Other Forums

 Context: What's the user provisioning? User provisioning using IDP such as Azure AD or Okta using SCIM protocol or provisioning users directly from your on-prem Domain Controller using Netskope Adapter (aka AD Importer). User provisioning is a one way push of users and groups to Netskope tenant. IDP or your Domain Controller is always the source of truth for Netskope (except for the users manually added). On Okta and Azure AD Netskope has a gallery app titled "Netskope User Authentication".  When users are manually added you can not add them to a group.   Can I sync all users at once? The answer to the question in the subject is "yes" you can sync all users dynamically (or using dynamic groups) but here are some considerations:   Do you want to control Netskope Client rollout group by group or department by department? If the answer is yes it may be a better idea to assign few groups at a time to the gallery or custom app on your IDP.  This will make your

The rise of generative AI tools such as ChatGPT has captured the attention of many people. In a recent blog post, we discussed the benefits, challenges, and potential risks of AI in the cybersecurity domain. We're curious: do you have any questions or concerns about AI? Feel free to share them with us! 

Hi Community Members, I have recently deployed cloud exchange in my organization, and integrated few plugins, however I need further support on implementing business rule to a monitored email box for the SOC team to pick up. At this stage, I am looking to maintain a simple workflow. Current scenario/implementation:- Deployed Cloud Exchange and integrated with my tenant.- Have the plugins of Notifier & Netskope ITSM configured- Able to receive "ALL" the alerts from Netskope tenant to cloud exchange My further requirement as below:- When a Web-access category is denied for a user, he may proceed with a suitable justification with "Justify Usage" or "Report False positives" description box enabled (by means of Email notification template) - I have configured this. (Completed)- I need only the "Justify Usage" notification alerts to be received by the Cloud Exchange vs Compared to "All" the policy alerts being received by Cloud exchange - How do I tweak it ? I need to minimize the log f

Microsoft rolled out an unannounced change earlier this year to newly created Office 365 tenants, which disables the ability to create Inbound exchange 'On-premises to O365'.  Inbound Connector Restricted Imposed by Exchange Online (office365itpros.com) I have been working with Microsoft to attempt to enable this connector type for a developer M365 tenant, but they are reluctant to do so.  Initially they attempted to have me try the new Partner Org to O365 inbound connector, which raised SMTP 451 errors in Skope IT. Now their reply has been to: "We really need for you to contact Netskope to ask them for the certificate domain, the requirements for creating the inbound connect is in place for a few months now and most likely Netskope have the certificates ready which they can provide if a customer ask them for it” Since this only effects customers that would be using M365 end to end, I am not sure if Netskope has seen or heard of this issue yet. 

I was on my way to airport when a colleague of mine message me asking for help with the traffic routing in Azure as he was having issue and didn’t know where the problem was. It was a minor issue and few messages back and forth during my Uber ride and he was off to the races. The fact that he has a sharp mind makes explaining very easy. However, his query triggered the idea for creation of this post i.e., traffic steering option understanding from Azure to Netskope. The first thing I like you to understand is that we can classify traffic into two groups: Machine Traffic: Think “Infrastructure-as-a-Service (IaaS)” where applications and systems running on Azure Virtual Machines are generating traffic. User Traffic: Think “Desktop-as-a-Service (DaaS)” where users are using Azure Virtual Machines in Azure as their desktop whether it’s an Azure Virtual Desktop or Windows 365 Desktop offering. You can integrate Azure and Netskope in multiple ways for both type of traffic groups. In this p

Hi Guys, I am still very new in the Netskope world and this might seem a very simple question, but I don't know how to do it 🙂 Is it possible to generate a report of all High and Critical level incidents over all Fields (DLP, Comp Credentials, BA, Malware, Malicious Sites) in a single report on a daily basis? The reports section with the building of widgets does not make too much sense to me yet. It would have been nice to filter on the incidents page and then have a button to apply the filter to generate a report based on the filters. Please, if anyone can assist with this, it would be greatly appreciated 🙂 JG

Machine learning-based image classification offers a fast and effective way to detect sensitive information within images, allowing for granular real-time DLP policy controls. Our DLP Classification Service accommodates an extensive range of image classifiers, such as passports, driver's licenses, SSNs, checks, payment cards, screenshots, whiteboards, and more. To improve its accuracy and provide better customer experience, we have retrained the classifiers for Release 103.   Significant changes were made to the image classifiers, including: A newer underlying model architecture with an 80% increase in the number of parameters High-quality labeled training data, including augmented images that are realistic for the image data we see in the cloud, to minimize false positives   According to our lab tests, most of the image classifiers show increased accuracy. If you have any questions or feedback about the image classifiers, please let us know.

