Other Forums

Dive into the Netskope Forums Community for comprehensive discussions on cloud security, network protection, and innovative cybersecurity solutions. Connect with experts and peers to share knowledge, experiences, and best practices in safeguarding digital assets and ensuring secure cloud adoption.

181 Topics

aplaza
Netskope Employee
aplazaNetskope Employee
published in Artificial Intelligence and Machine Learning

NEW eBook—Securing GenAI for Dummies

Learn how to balance the innovative potential of GenAI while protecting your business. When approached correctly, effective data security enables businesses to leverage tools like ChatGPT and Google Gemini for competitive advantage. Conversely, neglecting the need for data security can lead to catastrophic consequences for your business.Read this ebook to learn how your organization can balance the potential of these innovative tools with robust data security practices.  📚 Get actionable insights with Securing Generative AI for Dummies eBook 📚

90
aplaza
Netskope Employee
1 day ago
B
barrycuda72New Member
asked in Additional Discussions

Cloud Exchange - Business Rules

Using the LogShipper to send logs to my SIEM.  One application in particular is very chatty and the logs it sends are not that important.   I am trying to create a business rule that will exclude that application from sending logs.   Right now, I have the default rule and one additional rule: Query: NOT (app Like "My App").  This does not work, do I have to use Regex for this?  Documentation for business rules are really poor.

0
B
1 day ago
T
tpimpaoNew Member III
asked in Additional Discussions

SAML - Forward Proxy | Unique SAML Entity ID for each Azure AD tenant.

Hello everyone,I've been pondering over a particular aspect of our SAML - Forward Proxy configuration and would appreciate some insights from the community. Specifically, I've noticed that the SAML Entity ID remains the same across all methods, whether it's IPSEC, GRE, Cloud Explicit Proxy, or Client Enrollment.This uniformity in SAML Entity ID across various methods has raised some concerns for me, particularly in relation to compatibility with Azure AD. As some of you may already know, Azure AD supports only a unique SAML Entity ID for each Azure AD tenant.Given this limitation, I'm curious about the rationale behind having a single SAML Entity ID for all methods within our SAML - Forward Proxy configuration. Has anyone encountered similar challenges with Azure AD integration due to this setup? If so, how have you addressed or worked around it?The goal is to only allow for the method “Client Enrollment” a specific Azure AD group. For that i will have two Enterprise Apps “Netskope Use

0
T
2 days ago
sfoster
sfosterExplorer III
posted in Additional Discussions

Using Microsoft Information Protection with Netskope to protect your data

Did you know that using Netskope's powerful Cloud DLP and Microsoft Information Protection you can scan your M365 instance and identify sensitive data in order to classify it and label (or re-label) it to add the right context to the file metadata.   The high-level process to set up Netskope and MIP to label documents as sensitive is as follows:   In the MIP tenant, go to Classification and create a new label you want to apply to files with sensitive content. Publish the label to all users and groups. Select All under Users and groups. In the Netskope tenant, create a new API-enabled Protection policy. Under Actions choose IRM Protect > MIPand then the label you want to use. Alternatively if you wish to revise a MIP label based on the content, files that are already labeled by MIP can be scanned by the Netskope API-enabled Protection policy for sensitive content. If the policy detects sensitive content in the files, then the policy replaces the file label wit

1
E
3 days ago
M
Netskope Employee
MandeepNetskope Employee
published in Netskope Threat Protection

‘Patient Zero’ Real-time Protection PolicyF.A.Q.

Netskope Global Technical Success (GTS)KB - ‘Patient Zero’ Real-time Protection Policy(Netskope Cloud Sandboxing) ObjectiveUnderstanding the Significance of Patient Zero in Cybersecurity: Building a Robust Defense via Netskope Prerequisite.Netskope Advanced Threat Protection license is required. ContextThis article explores the significance of Patient Zero events, emphasizing the need to take it seriously in cybersecurity defense strategies. It outlines creating a Real-time policy to mitigate Patient Zero events and provides insights into addressing common queries associated with Patient Zero events Reference https://docs.netskope.com/en/netskope-help/data-security/threat-protection/creating-a-threat-protection-policy-for-patient-zero/ Do you know?Before we proceed, let me address some foundational questions: What is Patient Zero?"Patient Zero" typically refers to the initial infection or point of entry in a cyber attack scenario. It represents the first victim or system to be compromi

120
M
Netskope Employee
3 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

New from Netskope Threat Labs: Evil Ant, Azorult, and Segmented Threat ReportsNews

