Other Forums

Trimming Logs with Netskope Cloud Exchange, Cloud Log Shipper (CLS) Netskope provides rich logs for all aspects of security and connectivity but sometimes you may not want so much detail on things like the device type or OS. For example, in our DLP logs, this is the information you would get on the device.             "category": "Cloud Storage",            "ccl": "low",            "device": "iPhone 6S Plus",            "os": "iOS  9.6",            "owner": "dte3831@test.netskope.com",            "policy": "policy_ga32",            "request_id": "2459149802892628500",            "scan_type": "Ongoing",            "site": "Verizon Media", Maybe you just need one of those fields.  In Cloud Log Shipper we can control which information is sent on to the destination by editing the mapping file. You can even have two destinations one with the full logs that you can send somewhere like an AWS S3 bucket for long term storage and then another one that you can send on to your SIEM that trims dow

Hello, we are attempting to enable/disable Netskope using the command line on MacOS and Windows. Previous discussions surrounding this provided solutions that are not working in my environment: For Windows:Restart the Netskope client through Task manager or ServicesFrom cmd (as admin): stagentsvc -stopFrom cmd (as admin): stagentsvc -start For Mac:Restart the Netskope client from a Mac terminal window> sudo launchctl unload /Library/LaunchDaemons/com.netskope.stagentsvc.plist> sudo launchctl load /Library/LaunchDaemons/com.netskope.stagentsvc.plist When running these commands in my environment, I'm met with the following errors in Windows and Mac respectively: Windows: "Command not found" or  'stagentsvc' is not recognized as an internal or external command, operable program or batch file.  Mac:   /Library/LaunchDaemons/com.netskope.stagentsvc.plist: No such file or directory Unload failed: 2: No such file or directory &

Using the LogShipper to send logs to my SIEM.  One application in particular is very chatty and the logs it sends are not that important.   I am trying to create a business rule that will exclude that application from sending logs.   Right now, I have the default rule and one additional rule: Query: NOT (app Like "My App").  This does not work, do I have to use Regex for this?  Documentation for business rules are really poor.

Netskope has been granted not one, but two brand new patents in the world of AI/ML - our expertise and commitment to delivering cutting-edge security solutions with AI/ML are on full display!"ML-based encrypted file classification for identifying encrypted data movement," Patent Number 11,947,682 “Image matching using deep learning image fingerprinting models and embeddings,” Patent Number 11,983,955The latest additions bring our total number of US patents related to AI/ML technology to an impressive 30. And we're just getting started!

Netskope has been awarded a new US patent (Patent Number 11,983,955) for our innovative image matching technology, specifically designed for image fingerprinting and classification. In our latest blog post, we delve into this cutting-edge technology behind Train Your Own Classifier (TYOC). 

SentinelOne Netskope Direct Integration There are a few ways to integrate SentinelOne and Netskope. Netskope can send them logs with Cloud Log Shipper, Cloud Threat Exchange can pull URLs and IoC hashes from SentinelOne into Netskope, and with this direct integration. You can use the Netskope application in the Singularity Marketplace for enrichment. I will be going over this last one in this document.  Taken from https://community.sentinelone.com/Configure the Netskope App to enrich threats to centralize data into one threat and accelerate investigations. Correlate your Netskope alert data and user risk scores into the SentinelOne threat enrichment view. This lets you easily ingest events from Netskope into Singularity™ Data Lake.You can also trigger XDR Manual Response Actions in Netskope to minimize the potential expansion of an attack or compromise. These actions are available in the SentinelOne threats in the Management Console for a one-click response.PrerequisitesA Netskope Tena

Hello every one. One of my user concerned that the NS client log was keep getting created repeatedly.I found out when enter shortkey the client log bundle was created. In MAC OS, the short key that create log bundle is“COMMAND + CONTROL + L”  I tested myself that every time i press “COMMAND + CONTROL + L”  the client log is created in Desktop folder  But the difference between the user and me was that for my instance, entering shortkey with selecting something related to Netskope Client (like NS client configuration browser) create log bundle. The user was able to create log bundle with selecting something that is not related to NS Client. (enter shortkey when working in eclipse or chrome browser) Wondering why the user was able to create log bundle without selecting browser that is realted to NS client. Also i’m having difficulties to find how to disable/edit Netskope Client’s short key. 

