Netskope client SSL decryption issues

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as we mention in SSL BYPASS. Same sites with SSL bypass- websites (with SSL bypass) are loading every time without intermittent issues- w

13665
B
7 months ago
M
munster
asked in Next Gen SWG
Only can access from local country IP

HiIn some countries, gov website can only access from local country IPs.  Any IP assign outside of the country will deny access.As we are using 163.116.x.x, user resides in that country was unable to access too.  How can we remediate this use case?thank

4059
S
Netskope Employee
7 months ago
K
KrugerNew Member
asked in Next Gen SWG
FTP (TCP 21) Controls

with an inline solution that is steering all traffic to the swg. Is there any controls that can be put in place of FTP(TCP 21)traffic? DLP? Malware? etc..

2781
ejang
Netskope Employee
7 months ago
M
munster
asked in Next Gen SWG
How to tell if URL was manually access by user or refer by link?

HiHow can I tell if URL was manually access by user or refer by link?Eg,  in a webpage, there were images downloaded from S3 storage vs user goto the S3 storage. Thank

1641
F
Netskope Employee
7 months ago
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
on-demand Remote Browser Isolation - use RBI for any website!

RBI or Remote Browser Isolation is a technology that allow users to open websites on a disposable container and only get the pixels from it, like a VDI, preventing any threats from the website to ever touch the user browser. Since this technology makes use of disposable browser containers for rendering sites, it consequently makes the browsing session not only safe but also anonymous.  Normally, RBI is configured to isolate high risk categories like ‘uncategorized’ and ‘Proxy/Anonymizers’ but what if you have a website that you really want to open in isolation, regardless of what category it belongs to? This is what this article is about.  To make this work, we will be setting up a policy that activates RBI when a special header is injected into the request and then setup a browser to inject it. You can toggle this special header on/off whenever you want and expand your use-cases for RBI and consequently its value to your organization.  Follow the steps below to configure your Netskope

3352
qyost
7 months ago
A
AyyanarGNew Member III
asked in Next Gen SWG
How to test Patient Zero policy is really work or not

Hi team, We have created the Patient Zero threat protection policy in my environment, before enabling rule to wider group like to do testing that rule. could you guide me if anyway to do test in Realtime?

1273
ppasseri
Netskope Employee
7 months ago
M
MichaelLNew Member III
posted in Next Gen SWG
How to prevent use of Microsoft Copilot without commercial data protection with Netskope

Copilot with commercial data protection To help business and educational organizations protect corporate data, Copilot adds commercial data protection when eligible users sign in with their work or school accounts (Entra ID).Commercial data protection means user and organizational data are protected, prompts and responses are not saved, Microsoft has no eyes-on access, and chat data isn't used to train the underlying large language models. Unlike Copilot for Microsoft 365, Copilot has no access to organizational data in the Microsoft 365 Graph.Commercial data protection applies to users with eligible work or school accounts wherever Copilot is available. (https://learn.microsoft.com/en-us/copilot/overview#-with-commercial-data-protection) ___________________________________________________________________________________________________One way to prevent the use of Copilot without commercial data protection is to update the DNS configuration by setting the DNS entry for www.bing.com to

44102
D
8 months ago
Indu
Netskope Partner
InduNetskope Partner
posted in Next Gen SWG
Configuring CLI Tools for Netskope SSL Interpretation When encryptClientConfig Enabled

Hi Community Team, The feature flag "encryptClientConfig" is a part of client hardening and is disabled by default. When this feature flag is enabled, it will encrypt Netskope folder files in client systems (both windows and macbook).Example: Netskope adds nscacert.pem cert in "/Library/Application Support/Netksope/STAgent/data/" at the time of NS-client installation. When above feature flag is enabled, the file will be encrypted and will show as "nscacert.pem.enc". (Other files will be .enc too).This encrypt feature breaks the CLI-Tools with Netskope SSL Interception. So, following KB instructions will not work. https://docs.netskope.com/en/netskope-help/data-security/netskope-secure-web-gateway/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception/ I am reaching out to community to find a workaround for above instructions when "encryptClientConfig" is enbabled. Thanks & Regards,Indu

7271
J
8 months ago
L
ldoellNew Member III
asked in Next Gen SWG
Configuration/Audit log question

Hi. I recently came had a problem related to configuration. it had to do with making a change in the user notifcation. This was a global change. I changed a setting from browser to client which had a strange effect on our org. Normally when you make a change you generally have to “save” then click “apply” in this case you only click “save” for it to take effect. My question is why do changes not requiring “Apply” don’t show up in the audit logs?My second question is what change logs don’t show in the Audit log?   