NETSKOPE THREAT LABS Evil Ant, Azorult, and Segmented Threat Reports Evil Ant Ransomware Evil Ant is a new Python-based ransomware with a hardcoded key, which makes recovering files without paying the ransom possible. An Evasive Azorult Campaign Netskope Threat Labs uncovered a new Azorult campaign using HTML smuggling, reflexive code loading, and AMSI bypass to try to evade detection while stealing crypto wallets, login credentials, browser files, and important documents.Segmented Threat ReportsNetskope Threat Labs has published five new region-specific and industry-specific threat reports.Canada Japan Financial Services Healthcare Retail Anyone can subscribe to this mailing list on the Netskope Threat Labs page: https://www.netskope.com/netskope-threat-labs#subscribe

240
ppasseri
Netskope Employee
7 days ago
C
cswordNew Member III
asked in Additional Discussions

Jumpcloud Client Deployment for Windows using Okta as IDP

We are looking for a way to deploy the Netskope Client for Windows using Jumpcloud and Okta as our IDP source. We’ve found a few articles for how to do this for macOS with Jumpcloud as the IDP but nothing for Okta.We’d like to set this up similar to our Kandji deployment for macOS where Okta serves as the identity provider. Has anyone had success with this? 

0
C
10 days ago
D
DerekbNew Member
posted in Additional Discussions

Removing Old Client

Can Someone Help We have a client Netskope installation v91.0.6.812 which i need to remove I have the password but the installer seems to be broken as it askes for the STAgent.msi "The Feature you are trying to use is on a network resource that is unavailable" I have tried other versions of the msi file but all fail.   Even the new installer we have gets stuck on removal of the old software, Tried all sorts, but cant get it off. Anyone have an idea or have the original v91.0.6.812 STAgent.msi to allow me to remove it ?   Derek  

6
T
10 days ago
pbeyleveld
Netskope Employee
pbeyleveldNetskope Employee
posted in Additional Discussions

Using nginx for On-Premises Detection

It is often necessary to disable private app steering when a user is on premises. This can be accomplished by using Dynamic steering as documented https://docs.netskope.com/en/dynamic-steering.html   On-premises detection is required for Dynamic steering and the Netskope client can detect that it is on-premises either by resolving a DNS A record to IP address or by probing an HTTP server.   NOTE: The host probed by on-premises detection should never be steered through Netskope Private access neither explicitly or by wildcard. This will result in unwanted behaviour.   In this article I will explain how you can use nginx to host a service which can be probed for on-prem check. As per the Netskope documentation for HTTP, the HTTP server must return 200 OK response code to determine if the device is on-premises.   nginx is an open source highly performant and scalable HTTP and reverse proxy server which can easily be used to perform this function. There are ma

1
jSalty
Netskope Partner
14 days ago
mfaris
Netskope Employee
mfarisNetskope Employee
posted in Additional Discussions

Traffic Steering Documentation Revamp

Hi all,After a couple years, we finally finished revamping most of our Traffic Steering documentation making them more user friendly! The revamp project consisted of:Adding missing content Updating any best practices, guidelines, and requirements Breaking up articles Fixing content structure for usability Adding new screenshots and network diagramsPlease let us know if you have any feedback.You might be wondering, what about the IPSec and GRE integration guides? Those are next!Thank you to everyone who has sent feedback on these articles!

0
mfaris
Netskope Employee
15 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Stats for February 2024

As we do every month, we have published the Threat Labs Statistics for February 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries and the return of GitHub to the top three. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware. In February, 49% of all malware downloads originated from a record-setting 215 distinct cloud apps. The top malware families active in February included the banking trojan Grandoreiro, the RAT AdWind, and the ransomware Lockbit. Cloud Malware Delivery Attackers attempt to fly under the radar by delivering malic

640
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Stats for January 2024

As we do every month, we have published the Threat Labs Statistics for January 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and SharePoint were again in the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 49% of all malware downloads in January originating from 178 cloud apps. A wide variety of malware families were circulating in January. Malware families including the Infostealer AgentTesla, the RAT AdWind, and the ransomware Lockbit and Trigona were among top families. Cloud Malware Delivery Attackers attempt to fly under the rad

520
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Report: HEALTHCARE 2024

Another monthly Netskope Threat Labs report. This edition is dedicated to healthcare. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the healthcare sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Although Microsoft OneDrive is the most popular app in the healthcare sector, its popularity lags behind that of other industries. The popularity of other Microsoft products was mixed, with SharePoint similarly lagging other industries but Teams leading other industries.Cloud App Abuse: Microsoft OneDrive was also the most popular app for malware downloads but lagged behind other industries, underscoring that successful malware delivery depends on both adversary tactics and user behavior.Malware & Ransomware: Among the most prevalent malware families targeting victims

470
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Threat Labs Report: FINANCIAL SERVICES 2024