One of the most important lines of defense in the Netskope Platform is the Threat Protection Engine. In the coming weeks, we will take a closer look under the hood and explore together how Netskope makes life difficult for attackers. One piece of the advanced multilayered threat protection is a module, based on classic threat intel feeds.  But which feeds are used and can customers customize or enrich them themselves? Netskope uses a wide range of threat intelligence feeds, both open source and commercial throughout our products.  These include various forms ranging from network and file indicators, to rules and signatures. Since our sources may change frequently, we don't publish a publicly available list.Netskope uses several own, best-of-breed open-source and paid threat feeds including MalwarePatrol (multiple feeds including phishing, C2, NRD, DGA), VirusTotal (multiple feeds), Webroot, Cisco Talos, Bitdefender, Reversing Labs, OpenPhish, PhishTank, VxVault, AIS/CISA, and many othe

With the updates to RBACv2 within the Netskope console, it adds Policy Groups.  As we investigate this feature and how best to utilize it, we are wondering how other Netskope teams are using them especially when you already have a fully developed policy list.

Hello everyone,I have a very annoying problem with my Netskope Steering configuration.Domain bypass exceptions don't work.For example, I need to access a site under development, which allows access via IP filtering. As this site is in our exceptions, we're normally supposed to be able to access it with our classic public IP, so I've added it to the exceptions.But despite this, we arrive on the site with a netskope IP (163.x.x.x), which prevents access to the site.I'm a bit stumped at this point...Do you have any ideas?Thanks!

HiFor the product update, were there recorded demo how those new features can be setup and tested?    There were 3 demos use cases, how about the rest features?  

Learn how to balance the innovative potential of GenAI while protecting your business. When approached correctly, effective data security enables businesses to leverage tools like ChatGPT and Google Gemini for competitive advantage. Conversely, neglecting the need for data security can lead to catastrophic consequences for your business.Read this ebook to learn how your organization can balance the potential of these innovative tools with robust data security practices.  📚 Get actionable insights with Securing Generative AI for Dummies eBook 📚

Hello everyone,I've been pondering over a particular aspect of our SAML - Forward Proxy configuration and would appreciate some insights from the community. Specifically, I've noticed that the SAML Entity ID remains the same across all methods, whether it's IPSEC, GRE, Cloud Explicit Proxy, or Client Enrollment.This uniformity in SAML Entity ID across various methods has raised some concerns for me, particularly in relation to compatibility with Azure AD. As some of you may already know, Azure AD supports only a unique SAML Entity ID for each Azure AD tenant.Given this limitation, I'm curious about the rationale behind having a single SAML Entity ID for all methods within our SAML - Forward Proxy configuration. Has anyone encountered similar challenges with Azure AD integration due to this setup? If so, how have you addressed or worked around it?The goal is to only allow for the method “Client Enrollment” a specific Azure AD group. For that i will have two Enterprise Apps “Netskope Use

Did you know that using Netskope's powerful Cloud DLP and Microsoft Information Protection you can scan your M365 instance and identify sensitive data in order to classify it and label (or re-label) it to add the right context to the file metadata.   The high-level process to set up Netskope and MIP to label documents as sensitive is as follows:   In the MIP tenant, go to Classification and create a new label you want to apply to files with sensitive content. Publish the label to all users and groups. Select All under Users and groups. In the Netskope tenant, create a new API-enabled Protection policy. Under Actions choose IRM Protect > MIPand then the label you want to use. Alternatively if you wish to revise a MIP label based on the content, files that are already labeled by MIP can be scanned by the Netskope API-enabled Protection policy for sensitive content. If the policy detects sensitive content in the files, then the policy replaces the file label wit

NETSKOPE THREAT LABS Evil Ant, Azorult, and Segmented Threat Reports Evil Ant Ransomware Evil Ant is a new Python-based ransomware with a hardcoded key, which makes recovering files without paying the ransom possible. An Evasive Azorult Campaign Netskope Threat Labs uncovered a new Azorult campaign using HTML smuggling, reflexive code loading, and AMSI bypass to try to evade detection while stealing crypto wallets, login credentials, browser files, and important documents.Segmented Threat ReportsNetskope Threat Labs has published five new region-specific and industry-specific threat reports.Canada Japan Financial Services Healthcare Retail Anyone can subscribe to this mailing list on the Netskope Threat Labs page: https://www.netskope.com/netskope-threat-labs#subscribe

We are looking for a way to deploy the Netskope Client for Windows using Jumpcloud and Okta as our IDP source. We’ve found a few articles for how to do this for macOS with Jumpcloud as the IDP but nothing for Okta.We’d like to set this up similar to our Kandji deployment for macOS where Okta serves as the identity provider. Has anyone had success with this? 

