Next Gen SWG

HiHow do you group to view the sequence of event for web access?Eg, Access to website, aaa.com which redirect to okta.com and redirect to bbb.com, etc ……If you can image it will be like “Wireshark Follow TCP Stream”.  I can view go thru each event but is inefficient and can missed out detail.  thx

We’ve yet to implement any HTTP Header elements and policies but have a use case where I believe this is the best solution. However, I wanted to get some guidance.Use Case: Dept wants a specific account (ex. - staff1@email.com) to only be able to access 3 sites (I’ll use examples):  newssite1.com newssite2.com one.teamspace.com All other sites are to be blocked completelyWe tested this by:building out URL List + Custom Category for the above list of URL’s creating a RTP policy to allow the sites via Custom Category for staff1@email.com creating a RTP policy to block remaining categories for staff1@email.com placing this well below the allow policy With the nature of news sites, though, everything feeding the content for the site (content servers, ads, other domains, etc) were blocked and unusable. Since “browse” for the rest of the web needs to be blocked, RBI wasn’t an applicable solution. I’ve since set the “block” policy to “alert” to glean more information on the web categories

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.co created a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit allow. I h

Hello,An integration was carried out between Netskope and Postman version 11.1.25, groups and users are already synchronized, but it does not allow the names to be modified once they are created. You are trying the following json: POST /groups/{groupId}/rename { "name": "New group name" } When the change is made it does not throw any error, on the contrary it sends 200 OK. Thank you

We are really excited to introduce the next phase of the Wiz and Netskope app instance integration.  OverviewThe risk of unauthorized data movement is very real and something we see security administrators often having to deal with - this includes the need to identify what’s going on, understand where data is moving to, and ultimately implement policies to limit this data movement and this is where instance controls can be very effective, giving administrators immense control over what to allow and what to ‘inspect’(for data loss prevention policies) and what to outright block.  Netskope’s industry leading Secure Access Services Edge (SASE)  offering provides not only control of access to your SaaS and IaaS apps and environments, but this control extends to “instances” of these apps and environments. What does this mean? Netskope not only has the ability to identify and control(block uploads, downloads etc.) the usage of AWS S3(say), you can also implement these controls to be specific

Could we manage browser extensions (including installation and execution) using NGSWG for MS edge and firefox?  

Hi Team, Can we have mapped categorization from Zscaler Palo alto Forcepoint Cloudflare Sky high to Netskope its very ease for the deployment prepective.

Hi team, I am Doing a Pov for one of my customer can you please provide me the list of harmful url where their i can test the Netskope is able to protect you from Threats Like Cross site scripting, Crypto mining, virus spyware Botnets. Please suggest me the website so i can show test to them also please dont suggest eicar and netskope security check. 

Greetings, I want to manage a computer without installing the Netskope client, I understand that I can install a Netskope CA certificate but I don't know if this allows me to create a policy in real time and apply it to this machine?download from the tenant Certificates option the one that says NETSKOPE ROOT CERTIFICATE and install on the machine then create a policy in real time but it does not apply, I do not see the equipment as managed within the tenant, but perhaps that is not the procedure.Could someone help me with the step by step to manage and apply real time policies through the certificate.

Hi, my organization is having some certificate issues with VMs in VMWare and VirtualBox. I attempted to make a custom cert pinned application using the process seen in the NS client NSdebuglog files, which did not work as expected. I have been working with support for a solution but I am hoping the community has an idea on how to solve this. 

Hi I am seeing in our client logs a lot of DTLS disconnects, we’ve lowered the MTU to 1300 too!! 2024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1093 nsssl DTLS SSL_write failed, err: 336642382, syserr: 02024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1096 nsssl DTLS SSL_write failed, errStr: error:1410C14E:SSL routines:dtls1_write_app_data_bytes:dtls message too big2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 error tunnel.cpp:898 nsTunnel DTLS nsssl_write failed, err: -12024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:681 nsssl nsssl_disconnect enter2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:1140 nsssl DTLS SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1164 nsssl DTLS Exit SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1606 nsssl DTLS Closing sock 14202024/05/24 15:03:05.328 stAgentSvc p38ec td2c info nsssl.cpp:1905 nsssl on socket close for socket 14202024/05/24 15:0

Hi,New here and I would like to ask if possible and if not where there is a wish a feature option.I had some naughty users who were  disabling the Netskope client (WISHLIST can it be disabled only by inputting a password )Under client Configuration > Tamperproof, I have selected to Hide Client Icon os system tray.Now, my question is, I would like to make sure that all my users are client-enabled on their windows computers.Is there a simple way to do it? Powershell preferably.Thanks E

Hello Netskope Community,  You’ve probably seen some other Netskope publications around GenAI adoption but this one specifically addresses organizations that haven’t started their journey yet and want to leverage a Zero Trust approach when it comes to GenAI apps like ChatGPT and others which have been fueling a lot of development and discussion at organization of all sizes due to its innovation possibilities but also by their perceived risks.  With the recent announcement of the extended license of RBI, admins can utilize our Remote Browser Isolation technology to provide access to apps based on application tags and their observed risk translated through the CCL (Cloud Confidence Level) values. Let's explore two scenarios which are possible by using this approach: Company has currently been blocking all GenAI apps but wants to allow access to at least ChatGPT via Remote Browser Isolation so users cannot paste corporate data into it or copy from it but still interact with the Assistant.