The first Netskope Threat Labs report of 2024 is dedicated to financial service. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Microsoft OneDrive, Microsoft Teams, and SharePoint are among the top five most popular apps in the financial services sector, with Microsoft Teams being significantly more popular than it is in other industries. As in other sectors, Microsoft OneDrive still takes the top spot.Cloud App Abuse: OneDrive, Github, and SharePoint are the top three most popular apps for malware downloads in the financial services sector. Users in financial services download malware from GitHub and Microsoft SharePoint more frequently than users in other industries.Malware & Ransomware: A

390
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
posted in Netskope Threat Protection

Threat Labs Report — Canada 2024

The is first Netskope Threat Labs report of 2024 dedicated to a specific geographical region. A public version of the same report is available here.The Netskope Threat Labs Report highlights a different segment every month. This report series aims to provide strategic, actionable intelligence on active threats against users in each segment. The segment highlighted in this report is users working in Canada. In This Report Cloud App Adoption: Microsoft OneDrive, the most popular app worldwide, is even more popular in Canada than in other parts of the world, with the rest of the Microsoft 365 ecosystem following a similar trend.Cloud App Abuse: More than half of all malware downloads in Canada come from cloud apps, with a significant percentage coming from Microsoft OneDrive and GitHub.Malware & Ransomware: Among the most prevalent malware families targeting victims in Canada are the remote access Trojan NjRat, the Trojan Formbook, and the infostealer AgentTesla. Cloud App Adoption Th

0
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Netskope Real-time Threat Protection and AV-TEST ResultsBlog

Public version, available here.By Tom ClareNetskope continues to advance inline threat protection capabilities and has improved its detection and blocking of malware and phishing attacks while also lowering and improving its false positive rate in the latest AV-TEST Report. In every part of the testing, Netskope improved.Today more than half of user egress traffic involves applications and cloud services rather than websites, and where more than half of threats are delivered knowing these popular domains are allowed, or worse yet bypassed from inline threat inspection altogether. Relying on endpoint protection for executable malware leaves a blind spot for fileless attacks using fake login forms and phishing techniques hosted in applications and cloud services that require inline content and context inspection to protect users. This dynamic changes the playing field for threat protection testing and what must be prioritized with respect to detection speed and efficacy scores.First, use

920
ppasseri
Netskope Employee
19 days ago
ppasseri
Netskope Employee
ppasseriNetskope Employee
published in Netskope Threat Protection

Welcome to the Netskope Threat Protection Forum!

This section of the forum is dedicated to the Netskope Threat Protection technology. In this section you will find configuration guides, reports, research documents, and in general a space where you can submit questions and be informed about the multiple features of our threat protection capabilities, including Behavior Analytics (UEBA) and Remote Browser Isolation (RBI).Everything You Always Wanted to Know About Threat Protection* But Were Afraid to Ask!Useful resources: Netskope Threat Labs Homepage Cloud and Threat Reports (published on a quarterly basis and focused on a specific topic) Threat Labs Reports (published on a monthly basis and focused on a specific topic, or a specific geographical region) Upcoming Events Recent Blog Posts (contains the links to the Netskope Threat Labs statistics published on a monthly basis)

310
ppasseri
Netskope Employee
19 days ago
ssumner
Netskope Employee
ssumnerNetskope Employee
posted in Additional Discussions

Livestream: Can we improve SaaS performance?

42% of SaaS users report consistently poor performance. 39% of these aren’t detected by traditional monitoring tools.Netskope ran a global survey this community and it was clear that troubleshooting SaaS issues and optimizing performance is incredibly difficult for several reasons:SaaS leverages highly distributed cloud hosting, where what looks like a single web page really relies on dozens of micro-services and integration with third party apps and services. The shift to hybrid working introduces BYOD, home WiFi and internet issues accessing SaaS apps, while users are also highly distributed as they fluidly move from home to office. SSE / SASE and Zero Trust approaches that address this new distributed user and security perimeter are themselves SaaS / cloud apps. Their impact on user experience and latency can’t be accurately measured by traditional monitoring tools that see these inline services as a ‘grey cloud’—much like a VPN or SD-WAN tunnel—making it nearly impossible to unders

0
ssumner
Netskope Employee
1 month ago
M
Netskope Employee
mgulledgeNetskope Employee
published in Artificial Intelligence and Machine Learning

Netskope Plugin for Microsoft Security CoPilotAI, ML, Skope AI

Microsoft has enhanced Security Copilot by preinstalling a set of plugins for their security services and frequently used websites. Additionally, you have the option to incorporate Netskope custom plugins, expanding Gen AI capabilities on your Netskope platform.RequirementsEnsure you have an active Microsoft Security CoPilot account and are able to login to: https://securitycopilot.microsoft.com/ For more information on Security CoPilot please visit: Get started with Microsoft Security Copilot Early Access ProgramCreate a local yaml file called NetskopeCoPilotSkill.yaml (filename can be anything). And paste the below in your yaml file: Descriptor: Name: Netskope Reporting for Threat and Data Protection DisplayName: Netskope Reporting API endpoints Description: The API plugin offers 6 skills that range from displaying Netskope Alerts and Events for Threat Hunting and Data Protection. SupportedAuthTypes: - ApiKey Authorization: Type: APIKey Key: Netskope-api-token Loca

7947
M
Netskope Employee
1 month ago
S
SagaNew Member
asked in Additional Discussions

Steering exception not working

Hello everyone,I have a very annoying problem with my Netskope Steering configuration.Domain bypass exceptions don't work.For example, I need to access a site under development, which allows access via IP filtering. As this site is in our exceptions, we're normally supposed to be able to access it with our classic public IP, so I've added it to the exceptions.But despite this, we arrive on the site with a netskope IP (163.x.x.x), which prevents access to the site.I'm a bit stumped at this point...Do you have any ideas?Thanks!

2
Rohit_Bhaskar
Netskope Employee
1 month ago
ssumner
Netskope Employee
ssumnerNetskope Employee
posted in Additional Discussions

Solving the SASE user experience challenge with DEM

Can security and performance coexist?The secure service edge should make the connection between users and apps more direct. But when things go wrong, it’s hard to tell where issues originate and who’s impacted. SASE can improve user experience, instead of impacting it. Visibility into cloud security reveals issues you can quickly fix then automate.We developed a next-level IT playbook to summarize practical strategies to deliver a phenomenal digital experience and a productive business advantage in a zero-trust environment.  Executive SummaryThe shift to a more distributed and dynamic digital infrastructure based on hybrid workforces, SaaS applications, and cloud hosting has created a visibility gap, making user experience and performance management more challenging for IT organizations.SASE-integrated DEM is a natural solution to this problem. It provides a unified view across network, application, endpoint–and security–management domains. This visibility simplifies collaboration amon

0
ssumner
Netskope Employee
1 month ago
T
Netskope Employee
tpommetNetskope Employee
posted in Additional Discussions

Cloud Exchange 5.0 Webcast Feb 27-29

Registration links to join Netskope Cloud Exchange 5.0 webcast that will air in different global time zones Feb 27-29.Join next week’s webcast on Netskope Cloud Exchange for your Zero Trust JourneyLeverage Your IT Security Stack with Netskope Cloud Exchange 5.0Come learn how the Netskope Technical Alliance team has improved our technology partner integration platform, Cloud Exchange. The new capabilities further extend the value of the security ecosystem at stopping threats together.Great work by David Willis, Gary Jenkins, Agasthiamani Sankaran NAM - February 27th - 10am EST | Noon CST | 1pm ESTEMEA  - February 28th - 10 am GMT | 11 am CETAPAC - February 29th - 10:30 am IST| 1:00 pm SGT | 4:00 pm AEDT

0
T
Netskope Employee
2 months ago
M
mchesmoNew Member
posted in Artificial Intelligence and Machine Learning

Preventing Virtual Assistants from recording meetings

Will Netskope block some of the virtual assistants like Otter.AI. I am trying to stop anyone from joining a MS Teams meeting and launching something like Otter.AI, regardless of if they are on a corporate device or a personal device.  

1
S
Netskope Employee
2 months ago
A
AlfaBaneExplorer III
asked in Additional Discussions

On-Premise Detection: status data for "remote" vs "on-premises"

With dynamic steering and on-premise detection enabled, I want the ability to see who is reporting as “remote” vs “on-premises” from the tenant/console. This would be good data for tracking, incident response, troubleshooting, etc.  I’ve been unable to find a data point in the tenant in relation to this. Does anyone know if it is available (short of having end-users manually confirm via Configuration)?

0
A
2 months ago
H
HaxDrNew Member
posted in Artificial Intelligence and Machine Learning

Technical Support Documentation for AI Embedding

Hello!  I wanted to know if there is an easy way to get a copy of all the technical support docs from Netskope. Including API docs (which are currently only available at the Netskope admin console level). My goal is to create a vector database and ultimately teach an AI Agent Netskope. For practical purposes I'd like to see the extent by which I can extend and embed a model with data and how that would stack up to some of our in house support. Apart from the public facing knowledge base I'm looking for more documents on troubleshooting client side issues. Maybe even some documentation on how to spot errors in Netskope Debug Logs, etc...  Thanks for any and all support!-Hax

2
yihualiao
Netskope Employee
2 months ago

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
Show all badges
Terms & ConditionsCookie settings