Earlier this month, we enabled the inline AI-powered phishing detection engine in Netskope Threat Protection for all customers, significantly enhancing its capability to block phishing content in real time.    Phishing is one of the most common online security threats. At Netskope, we use cutting-edge deep learning techniques to learn the patterns of phishing websites. Similar to generative pre-training of large language models, such as BERT and GPT, we use a large number of web pages to train the HTML encoder and then use it to build the phishing classifier. We have been awarded three U.S. patents for our innovative approach to phishing detection.   We have been gradually rolling out the inline phishing detection engine. The engine has discovered a range of zero-day phishing attacks in customer traffic, including active phishing campaigns targeting Microsoft, Facebook, and so on.   How can you tell if a page was blocked by the inline phishing detection engine? &nbs

Hi community members!Is there a High Availability system for the Cloud Exchange module? Active/Active or Active/Standby? Is it on the roadmap?Thanks.

SSL certs for Cloud Exchange using Let’s Encrypt Requirements CloudExchange and underling Ubuntu server running Domain url already setup Setup steps Domain and DNS setup Install Certbot Run Certbot to generate certificates Install certificates for Cloud Exchange to use Domain and DNS setup I get that this part might not be needed so if you already know how to setup DNS, skip down to the Certbot section. Buying the domain is super easy and you just select “get a new domain” in Google Domains so I won’t cover that. Of course you can use any service to buy your domain.    DNS - I went to domains.google.com > DNS and created my A record to point to my Cloud Exchange Ubuntu server that is running in AWS.     Host name Type TTL Data demo1-netskope.com A 1 hour 35.165.210.194 Now I can get to my Cloud Exchange with the url instead of the IP address but as you see I have a certificate error because I am using a self signed certificate.

We've opened a support ticket as we believe we've found a bug where devices are not honoring the fail close option in the Client Configuration. We have fail closed unchecked, yet we notice almost all our systems in the UI (as well as logs) having fail closed enabled. That led us down the path of wanting to do the install of NS Client with fail closed disabled -- the tool tip says this can be done during install however we can't find on the KB or help section what those install switches are to do this.There is also no bulk way we can see to change all devices to fail close disabled (API or UI). 

Hi, I have a tenant with more than 10000 users (integration Azure via scim)I need to get the scim_user_id of all of them, to add some to some groups manually (postman)I'm doing the query with postman using "SCIM - List all Users", which is basically doing get {{scimurl}}/Users The answer is ok, but incomplete.  I see "totalResults": 16717, but it only returns 1000."itemsPerPage": 1000,"startIndex": 1 Is it possible to get a complete list with all 16000 users?Is there a way to paginate it? I thought it would be a postman limitation, but doing the query with a curl (linux command) the result is the same.Any ideas?  Thanks in advance!Best regards 

Publisher doubts about the robustness and HA of the platform Good evening, thanks for the collaboration. Thinking in a critical and highly productive and highly demanded environment, what would be the correct specifications to install a publisher? Thinking in an example of 30 applications, 10 of them web, standard and alternative ports, and other applications like Jira, SAP, SMB, private applications, etc. And that will be constantly demanded approx a load of 100 to 300 concurrent connections. Thinking about a scenario and having HA Publisher, what should be the capacities ? how many Publisher should be deployed ? Is it possible to deploy a VM in Vmware environments, with OVA/OVF ? is it possible to install on a base O.S. like Centos/Debian/Ubuntu, other Linux and/or UNIX, that is to say a VM with one of these O.S. and install a Publisher on them ? is this compatible and/or possible ? Thank you for your collaboration, I remain attentive Best regards

So, we have an issue in our environment that we've been troubleshooting for several months now. When an Azure managed user locks their PC, the Netskope client drops the filtered subnet assigned to the PC, which then triggers Duo MFA. Unfortunately, this behavior doesn't occur when using the MS Authenticator, but we are fully integrated with Duo and cannot move to MS MFA...We contacted Netskope support, and they collected logs and proceeded to tell us that the NIC was disabling and that was the issue... along with possibly DNS or our AnyConnect VPN... I can't believe the engineer was so clueless to suggest the NIC was disabling, when we maintain a connection to Azure and show the IP address change in the Sign-In logs, which I provided. Not to mention, DNS has nothing to do with the subnet changing on a device when it goes to sleep. As for the VPN, the behavior is the same regardless of having the VPN running, which was also provided to support. I am at my wits end with Ne

First, Let me start by saying that I tried raising this via my support and account teams and was wildly unsuccessful.About 2 weeks ago, the template message that is sent when a user creates a new ticket via the portal was updated.  However, the message that is now being sent does not make sense for the context of tickets created via the portal. Hi {support contact},We greatly appreciate your choice in Netskope, the leader in cloud security. For logging new support cases or tracking progress for previously logged tickets, we highly encourage you to leverage our support portal at https://support.netskope.com/. Support Portal allows us to more quickly associate your issue with the correct customer account and start problem solving.Please note that if you emailed from a non corporate email domain account such as Gmail, Yahoo, Hotmail, etc., we are unable to map your request with the correct customer account, therefore will not be able to process your request.Based on the current proce

Hello community,We are looking for a way how to subscribe to official Netskope vulnerabilities that have been identified by Netskope and will notify partners / subscribers afterwards. The goal is that you can subscribe to an official Netskope vulnerability notification service based on products and features via e-mail and then receive a mail when vulnerabilities / CVEs have bee detected on Netskope products.Thanks for answering...MBL

Hi Team,The installation of the netskope CRE 1.0.0 plugin fails.  Both the SCIM URL and SKIM Key should be fine, but I get the following error on clicking "save" "Error: Error in credentials(Forbidden user)"   Version information is below.Core Version:3.4.0 UI Version:3.4.0 Database Version:3.4.0I am not sure what the cause is and would appreciate it if someone could provide me with some information.  

