Next Gen SWG

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security.

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffi

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should b

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create S

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Re

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks

This is just in reference to this thread that I found very helpful but am unable to add a comment.All microsoft delivery optimization - regex.... | CommunityJust in case people find it helpful, I found that the regex wasn’t capturing everything and had to add a few of my own.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b.*\/msdownload\/.* I found that th

Hi all,Has anyone had any issues with using the Netskope proxy and Microsoft Safelinks?We currently use Microsoft safelinks to protect clicks within the Microsoft suite.It is sporadic, but if a user clicks a link within an email, (typically marketing emails) Netskope correctly blocks access due to a SSL mismatch.if we use the safelink decoder to get the actual URL,  we can get to the website without any issues.its two popular products, so i’m assuming others have this same issue, any ideas? We don’t want to bypass the SSL Host Mismatch error. thanks  

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinat

Verbally, Netskope indicates that installation of client on servers because the client is dependent on login for policy. I am looking for that documented.   Has anyone seen that?  

HiIs there anyway to block python from access internet to download packages?Whether from VSC or cmdline, etc? thank 

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

Is there a way to dump out the Network Locations and which IP address are contained in each?

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem:

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

Good afternoon, thank you for your time and good vibes.I have the following situation:We know that by default at Global level, Netskope, is blocking sites with self signed certificates.In certain cases there are sites we say "known" somewhat controlled, where there are VPN access portals, sites or systems with self-signed certificates, etc..Now the idea is not to apply it globally, but by means of exceptions, so as not to allow all sites with self-signed certificates, but only some based on need and demand.Then I tried to apply a web policy, with action Bypass and it did not work, it still shows the blocking of sites with self signed certificate, as I did not intend to allow it globally, I added a policy, of SSL decrypt, to not make decrypt to a custom web category, that contains these sites, to omit or bypass the blocking. Well this worked, but with this I feel that we lose visibility and inspection to these sites, therefore