Next Gen SWG

Dear Netskope community, at the level of Malware/Malsites, there is something similar to the incident part, where the analyst can deal with the case opened by Q-Radar, like to sign the incident and classify it,  what do you do with these events or better what should I do? Another question, is it interesting to insert the hashes of Block events in IOCs lists, I ask it because the rule action is already a Block, I understand that inserting the hash already blocked in an IOC list is something redundant, right or wrong? I fully understand the possibilities of integration of Netskope Exchange with Service-Now, Siem Q-radar etc, but my question is more focused on operational procedure, the problem we find here is as to what action to take in the face of dozens of alerts forwarded to Service-now via Q-radar, and at each Malware event the Soc people keep registering hash in IoC list and it's like wiping ice,  there are dozens of events, we have this implemented for a Tenant with more than 9k u

Hi For the threat protection scanning,1) What is the scan policy setting?2) How do I show what are the file being scanned? thank

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

agent installationI want to install the agent on several machines that I cannot reach either by invitation or through GPO.Is there a way to give an installer to the support staff and they go machine by machine to install the netskope agent and then the end users enter and authenticate with their user? If, for example, I download from this route https://download-<;your-tenant-name>.goskope.com/dlr/win/get and the support staff installs it correctly?

HiWhen access www.businesstimes.com.sg, a full page advertisement will popup.  I have to click “X” to close in order to access to the actual content. How can I block this full page advertisement?  I tried “Online Ad”, but did not work.Likewise, how to cleaning remove the top advertisement border in “cnn.com”?Pls advise

Hello Netskope Community,  Have you ever asked yourself (or someone) if “Netskope Threat protection have signature coverage for [insert name of threat here]? “Well, in case yes, now we have an easy tool that can help you find the answer. The threat labs team just released an online database with all the signatures and protections we have in place, broken down by CVE, engine, family and MITRE ATT&CK information.  check it out here: https://threatlibrary.netskopethreatlabs.com/ Now you know! Stay safe out there! Fabio 

HiI have a RTP allow for video streaming with webpage coaching notification to inform user.How do I configure it to show the coaching page everytime it was access to those site? Thank

HiFor a just booted up laptop and yet to login, can the agent steer web traffic to Netskope?   Or it has to login to steer web traffic?  Thank 

Good morning,in order to understand how to administratively place the purchase of Netskope I am being asked to understand if Netskope can in any way function if the Netskope Client is unable to contact the gateway in the cloud or if, as I imagine it is, all traffic goes through the firewall.

Re: Support Case00347414 I am having issues with Facetime when Netskope is enabled. I am steering "All Traffic" I have created a certificate pinned app for the facetime process and bypassed * all domains from steering config.  Whether this cert pinned app is enabled, or not - the issue persists. I have ALLOW-ALL rules set for cloud apps, all web traffic, and cloud firewall. I also have numerous Apple domains set to Do Not Decrypt in SSL Decryption policy.  Looking for assistance from others who may have encountered this in there deployment.  @sshiflett any ideas? NS Debug Logs with Cert Pinned App disabled: 2023/11/20 11:36:43.519144 stAgentNE p2668 t18363 info tunnel.cpp:873 nsTunnel DTLS [sessId 120352348] Tunneling flow from addr: 1.0.0.1:51979, process: facetime to host: gateway.icloud.com, addr: 17.248.193.19:443 to nsProxy 2023/11/20 11:36:43.652241 stAgentNE p2668 t9523 error nsClientFlow.mm:200 nsClientFLow Find UDP flow id

Hi guys! Just a quick question since a requirement from senior management just arrived:Is it possible to filter (allow / deny) web traffic to google workspace services based on domain or tenant id?The idea is to allow only some tenants or domains to access google workspace resources (and denying all personal services) via SWG configuration. Best regards to all!

