Other Forums

With the updates to RBACv2 within the Netskope console, it adds Policy Groups.  As we investigate this feature and how best to utilize it, we are wondering how other Netskope teams are using them especially when you already have a fully developed policy list.

Hello everyone,I have a very annoying problem with my Netskope Steering configuration.Domain bypass exceptions don't work.For example, I need to access a site under development, which allows access via IP filtering. As this site is in our exceptions, we're normally supposed to be able to access it with our classic public IP, so I've added it to the exceptions.But despite this, we arrive on the site with a netskope IP (163.x.x.x), which prevents access to the site.I'm a bit stumped at this point...Do you have any ideas?Thanks!

HiFor the product update, were there recorded demo how those new features can be setup and tested?    There were 3 demos use cases, how about the rest features?  

Learn how to balance the innovative potential of GenAI while protecting your business. When approached correctly, effective data security enables businesses to leverage tools like ChatGPT and Google Gemini for competitive advantage. Conversely, neglecting the need for data security can lead to catastrophic consequences for your business.Read this ebook to learn how your organization can balance the potential of these innovative tools with robust data security practices.  📚 Get actionable insights with Securing Generative AI for Dummies eBook 📚

Hello everyone,I've been pondering over a particular aspect of our SAML - Forward Proxy configuration and would appreciate some insights from the community. Specifically, I've noticed that the SAML Entity ID remains the same across all methods, whether it's IPSEC, GRE, Cloud Explicit Proxy, or Client Enrollment.This uniformity in SAML Entity ID across various methods has raised some concerns for me, particularly in relation to compatibility with Azure AD. As some of you may already know, Azure AD supports only a unique SAML Entity ID for each Azure AD tenant.Given this limitation, I'm curious about the rationale behind having a single SAML Entity ID for all methods within our SAML - Forward Proxy configuration. Has anyone encountered similar challenges with Azure AD integration due to this setup? If so, how have you addressed or worked around it?The goal is to only allow for the method “Client Enrollment” a specific Azure AD group. For that i will have two Enterprise Apps “Netskope Use

Did you know that using Netskope's powerful Cloud DLP and Microsoft Information Protection you can scan your M365 instance and identify sensitive data in order to classify it and label (or re-label) it to add the right context to the file metadata.   The high-level process to set up Netskope and MIP to label documents as sensitive is as follows:   In the MIP tenant, go to Classification and create a new label you want to apply to files with sensitive content. Publish the label to all users and groups. Select All under Users and groups. In the Netskope tenant, create a new API-enabled Protection policy. Under Actions choose IRM Protect > MIPand then the label you want to use. Alternatively if you wish to revise a MIP label based on the content, files that are already labeled by MIP can be scanned by the Netskope API-enabled Protection policy for sensitive content. If the policy detects sensitive content in the files, then the policy replaces the file label wit

NETSKOPE THREAT LABS Evil Ant, Azorult, and Segmented Threat Reports Evil Ant Ransomware Evil Ant is a new Python-based ransomware with a hardcoded key, which makes recovering files without paying the ransom possible. An Evasive Azorult Campaign Netskope Threat Labs uncovered a new Azorult campaign using HTML smuggling, reflexive code loading, and AMSI bypass to try to evade detection while stealing crypto wallets, login credentials, browser files, and important documents.Segmented Threat ReportsNetskope Threat Labs has published five new region-specific and industry-specific threat reports.Canada Japan Financial Services Healthcare Retail Anyone can subscribe to this mailing list on the Netskope Threat Labs page: https://www.netskope.com/netskope-threat-labs#subscribe

We are looking for a way to deploy the Netskope Client for Windows using Jumpcloud and Okta as our IDP source. We’ve found a few articles for how to do this for macOS with Jumpcloud as the IDP but nothing for Okta.We’d like to set this up similar to our Kandji deployment for macOS where Okta serves as the identity provider. Has anyone had success with this? 

Can Someone Help We have a client Netskope installation v91.0.6.812 which i need to remove I have the password but the installer seems to be broken as it askes for the STAgent.msi "The Feature you are trying to use is on a network resource that is unavailable" I have tried other versions of the msi file but all fail.   Even the new installer we have gets stuck on removal of the old software, Tried all sorts, but cant get it off. Anyone have an idea or have the original v91.0.6.812 STAgent.msi to allow me to remove it ?   Derek  

It is often necessary to disable private app steering when a user is on premises. This can be accomplished by using Dynamic steering as documented https://docs.netskope.com/en/dynamic-steering.html   On-premises detection is required for Dynamic steering and the Netskope client can detect that it is on-premises either by resolving a DNS A record to IP address or by probing an HTTP server.   NOTE: The host probed by on-premises detection should never be steered through Netskope Private access neither explicitly or by wildcard. This will result in unwanted behaviour.   In this article I will explain how you can use nginx to host a service which can be probed for on-prem check. As per the Netskope documentation for HTTP, the HTTP server must return 200 OK response code to determine if the device is on-premises.   nginx is an open source highly performant and scalable HTTP and reverse proxy server which can easily be used to perform this function. There are ma

Hi all,After a couple years, we finally finished revamping most of our Traffic Steering documentation making them more user friendly! The revamp project consisted of:Adding missing content Updating any best practices, guidelines, and requirements Breaking up articles Fixing content structure for usability Adding new screenshots and network diagramsPlease let us know if you have any feedback.You might be wondering, what about the IPSec and GRE integration guides? Those are next!Thank you to everyone who has sent feedback on these articles!

As we do every month, we have published the Threat Labs Statistics for February 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries and the return of GitHub to the top three. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware. In February, 49% of all malware downloads originated from a record-setting 215 distinct cloud apps. The top malware families active in February included the banking trojan Grandoreiro, the RAT AdWind, and the ransomware Lockbit. Cloud Malware Delivery Attackers attempt to fly under the radar by delivering malic

As we do every month, we have published the Threat Labs Statistics for January 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and SharePoint were again in the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 49% of all malware downloads in January originating from 178 cloud apps. A wide variety of malware families were circulating in January. Malware families including the Infostealer AgentTesla, the RAT AdWind, and the ransomware Lockbit and Trigona were among top families. Cloud Malware Delivery Attackers attempt to fly under the rad

Another monthly Netskope Threat Labs report. This edition is dedicated to healthcare. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the healthcare sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Although Microsoft OneDrive is the most popular app in the healthcare sector, its popularity lags behind that of other industries. The popularity of other Microsoft products was mixed, with SharePoint similarly lagging other industries but Teams leading other industries.Cloud App Abuse: Microsoft OneDrive was also the most popular app for malware downloads but lagged behind other industries, underscoring that successful malware delivery depends on both adversary tactics and user behavior.Malware & Ransomware: Among the most prevalent malware families targeting victims

The first Netskope Threat Labs report of 2024 is dedicated to financial service. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Microsoft OneDrive, Microsoft Teams, and SharePoint are among the top five most popular apps in the financial services sector, with Microsoft Teams being significantly more popular than it is in other industries. As in other sectors, Microsoft OneDrive still takes the top spot.Cloud App Abuse: OneDrive, Github, and SharePoint are the top three most popular apps for malware downloads in the financial services sector. Users in financial services download malware from GitHub and Microsoft SharePoint more frequently than users in other industries.Malware & Ransomware: A

Public version, available here.By Tom ClareNetskope continues to advance inline threat protection capabilities and has improved its detection and blocking of malware and phishing attacks while also lowering and improving its false positive rate in the latest AV-TEST Report. In every part of the testing, Netskope improved.Today more than half of user egress traffic involves applications and cloud services rather than websites, and where more than half of threats are delivered knowing these popular domains are allowed, or worse yet bypassed from inline threat inspection altogether. Relying on endpoint protection for executable malware leaves a blind spot for fileless attacks using fake login forms and phishing techniques hosted in applications and cloud services that require inline content and context inspection to protect users. This dynamic changes the playing field for threat protection testing and what must be prioritized with respect to detection speed and efficacy scores.First, use

This section of the forum is dedicated to the Netskope Threat Protection technology. In this section you will find configuration guides, reports, research documents, and in general a space where you can submit questions and be informed about the multiple features of our threat protection capabilities, including Behavior Analytics (UEBA) and Remote Browser Isolation (RBI).Everything You Always Wanted to Know About Threat Protection* But Were Afraid to Ask!Useful resources: Netskope Threat Labs Homepage Cloud and Threat Reports (published on a quarterly basis and focused on a specific topic) Threat Labs Reports (published on a monthly basis and focused on a specific topic, or a specific geographical region) Upcoming Events Recent Blog Posts (contains the links to the Netskope Threat Labs statistics published on a monthly basis)

The is first Netskope Threat Labs report of 2024 dedicated to a specific geographical region. A public version of the same report is available here.The Netskope Threat Labs Report highlights a different segment every month. This report series aims to provide strategic, actionable intelligence on active threats against users in each segment. The segment highlighted in this report is users working in Canada. In This Report Cloud App Adoption: Microsoft OneDrive, the most popular app worldwide, is even more popular in Canada than in other parts of the world, with the rest of the Microsoft 365 ecosystem following a similar trend.Cloud App Abuse: More than half of all malware downloads in Canada come from cloud apps, with a significant percentage coming from Microsoft OneDrive and GitHub.Malware & Ransomware: Among the most prevalent malware families targeting victims in Canada are the remote access Trojan NjRat, the Trojan Formbook, and the infostealer AgentTesla. Cloud App Adoption Th

Microsoft has enhanced Security Copilot by preinstalling a set of plugins for their security services and frequently used websites. Additionally, you have the option to incorporate Netskope custom plugins, expanding Gen AI capabilities on your Netskope platform.RequirementsEnsure you have an active Microsoft Security CoPilot account and are able to login to: https://securitycopilot.microsoft.com/ For more information on Security CoPilot please visit: Get started with Microsoft Security Copilot Early Access ProgramCreate a local yaml file called NetskopeCoPilotSkill.yaml (filename can be anything). And paste the below in your yaml file: Descriptor: Name: Netskope Reporting for Threat and Data Protection DisplayName: Netskope Reporting API endpoints Description: The API plugin offers 6 skills that range from displaying Netskope Alerts and Events for Threat Hunting and Data Protection. SupportedAuthTypes: - ApiKey Authorization: Type: APIKey Key: Netskope-api-token Loca

Registration links to join Netskope Cloud Exchange 5.0 webcast that will air in different global time zones Feb 27-29.Join next week’s webcast on Netskope Cloud Exchange for your Zero Trust JourneyLeverage Your IT Security Stack with Netskope Cloud Exchange 5.0Come learn how the Netskope Technical Alliance team has improved our technology partner integration platform, Cloud Exchange. The new capabilities further extend the value of the security ecosystem at stopping threats together.Great work by David Willis, Gary Jenkins, Agasthiamani Sankaran NAM - February 27th - 10am EST | Noon CST | 1pm ESTEMEA  - February 28th - 10 am GMT | 11 am CETAPAC - February 29th - 10:30 am IST| 1:00 pm SGT | 4:00 pm AEDT

Will Netskope block some of the virtual assistants like Otter.AI. I am trying to stop anyone from joining a MS Teams meeting and launching something like Otter.AI, regardless of if they are on a corporate device or a personal device.  

With dynamic steering and on-premise detection enabled, I want the ability to see who is reporting as “remote” vs “on-premises” from the tenant/console. This would be good data for tracking, incident response, troubleshooting, etc.  I’ve been unable to find a data point in the tenant in relation to this. Does anyone know if it is available (short of having end-users manually confirm via Configuration)?

Hello!  I wanted to know if there is an easy way to get a copy of all the technical support docs from Netskope. Including API docs (which are currently only available at the Netskope admin console level). My goal is to create a vector database and ultimately teach an AI Agent Netskope. For practical purposes I'd like to see the extent by which I can extend and embed a model with data and how that would stack up to some of our in house support. Apart from the public facing knowledge base I'm looking for more documents on troubleshooting client side issues. Maybe even some documentation on how to spot errors in Netskope Debug Logs, etc...  Thanks for any and all support!-Hax

In an era of escalating cyber threats and increasingly sophisticated attacks, organizations are facing an ever-growing challenge to safeguard their digital assets and sensitive information.Watch this demo with Netskope Chief Evangelist, Bob Gilbert, to hear how you can harness the power of AI/ML to strengthen your cybersecurity and defend against bad actors attempting to infiltrate your infrastructure.Demo Highlights:Learn how AI/ML is revolutionizing threat detection and data protection Discover cutting-edge AI/ML techniques for anomaly detection and behavior analysis See how artificial intelligence and machine learning are powering the future of data classification  

HiIn the Steering Configuration and Client Configuration, I can only select OU or AD User Group.Using OU or AD User Group are inflexibleExample for testing purpose, unable to select AD users from different AD user group for testing since there was no AD user group for these selective users. can’t just test for 1 user.  WIll have to create AD user group for for 1 user Select by device.  I may have multiple devices login using the same account.  I will want the test steering and client configuration for test devices.  My corp device will not take effect.Is it possible to select by individual AD user or by device?  thank