941
edmundosammie
8 months ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
posted in Next Gen SWG
Operacional Procedure about Malware incidentes

Dear Netskope community, at the level of Malware/Malsites, there is something similar to the incident part, where the analyst can deal with the case opened by Q-Radar, like to sign the incident and classify it,  what do you do with these events or better what should I do? Another question, is it interesting to insert the hashes of Block events in IOCs lists, I ask it because the rule action is already a Block, I understand that inserting the hash already blocked in an IOC list is something redundant, right or wrong? I fully understand the possibilities of integration of Netskope Exchange with Service-Now, Siem Q-radar etc, but my question is more focused on operational procedure, the problem we find here is as to what action to take in the face of dozens of alerts forwarded to Service-now via Q-radar, and at each Malware event the Soc people keep registering hash in IoC list and it's like wiping ice,  there are dozens of events, we have this implemented for a Tenant with more than 9k u

750
thiagofc
Netskope Partner
8 months ago
M
munster
asked in Next Gen SWG
Threat Protection Scanning

Hi For the threat protection scanning,1) What is the scan policy setting?2) How do I show what are the file being scanned? thank

2386
M
8 months ago
M
munster
asked in Next Gen SWG
Block Zip File Contains Executable

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

4325
ejang
Netskope Employee
8 months ago
T
toshiyukiNew Member
asked in Next Gen SWG
CapCut native application for IOS is not available

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

840
T
8 months ago
T
toshiyukiNew Member
posted in Next Gen SWG
CapCut native application for IOS is not available

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

1130
T
8 months ago
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Next Gen SWG
agent installation

agent installationI want to install the agent on several machines that I cannot reach either by invitation or through GPO.Is there a way to give an installer to the support staff and they go machine by machine to install the netskope agent and then the end users enter and authenticate with their user? If, for example, I download from this route https://download-<;your-tenant-name>.goskope.com/dlr/win/get and the support staff installs it correctly?

8152
msouza
Netskope Employee
8 months ago
M
munster
asked in Next Gen SWG
How to block Online Advertisement

HiWhen access www.businesstimes.com.sg, a full page advertisement will popup.  I have to click “X” to close in order to access to the actual content. How can I block this full page advertisement?  I tried “Online Ad”, but did not work.Likewise, how to cleaning remove the top advertisement border in “cnn.com”?Pls advise

3125
ejang
Netskope Employee
8 months ago
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
Netskope ThreatLibrary is live!

Hello Netskope Community,  Have you ever asked yourself (or someone) if “Netskope Threat protection have signature coverage for [insert name of threat here]? “Well, in case yes, now we have an easy tool that can help you find the answer. The threat labs team just released an online database with all the signatures and protections we have in place, broken down by CVE, engine, family and MITRE ATT&CK information.  check it out here: https://threatlibrary.netskopethreatlabs.com/ Now you know! Stay safe out there! Fabio 

1041
Rohit_Bhaskar
Netskope Employee
8 months ago
M
munster
asked in Next Gen SWG
Show Coaching Webpage Notification

HiI have a RTP allow for video streaming with webpage coaching notification to inform user.How do I configure it to show the coaching page everytime it was access to those site? Thank

1062
M
8 months ago
M
munster
asked in Next Gen SWG
Does Windows Steer Traffic after fresh bootup

HiFor a just booted up laptop and yet to login, can the agent steer web traffic to Netskope?   Or it has to login to steer web traffic?  Thank 

1334
Rohit_Bhaskar
Netskope Employee
8 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings