Skip to main content
  • EN

Other Forums

Dive into the Netskope Forums Community for comprehensive discussions on cloud security, network protection, and innovative cybersecurity solutions. Connect with experts and peers to share knowledge, experiences, and best practices in safeguarding digital assets and ensuring secure cloud adoption.

196 Topics
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Additional Discussions
Hub - Spoke gateway - Dynamic Public IP - Spokes-branchs

Hub - Spoke gateway - Dynamic Public IP ( Spokes-branchs )  Hello community, good afternoon.  I have a question regarding the sdwan borderless wan part of Netskope. Understanding a Hub-Spoke architecture Where I have one or a few SDWAN Gateway in Hub mode and other Spoke branches with their corresponding gateways. My doubt is the following. If I have Spoke/BranchOffice sites, where eventually there is a need for some other connection from the other branches to some particular resource of that branch, I would understand that it is not necessary that my Gateway - Spoke sdwan does not have static public IP, but dynamic either by 4G/5G or some high quality ADSL connection and / or public IP links Dynamics, for the Gateways / Spoke would not be critical to have static public IP where if in the case of the Hub if you have preferably static Public IP and / or port forwarding to the IP of the gateway-sdwan. Hub, but if it could allow and set up the tunnels and according to the policies would a

0
MetgatzNK
Netskope Partner
2 days ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Cribl Netskope Events and Alerts Integration

Cribl Netskope Events and Alerts Integration Netskope’s Events and Alerts can be pulled into Cribl via the Netskope REST v2 APIs. You can use Cribl Stream to filter and redirect to the destination of your liking. Note: Netskope Steaming Events (WebTx) aren’t supported currently. RequirementsNetskope tenant with API v2 enabled Cribl Stream accountSetup StepsNetskope Generate API token CriblCreate Data Source VerifySave and Run NetskopeGenerate API tokenIn your Netskope tenant go to Settings > Tools > REST API v2 > New Token  Add permission scopes to the token. You will need to add all scopes that you want to pull. In my example, I am going to grab all Events and Alerts. Give your token a name, and expiration period. Use the following scopes Events/api/v2/events/dataexport/events/application/api/v2/events/dataexport/events/audit/api/v2/events/dataexport/events/incident/api/v2/events/dataexport/events/infrastructure/api/v2/events/dataexport/events/network/api/v2/events/dataexport

3
Gary-Jenkins
Netskope Employee
20 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
posted in Netskope Threat Protection
[Cloud Threats Memo] Iranian Threat Actors Continue to Exploit Azure

One of the advantages of exploiting a cloud service to host the attack infrastructure, is that the threat actors can use either a legitimate compromised account or create a new one specifically for their malicious purposes. According to researchers at Microsoft, this modus operandi has been used by APT33 (also known as “Peach Sandstorm”) - a threat actor believed to operate on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC)  - in their latest campaign, tracked between April and July 2024 and targeting organizations in the education, satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the United Arab Emirates. This campaign is characterized by a really interesting attack chain: the threat actors used LinkedIn to gather intelligence on their targets. From there, they launched password-spraying attacks to break into their victims’ accounts and

0
ppasseri
Netskope Employee
22 days ago
B
brohanFTFCUNew Member III
posted in Additional Discussions
Netskope Splunk dashboards

Has anyone created any useful Splunk dashboards from the Netskope Splunk Add-on that they are willing to share with the community?

1
J
23 days ago
N
nadkickNew Member III
asked in Additional Discussions
Identify mode of enrollment (UPN vs IdP)

Hello,Is there a way in the tenant to identify on how a user has been enrolled (UPN vs IdP)? In preparation for mitigating Netskope’s enrolment vulnerability, we need to find a way to identify users/devices that are affected as they have been enrolled using UPN mode (we starting with UPN and switched to IdP for new subsidiaries). In addition, this might be a way to identify devices that should not be there (aka exploited the vulnerability).Thank you!Regards,Nadja

1
ns-ssalomon
Netskope Employee
28 days ago
prajakta.yadav
Netskope Partner
prajakta.yadavNetskope Partner
asked in Additional Discussions
Remediation profile

Hi, We want to integrate CrowdStrike for EDR with Netskope using the link- “https://docs.netskope.com/en/integrating-crowdstrike-for-edr/#integrating-crowdstrike-for-edr-1”As per the document I understand that Netskope pushes the malware hash file to CrowdStrike, endpoints are checked to see if that malware hash file exists. If so, Netskope retrieves the identity of the endpoints and captures the details in a Skope IT alert. If no endpoints have the malware hash file, Netskope publishes the Indicators of Compromise IOC into CrowdStrike’s Custom IOC repository.  But I have few questions here as- 1. When NS pushes malware hash file to CS, if there is any active detection occurs we will get alert on NS under remediation alert type. But will we get the detection alert on CS for the same? For this same scenario, when we are getting the remediation alert on NS, it will be block from NS. But will it be block from CS also and in this case will it be added under IOC of CS? 

0
prajakta.yadav
Netskope Partner
1 month ago
B
BrianThomasNew Member III
posted in Additional Discussions
Obtain Group Members via SCIM

I am using the SCIM API with Swagger to pull information down from our tenant but I could not see how to pull all members of a group. The Admin UI has no option to export group memberships so I figured the SCIM API could do this but I don't see how to get anything other than SCIM ID and External ID via the API.  Is there a way to do this via SCIM or if not, how can I obtain group memberships in a programmatic way? 

2
T
1 month ago
jsaunders
Netskope Employee
jsaundersNetskope Employee
posted in Additional Discussions
How Do You Educate Your Users About Security Controls?

"How should we communicate security controls and changes to our users? How do other Netskope customers do it?" These are questions we hear a lot, and the answer often is, "It depends."Here are some key factors to consider:Impact on Daily Operations: Will the change affect users' daily activities? Access Restrictions: Will users lose access to something they previously had? Policy Flexibility: Is your default policy open or restrictive, and how will this change affect the user experience—positively or negatively?It’s important to strike a balance between inundating users with minor regular change announcements, and notifying them when an impactful change is incoming. Many small changes won’t need this level of awareness.However, when users have access to something one day and lose it the next without warning, it can lead to frustration and a flood of support tickets—neither of which you want!So, how does Netskope handle it?At Netskope (Customer Zero), we notify our users about security

0
jsaunders
Netskope Employee
1 month ago
yihualiao
Netskope Employee
yihualiaoNetskope Employee
posted in Artificial Intelligence and Machine Learning
Introducing Netskope SkopeAI for GenAI Hands-on Lab

We’re excited to invite you to our Netskope SkopeAI for GenAI Hands-On Lab. It provides a unique opportunity to learn how to detect new usage of GenAI apps such as ChatGPT, prevent sensitive data exposure using machine learning models, and further enhance your security posture using the Netskope One platform. The lab takes about 30 minutes to complete. Activate your lab today at https://www.netskope.com/company/events/introduction-to-skopeai-for-genai-hands-on-lab. 

0
yihualiao
Netskope Employee
1 month ago
M
munster
asked in Additional Discussions
Manual Trigger Netskope Client Upgrade

Hiv118 was available. How frequent will the client check of newer version? How can I manually trigger upgrade?thank

1
V
Netskope Employee
1 month ago
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Netskope Threat Protection
‘Patient Zero’ Real-time Protection PolicyF.A.Q.

Netskope Global Technical Success (GTS)KB - ‘Patient Zero’ Real-time Protection Policy(Netskope Cloud Sandboxing) ObjectiveUnderstanding the Significance of Patient Zero in Cybersecurity: Building a Robust Defense via Netskope Prerequisite.Netskope Advanced Threat Protection license is required. ContextThis article explores the significance of Patient Zero events, emphasizing the need to take it seriously in cybersecurity defense strategies. It outlines creating a Real-time policy to mitigate Patient Zero events and provides insights into addressing common queries associated with Patient Zero events Reference https://docs.netskope.com/en/netskope-help/data-security/threat-protection/creating-a-threat-protection-policy-for-patient-zero/ Do you know?Before we proceed, let me address some foundational questions: What is Patient Zero?"Patient Zero" typically refers to the initial infection or point of entry in a cyber attack scenario. It represents the first victim or system to be compromi

2172
M
2 months ago
Iftesam
Netskope Partner
IftesamNetskope Partner
asked in Additional Discussions
Difference between Advanced debugging logs and logs collected from tenant.

I recently encountered the below mentioned issue and would like to have better understanding of the same.I have collected advanced debugging logs from the users system, where in the option of “Start” for outer capture was disabled, still I collected the logs and those were as expected.However when I tried collecting the same logs from the tenant for that user, I observed the logs were different and some of the captures which were present in the previously collected advanced debugging logs from the system were missing in the logs collected from the tenant.Attaching the screenshots for reference:Events triggered for the date and time : 2024/07/17 14:47:00.213Logs collected from the tenant :Advanced debugging logs collected from the device for the same time :Need to understand why the captured even for the same timestamp are different.

2
Iftesam
Netskope Partner
2 months ago
S
Saif-ChaudhryNew Member
posted in Additional Discussions
Can you send me all Netskope log data in Microsoft Sentinel?