Can Someone Help We have a client Netskope installation v91.0.6.812 which i need to remove I have the password but the installer seems to be broken as it askes for the STAgent.msi "The Feature you are trying to use is on a network resource that is unavailable" I have tried other versions of the msi file but all fail.   Even the new installer we have gets stuck on removal of the old software, Tried all sorts, but cant get it off. Anyone have an idea or have the original v91.0.6.812 STAgent.msi to allow me to remove it ?   Derek  

It is often necessary to disable private app steering when a user is on premises. This can be accomplished by using Dynamic steering as documented https://docs.netskope.com/en/dynamic-steering.html   On-premises detection is required for Dynamic steering and the Netskope client can detect that it is on-premises either by resolving a DNS A record to IP address or by probing an HTTP server.   NOTE: The host probed by on-premises detection should never be steered through Netskope Private access neither explicitly or by wildcard. This will result in unwanted behaviour.   In this article I will explain how you can use nginx to host a service which can be probed for on-prem check. As per the Netskope documentation for HTTP, the HTTP server must return 200 OK response code to determine if the device is on-premises.   nginx is an open source highly performant and scalable HTTP and reverse proxy server which can easily be used to perform this function. There are ma

Hi all,After a couple years, we finally finished revamping most of our Traffic Steering documentation making them more user friendly! The revamp project consisted of:Adding missing content Updating any best practices, guidelines, and requirements Breaking up articles Fixing content structure for usability Adding new screenshots and network diagramsPlease let us know if you have any feedback.You might be wondering, what about the IPSec and GRE integration guides? Those are next!Thank you to everyone who has sent feedback on these articles!

As we do every month, we have published the Threat Labs Statistics for February 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and GitHub were on the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries and the return of GitHub to the top three. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware. In February, 49% of all malware downloads originated from a record-setting 215 distinct cloud apps. The top malware families active in February included the banking trojan Grandoreiro, the RAT AdWind, and the ransomware Lockbit. Cloud Malware Delivery Attackers attempt to fly under the radar by delivering malic

As we do every month, we have published the Threat Labs Statistics for January 2024!The article is reported below for your convenience, but you can find a public link here.Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide. SummaryOneDrive and SharePoint were again in the top of the list of top cloud apps used for malware downloads, showing a very strong preference from adversaries. Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 49% of all malware downloads in January originating from 178 cloud apps. A wide variety of malware families were circulating in January. Malware families including the Infostealer AgentTesla, the RAT AdWind, and the ransomware Lockbit and Trigona were among top families. Cloud Malware Delivery Attackers attempt to fly under the rad

Another monthly Netskope Threat Labs report. This edition is dedicated to healthcare. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the healthcare sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Although Microsoft OneDrive is the most popular app in the healthcare sector, its popularity lags behind that of other industries. The popularity of other Microsoft products was mixed, with SharePoint similarly lagging other industries but Teams leading other industries.Cloud App Abuse: Microsoft OneDrive was also the most popular app for malware downloads but lagged behind other industries, underscoring that successful malware delivery depends on both adversary tactics and user behavior.Malware & Ransomware: Among the most prevalent malware families targeting victims

The first Netskope Threat Labs report of 2024 is dedicated to financial service. A public version of the same report is available here.This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past 12 months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps. In This Report Cloud App Adoption: Microsoft OneDrive, Microsoft Teams, and SharePoint are among the top five most popular apps in the financial services sector, with Microsoft Teams being significantly more popular than it is in other industries. As in other sectors, Microsoft OneDrive still takes the top spot.Cloud App Abuse: OneDrive, Github, and SharePoint are the top three most popular apps for malware downloads in the financial services sector. Users in financial services download malware from GitHub and Microsoft SharePoint more frequently than users in other industries.Malware & Ransomware: A

Public version, available here.By Tom ClareNetskope continues to advance inline threat protection capabilities and has improved its detection and blocking of malware and phishing attacks while also lowering and improving its false positive rate in the latest AV-TEST Report. In every part of the testing, Netskope improved.Today more than half of user egress traffic involves applications and cloud services rather than websites, and where more than half of threats are delivered knowing these popular domains are allowed, or worse yet bypassed from inline threat inspection altogether. Relying on endpoint protection for executable malware leaves a blind spot for fileless attacks using fake login forms and phishing techniques hosted in applications and cloud services that require inline content and context inspection to protect users. This dynamic changes the playing field for threat protection testing and what must be prioritized with respect to detection speed and efficacy scores.First, use

This section of the forum is dedicated to the Netskope Threat Protection technology. In this section you will find configuration guides, reports, research documents, and in general a space where you can submit questions and be informed about the multiple features of our threat protection capabilities, including Behavior Analytics (UEBA) and Remote Browser Isolation (RBI).Everything You Always Wanted to Know About Threat Protection* But Were Afraid to Ask!Useful resources: Netskope Threat Labs Homepage Cloud and Threat Reports (published on a quarterly basis and focused on a specific topic) Threat Labs Reports (published on a monthly basis and focused on a specific topic, or a specific geographical region) Upcoming Events Recent Blog Posts (contains the links to the Netskope Threat Labs statistics published on a monthly basis)