Next Gen SWG

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create SAML groups using “memberof” values from the SAML assertion response and configure policies in advance even before intercepting user traffic Friendly group name mapping: Netskope administrators can manually map SAML attribute values to user-friendly group names for simplified management and improved clarity in policy configurat

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Rest API V2 token provisioning workflow. Previous Method: Historically, API tokens were provisioned through the user interface by navigating to Tools -> Rest API V2. Impact of RBAC V3 Enablement: Once RBAC V3 functionality is activated on a tenant, the aforementioned Rest API V2 tok

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks

This is just in reference to this thread that I found very helpful but am unable to add a comment.All microsoft delivery optimization - regex.... | CommunityJust in case people find it helpful, I found that the regex wasn’t capturing everything and had to add a few of my own.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b.*\/msdownload\/.* I found that the following examples were being blocked:70.156.87.153/c/msdownload/update/software/updt/2025/03/windows11.0-kb5054980-x64-ndp481_d8ca7b3b24823cc8480dbe3cf3355ae0ca0c311e.cab?cacheHostOrigin=2.au.download.windowsupdate.com177.128.21

Hi all,Has anyone had any issues with using the Netskope proxy and Microsoft Safelinks?We currently use Microsoft safelinks to protect clicks within the Microsoft suite.It is sporadic, but if a user clicks a link within an email, (typically marketing emails) Netskope correctly blocks access due to a SSL mismatch.if we use the safelink decoder to get the actual URL,  we can get to the website without any issues.its two popular products, so i’m assuming others have this same issue, any ideas? We don’t want to bypass the SSL Host Mismatch error. thanks  

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in

Verbally, Netskope indicates that installation of client on servers because the client is dependent on login for policy. I am looking for that documented.   Has anyone seen that?  

HiIs there anyway to block python from access internet to download packages?Whether from VSC or cmdline, etc? thank 

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

Is there a way to dump out the Network Locations and which IP address are contained in each?

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

Good afternoon, thank you for your time and good vibes.I have the following situation:We know that by default at Global level, Netskope, is blocking sites with self signed certificates.In certain cases there are sites we say "known" somewhat controlled, where there are VPN access portals, sites or systems with self-signed certificates, etc..Now the idea is not to apply it globally, but by means of exceptions, so as not to allow all sites with self-signed certificates, but only some based on need and demand.Then I tried to apply a web policy, with action Bypass and it did not work, it still shows the blocking of sites with self signed certificate, as I did not intend to allow it globally, I added a policy, of SSL decrypt, to not make decrypt to a custom web category, that contains these sites, to omit or bypass the blocking. Well this worked, but with this I feel that we lose visibility and inspection to these sites, therefore, please clarify what is the position, recommendation, proced

Hello enthusiasts, I have been configuring the device classification rule for iOS devices with criteria “REQUIRE PASSCODE” only. Although I have removed the passwords in test device (iPad) the Netskope found to be unable to detect the device as “unmanaged” hence the Realtime policy I configured against the “unmanaged devices” did not work as expected. I would request all the folks who have expertise in this matter to help me with your valuable guidance to troubleshoot and fix this. Meanwhile I am testing all the possible scenarios to fix this. Regards,Saifin Thomas

Some context related to user regulation, we found that once users are imported, we can not delete them on the console.We would like to control that only certain users can use Netskope service but integrated idp will have all employee information including ex-employees, so they can still using Netskope SSE and we can only manually set blocking policy to stop their access.In this case, we haven’t come out a way to grant only rightful users to enable Netskope clients, and stop/remove Netskope clients from their byod.Does anyone have any suggestion on this?How can we develop a better user regulation mechanism to enable correct amount of licensed user?Thanks a lot.

Can anyone help me in understanding the below error logs and what could be the issue here.Thank you in advance! User's Netskope client is in disabled state. 2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error NSCom2.cpp:863 NSCOM2 bind failed on sever socket 100132023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:2147 nsAgentSvc Token not found in the client name2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:1225 nsAgentSvc Failed to get session details on NSCom error

Hello Skope community!I hope everyone is doing well.I would like to tell you that I have related IDP configuration with AzureAD for the install via IDP, using reverse proxy for NPA access over Web-browser, among other experiences with Netskope in labs, POC, production environments, among others.Now I have to configure Reverse Proxy for the following environment.-Control access to office 365 suite (Sharepoint, Onedrive, Outlook, etc.)- IDP Azure-AD / Entra ID.Environment with users with Netskope agent, with steering profiles forwarding all office 365 (SSL Exception Pining Apps O365) to Netskope.Environment with users with Netskope agent, with steering profiles with bypass of office 365.What is sought with the use of Reverse Proxy, control access, upload, download, authentication, etc. to Office 365, of unmanaged computers.I have already been in the process of analyzing and reviewing Links to document and be able to read, analyze and acquire information for the configuration.https://docs

when I modify a policy or configuration change it takes a long time to apply the changes and I have to force the client to apply them (deactivating and activating) does anyone know another way to apply them automatically?   attached client screenshot after adding an exception in Security Cloud Platform > Traffic Steering