Provisioning Users and Groups from Office 365 to Netskope/Policies based on Groups/Users Office 365Hello,good afternoon, first of all, thank you all very much for your time and for your collaborationI have a question regarding the level of licensing required to support provisioning "All Users and User Groups from Office 365" ( To be able to both provision users and groups, to Netskope Tenant and to be able to apply policies/rules based on Users and Groups ), with a standard plan/subscription: Exactly "Microsoft 365 Business Standard". This subscription/plan level named above ( Microsoft 365 Business Standard ) is compatible and supported for Netskope, for the above mentioned, i.e. Full Users/Groups for group/user based policies and provisioning users ? )Thank you very much for your time and your collaboration.I will remain attentive to your commentsBest regards

Overview Cloud Exchange CTO’s integration with MS Teams gives you the ability to send Netskope Alert messages to MS Teams. Using the Microsoft Incoming Webhook application from the Admin center Cloud Exchange will send messages to a configured Teams channel to notify you when an Alert was seen from Netskope. Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CTO Microsoft Teams account Setup Steps Microsoft Teams Enable Incoming Webhook Setup Teams Channel Configure Incoming Webhook Netskope Cloud Exchange Setup Netskope Plugins Netskope CTO Plugin Teams CTO v1.0.1 or greater Create Business Rules Create Queue Configuration Verify Integration Check CTO Tickets Verify tickets are coming into MS Teams   Microsoft Teams Setup Steps Enable Incoming Webhook Login to your Microsoft Teams admin interface and go to Teams Apps > Manage apps. Search for Incoming Webhook and allow it if it isn’t alre

Overview Cloud Exchange CRE’s integration with CrowdStrike gives you the ability to change a device’s status from Managed to Unmanaged (or vice versa) based off of the CrowdStrike Zero Trust Assessment (ZTA) score. This is helpful to give devices real time policy changes to protect your network when a device is seen as risky from the CrowdStrike sensor running on the device.   Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CRE CrowdStrike CRE plugin version 1.1.0 or greater CrowdStrike agent Setup Steps CrowdStrike Deploy CrowdStrike Falcon Sensors to your end devices Setup API clients and keys   Netskope Cloud Exchange Setup Netskope Plugins Netskope CRE Plugin CrowdStrike CRE v1.1.0 or greater Create Business Rules Create Action Netskope Policy Create Device Classification Rule Verify CrowdStrike Setup Steps Deploy CrowdStrike Falcon Sensors to your end devices Please follow the in

First of all, thank you very much for your time and collaboration. I have the following doubts:I understand that for the matter of detecting whether or not the client is on-premise, there is such a configuration for the client to detect it: -Whether it is resolving an internal DNS domain, for example, and with that it concludes, if there is a correct resolution, it determines that it is on-premise, in corporate offices and seek, let's say, skip the use of Netskope, so that the filtering does it the firewall and/or Proxies or devices within the corporate network. But here the doubt, what happens in cases where I have a VPN client, typical and traditional VPN client (whatever the vendor is, for example Forticlient, Global protect, anyconnect? Example I connect with my VPN client, from one of the known vendors, and if I manage, being outside the dependencies, to have connectivity to the DNS and resolve said domain that defines that it is on-premise or not, but in reali

Hi Team, I am new to netskope, not sure where to post for help.  Trying to create account for opening a case in https://support.netskope.com/s/login but can't.  Is there any other way, where I can log it. Can someone please help me in this query. S@m

Hi, I am getting internal server error while hitting below POST query through swagger/ postman https://alliances.goskope.com/api/v2/policy/urllist/deployI have provided all the required permission while creating token to make the request, not sure why I am getting this error.https://alliances.goskope.com/apidocs/?include_beta_routes=0#/policy/post_api_v2_policy_urllist_deploy Am I missing anything ? Please help me out with this issue. Thanks,Sakshi

Which versions of the Netskope client officially supports MacOS Ventura?

Would the community managers consider allowing participants to post inline images (maybe after a community member has some level of trust/rank and/or moderation and approval)?   Having images as attachments that need to be downloaded separately greatly limits their usefulness in conveying information quickly.  We can see that the platform supports the functionality from the "You do not have permission to upload images"  banner that pops up when we do try to paste one inline.