Hi What is your best practice?  Do you block ALL and allow as require? Or Allow ALL and block as require?How do I log all web access activity whether is blocked or allowed?  Eg, do a google search, go to new site, upload file to storage etc.  Do I need to write policy to do it? ThankMunster

In order to view actual policy violating identifiers such as SSN, Credit Card numbers, First / Last Names you must create a Forensic Profile on a supported repository such as Azure Blob, Sharepoint https://docs.netskope.com/en/netskope-help/data-security/forensics/

Hi I have issue uploading file to a storage site that has "Host Name Mismatch" error. Further troubleshooting, it was related to "Security Cloud Platform-> Traffic Steering-> Steering Configuration-> MANAGE ERROR SETTINGS-> SSL Host Mismatch" which was set to "BLOCK".  Hence, a) Where can I find the 'SSL Host Mismatch" error in Skope-IT?b) How can I exclude this storage site from the above 'SSL Host Mismatch" Block setting?  Thank

Hi,Not sure if there's already a similar question posted somewhere, In the Administration > Audit Log section:When clicking on the gear, the options to select are "User, Severity, Activity" .  There is no option to show comments/notes entered for a specific activity logged. Is there a way to add another column in the Audit Log that can show the comments that were entered when adding/modifying a policy/persona/rule?  It seems odd that while add/changing/modify/removing a rule/policy, you're prompted to add (which is optional) a comment/note before saving/applying a change to an activity performed but never can locate or view the comments in the Audit log.Are the comments details located in another section of Netskope? Are they retrievable?  if yes, will the notes/comments still be linked to the very activity event that was performed at the time when the comments were entered? orIf not, could this be a consideration as an additional enhancement in the next release/upgrade/patch to the

Hi User can only access corporate M365 tenant. To prevent data leakage,  we will like to block M365 non-tenant access such onedrive, sharepoint, email, etc?  How can I do config it? thankMunster

Hi There are predefined list such as abortion, etc.  How can I block domain that has NOT been category yet? thankMunster

I'm having trouble accessing Nginx locally, which is running with Docker and Netskope client enabled.I need to use the Nginx Docker image for development on some machines; however, when the Netskope client is enabled, I can't access the web server via http://127.0.0.1:8080. When I disable the client, access works fine. Has anyone experienced a similar issue?

We block the download of certain files, such as msi, and exe.  Microsoft delivery optimization uses random IPs within the URL to download these updates, and some IPs might not even be owned by Microsoft.  Below is an example of a download: 151.139.71.28/filestreamingservice/files/814b848b-a4e4-48f7-9dc0-b18b57f6c9f3?P1=1707275479&P2=404&P3=2&P4=XS3dTPEuizRfF1O1rjyxG4xt4%2f7vGGgU0h4OKnajgEDC0tollwGtN5fmEf1kuPFohFTDKuVPTCg9zrAoEck6sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.comWe would like to include a regex or some sort of wild card to allow these.  The URL always seems to include: delivery.mp.microsoft.com When we allow URLs, we add the URLs to a URL list, which is tied to category.  I see we can use regex, but I am not certain if the URL needs the hostname???  I am also not sure how the regex would look.  I opened a case with support, but they referenced me to regex101 website, but that was really it, so hoping the Netskope community might be able t

Can we allow only specific URL and block every other web application in browser using NG SWG solution??If yes, how do we set a policy??

I understand the underlying premise for Netskope's recommendation for blocking DNS over HTTPS, to mitigate exfiltration risk, etc. However, with the industry push to move to DOH, won't we need to allow DOH traffic at some point? Most of our users browsers are configured to try DOH first, and some of them seem to be running into issues if DOH is not available and falling back to traditional udp 53 fails. I also don't understand why Netskope says they don't support DOH traffic steering. (See https://docs.netskope.com/en/netskope-help/data-security/real-time-protection/best-practices-for-real-time-protection-policies/best-practices-for-utility-policies/#recommended-utility-policy-2-1) It would seem Netskope DOES support it since we ARE steering DOH traffic to Netskope, Netskope identifies the DOH traffic, and then blocks it with the Block DOH real time protection policy. So what does Netskope mean when they say "DNS over HTTPS is not a supported protocol for Netskope steering (C

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You

This content can be found on the Netskope Support portal https://support.netskope.com/s/article/Blocking-Microsoft-Co-Pilot