If you work with Security Architects, SOC Engineer, or a SOC Analyst, all of them will tell you one thing “Send me ‘ALL’ the logs!” because their ability to find threats or investigate incidents is reduced without the log data or if the required log data is dispersed in various log data stores. If your chosen partner for cloud is Microsoft, then they will also tell you one more thing “Send it to Microsoft Sentinel!” If you happen to be a person responsible to fetch these logs from Netskope then it’s okay to establish feeling where you think the whole world is working towards making your life difficult. I can tell you one thing – I’m not one of them so let me explain why I think I’m the angel 👼 out there to save you ....! Let’s get some fundamentals out of our way: Cloud Exchange – it’s our integration platform to enable third party partner integrations. Packaged as a multi-container application. Modules - Cloud Exchange (CE) comes with four primary modules: Log Shipper, T

4
M
Netskope Employee
2 months ago
N
nadkickNew Member III
asked in Additional Discussions
Switch from UPN to IdP mode

Hello,Driven by Netskope’s enrolment vulnerability, we want/need to move our Windows endpoints from UPN to IdP mode. Does anyone know if there is a way to use a script to change the existing configs of the already installed agents? Before we plan to uninstall and re-install all 10k agents, we would like to elaborate if there is another way by eg deleting/modifying an existing config file.Appreciate any feedback. Thanks,Nadja

0
N
2 months ago
I
ITGuy1New Member III
posted in Additional Discussions
Uninstall Netskope Client on Mac: A Simple Tutorial

The Netskope Client it password protected. Looking to see if any one has success with uninstaller scripts that will allow you to add those parameters to the scripts and do a clean uninstall

6
J
2 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Netskope Cloud Threat Exchange Trend Micro Vision One

Overview Cloud Exchange CTE’s integration with Trend Micro Vision One gives you the ability to bilaterally share indicators of compromise (IOCs) in the form of URLs and file hashes. For example, if Trend Micro Vision One detects a suspicious object, you can configure an action to add it to Netskope’s blocked URL or file list.    Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CTE Trend Micro Vision One Setup Steps Trend Micro Vision One Find Region URL Create API Token Netskope Cloud Exchange Setup Netskope Plugins Netskope CTE Plugin Trend Micro Vision One CTE v1.0.1 or greater Create a Cloud Exchange Business Rule Create Sharing Configuration Sharing Hashes to Netskope Netskope  Create File Profile Policy Create New Malware Detection Profile Add file list to Netskope Real-time Protection Policy Verify Integration Verify Sharing of IoCs Trend Micro Vision One setup steps Fin

2
S
2 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS)

Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS) Netskope provides rich logs for all aspects of security and connectivity but sometimes you may not want so much detail on things like the device type or OS. For example, in our DLP logs, this is the information you would get on the device.             "category": "Cloud Storage",            "ccl": "low",            "device": "iPhone 6S Plus",            "os": "iOS  9.6",            "owner": "dte3831@test.netskope.com",            "policy": "policy_ga32",            "request_id": "2459149802892628500",            "scan_type": "Ongoing",            "site": "Verizon Media", Maybe you just need one of those fields.  In Cloud Log Shipper we can control which information is sent on to the destination by editing the mapping file. You can even have two destinations one with the full logs that you can send somewhere like an AWS S3 bucket for long term storage and then another one that you can send on to your SIEM that trims dow

0
Gary-Jenkins
Netskope Employee
3 months ago
C
connorjbeattyNew Member III
posted in Additional Discussions
Can you enable Netskope Client via command line?

Hello, we are attempting to enable/disable Netskope using the command line on MacOS and Windows. Previous discussions surrounding this provided solutions that are not working in my environment: For Windows:Restart the Netskope client through Task manager or ServicesFrom cmd (as admin): stagentsvc -stopFrom cmd (as admin): stagentsvc -start For Mac:Restart the Netskope client from a Mac terminal window> sudo launchctl unload /Library/LaunchDaemons/com.netskope.stagentsvc.plist> sudo launchctl load /Library/LaunchDaemons/com.netskope.stagentsvc.plist When running these commands in my environment, I'm met with the following errors in Windows and Mac respectively: Windows: "Command not found" or  'stagentsvc' is not recognized as an internal or external command, operable program or batch file.  Mac:   /Library/LaunchDaemons/com.netskope.stagentsvc.plist: No such file or directory Unload failed: 2: No such file or directory &

13
C
3 months ago
B
barrycuda72New Member
asked in Additional Discussions
Cloud Exchange - Business Rules

Using the LogShipper to send logs to my SIEM.  One application in particular is very chatty and the logs it sends are not that important.   I am trying to create a business rule that will exclude that application from sending logs.   Right now, I have the default rule and one additional rule: Query: NOT (app Like "My App").  This does not work, do I have to use Regex for this?  Documentation for business rules are really poor.