Hi, i am having an issue on mac devices. When i am away from my device for a period of time (normally an hour) i will have to re authenticate via OKTA to outlook and teams, i have worked out this is because my netskope client is somehow dropping connection and as a result im coming from my home IP address which isnt allowed on the Microsoft end. Has anyone else noticed this behaviour, i have seen a battery setting on the Mac that i think will fix it but i just wondered if this was common.

Windows onlyWe noticed that starting last week we’ve been getting reports of a lot of windows agents where NPA is disabled and the Agent Config doesn’t update. A reboot solves this. We’ve never had a single issue with Windows endpoints in years, now this. We’ve opened a ticket but curious if anyone else is seeing this.2024/03/04 10:37:09.253 stAgentUI pbb4 tbc0 error osUtils.cpp:358 nsUtil Failed to initialize COM library. Error code = 0x80010106One observation we have is that when this started (last week) there was a push from our IT team to get Windows updates applied. 

HiIs there a difference between wireshark vs netskope packet capture when collecting trace?thank

Some of you may know that Netskope has a SCIM API which can be integrated with IDP's such as Okta, Azure AD, etc., to provision User's and Group's into a Netskope tenant.  This is a critical part of deploying Netskope since the User provisioning is a pre-requisite to deploying the Netskope client.   There are certain times that you may not want to integrate with the IDP or maybe you are transitioning from an on-prem Identity Store to a cloud based one and aren't quite ready, but you still want to test Netskope functionality.   The SCIM API can also be used to manually create users and groups and add the users into groups so that they can both be leveraged in Netskope real-time protection policies.  The guide provides a walk through on how to accomplish this task.   If you have some ideas on how to improve the guide or on any additions, please reach out to me to discuss.

Hi I have questions about Captive  usageNotification - Can it be customized with our own words?   Timeout 10min -  If failed to pass captive after 10min, the traffic is blocked.   How can I re-enable again captive login?  Do I close and open the browser to have the captive login?  Do I have to reboot?  etc….  Thank

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as we mention in SSL BYPASS. Same sites with SSL bypass- websites (with SSL bypass) are loading every time without intermittent issues- w

HiIn some countries, gov website can only access from local country IPs.  Any IP assign outside of the country will deny access.As we are using 163.116.x.x, user resides in that country was unable to access too.  How can we remediate this use case?thank

with an inline solution that is steering all traffic to the swg. Is there any controls that can be put in place of FTP(TCP 21)traffic? DLP? Malware? etc..

HiHow can I tell if URL was manually access by user or refer by link?Eg,  in a webpage, there were images downloaded from S3 storage vs user goto the S3 storage. Thank

RBI or Remote Browser Isolation is a technology that allow users to open websites on a disposable container and only get the pixels from it, like a VDI, preventing any threats from the website to ever touch the user browser. Since this technology makes use of disposable browser containers for rendering sites, it consequently makes the browsing session not only safe but also anonymous.  Normally, RBI is configured to isolate high risk categories like ‘uncategorized’ and ‘Proxy/Anonymizers’ but what if you have a website that you really want to open in isolation, regardless of what category it belongs to? This is what this article is about.  To make this work, we will be setting up a policy that activates RBI when a special header is injected into the request and then setup a browser to inject it. You can toggle this special header on/off whenever you want and expand your use-cases for RBI and consequently its value to your organization.  Follow the steps below to configure your Netskope

Hi team, We have created the Patient Zero threat protection policy in my environment, before enabling rule to wider group like to do testing that rule. could you guide me if anyway to do test in Realtime?

Copilot with commercial data protection To help business and educational organizations protect corporate data, Copilot adds commercial data protection when eligible users sign in with their work or school accounts (Entra ID).Commercial data protection means user and organizational data are protected, prompts and responses are not saved, Microsoft has no eyes-on access, and chat data isn't used to train the underlying large language models. Unlike Copilot for Microsoft 365, Copilot has no access to organizational data in the Microsoft 365 Graph.Commercial data protection applies to users with eligible work or school accounts wherever Copilot is available. (https://learn.microsoft.com/en-us/copilot/overview#-with-commercial-data-protection) ___________________________________________________________________________________________________One way to prevent the use of Copilot without commercial data protection is to update the DNS configuration by setting the DNS entry for www.bing.com to