1
Rohit_Bhaskar
Netskope Employee
3 months ago
yihualiao
Netskope Employee
yihualiaoNetskope Employee
posted in Artificial Intelligence and Machine Learning
Netskope Lands Two New AI/ML Patents

Netskope has been granted not one, but two brand new patents in the world of AI/ML - our expertise and commitment to delivering cutting-edge security solutions with AI/ML are on full display!"ML-based encrypted file classification for identifying encrypted data movement," Patent Number 11,947,682 “Image matching using deep learning image fingerprinting models and embeddings,” Patent Number 11,983,955The latest additions bring our total number of US patents related to AI/ML technology to an impressive 30. And we're just getting started!

0
yihualiao
Netskope Employee
3 months ago
yihualiao
Netskope Employee
yihualiaoNetskope Employee
posted in Artificial Intelligence and Machine Learning
New Patent and Blog Post on Train Your Own Classifier

Netskope has been awarded a new US patent (Patent Number 11,983,955) for our innovative image matching technology, specifically designed for image fingerprinting and classification. In our latest blog post, we delve into this cutting-edge technology behind Train Your Own Classifier (TYOC). 

1
S
Netskope Employee
3 months ago
Gary-Jenkins
Netskope Employee
Gary-JenkinsNetskope Employee
posted in Additional Discussions
SentinelOne Netskope Direct Integration

SentinelOne Netskope Direct Integration There are a few ways to integrate SentinelOne and Netskope. Netskope can send them logs with Cloud Log Shipper, Cloud Threat Exchange can pull URLs and IoC hashes from SentinelOne into Netskope, and with this direct integration. You can use the Netskope application in the Singularity Marketplace for enrichment. I will be going over this last one in this document.  Taken from https://community.sentinelone.com/Configure the Netskope App to enrich threats to centralize data into one threat and accelerate investigations. Correlate your Netskope alert data and user risk scores into the SentinelOne threat enrichment view. This lets you easily ingest events from Netskope into Singularity™ Data Lake.You can also trigger XDR Manual Response Actions in Netskope to minimize the potential expansion of an attack or compromise. These actions are available in the SentinelOne threats in the Management Console for a one-click response.PrerequisitesA Netskope Tena

0
Gary-Jenkins
Netskope Employee
4 months ago
sanghwa0681
Netskope Partner
sanghwa0681Netskope Partner
asked in Additional Discussions
How to Disable/Edit Netskope Client Shortkey that create NS Client log bundle

Hello every one. One of my user concerned that the NS client log was keep getting created repeatedly.I found out when enter shortkey the client log bundle was created. In MAC OS, the short key that create log bundle is“COMMAND + CONTROL + L”  I tested myself that every time i press “COMMAND + CONTROL + L”  the client log is created in Desktop folder  But the difference between the user and me was that for my instance, entering shortkey with selecting something related to Netskope Client (like NS client configuration browser) create log bundle. The user was able to create log bundle with selecting something that is not related to NS Client. (enter shortkey when working in eclipse or chrome browser) Wondering why the user was able to create log bundle without selecting browser that is realted to NS client. Also i’m having difficulties to find how to disable/edit Netskope Client’s short key. 

0
sanghwa0681
Netskope Partner
4 months ago
eneufeld
Netskope Employee
eneufeldNetskope Employee
posted in Netskope Threat Protection
Which feeds are used by Netskope Threat Protection and can customers customize or enrich them themselves?

One of the most important lines of defense in the Netskope Platform is the Threat Protection Engine. In the coming weeks, we will take a closer look under the hood and explore together how Netskope makes life difficult for attackers. One piece of the advanced multilayered threat protection is a module, based on classic threat intel feeds.  But which feeds are used and can customers customize or enrich them themselves? Netskope uses a wide range of threat intelligence feeds, both open source and commercial throughout our products.  These include various forms ranging from network and file indicators, to rules and signatures. Since our sources may change frequently, we don't publish a publicly available list.Netskope uses several own, best-of-breed open-source and paid threat feeds including MalwarePatrol (multiple feeds including phishing, C2, NRD, DGA), VirusTotal (multiple feeds), Webroot, Cisco Talos, Bitdefender, Reversing Labs, OpenPhish, PhishTank, VxVault, AIS/CISA, and many othe

0
eneufeld
Netskope Employee
4 months ago
T
TwoodsNew Member III
posted in Additional Discussions
Policy Group Usage

With the updates to RBACv2 within the Netskope console, it adds Policy Groups.  As we investigate this feature and how best to utilize it, we are wondering how other Netskope teams are using them especially when you already have a fully developed policy list.

6
S
4 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings