Product Forums

Hi all: Is anyone out there running WSL Version two and using Netskope? 

Hello Everyone,I have a query regarding Netskope with Sensitivity Labels for Email DLP.We’ve successfully integrated Netskope with Sensitivity Label Integration so that all labels are published into Netskope. For Cloud and Web traffic, DLP enforcement is working perfectly with label‑based rules.Current Email DLP Setup Created DLP Entities, Rules, and Profiles for all labels: Public, Restricted, Secret, Top Secret. For Word documents, we extracted metadata via File → Info → Properties → Advanced Properties → Custom tab. And created a Regex Entity. Example: ClassificationContentMarkingHeaderText.*Restricted Used these

We are facing one issue where users are sharing google docs from external domains eg: gmail.com to nykaa.com, and nykaa.com users are able to access the google docs or sheets on which they can paste /write the sensitive information.So how do we block this transaction with Netskope

HI Team,We are currently receiving 24-hour scheduled reports for USB activity from Netskope; however, this does not fully meet our organization’s monitoring requirements.We would like to highlight a specific requirement from our end:• Whenever USB access is granted to any user, we need the ability to capture and receive activity details immediately (near real-time or on demand).• The report/log should include:o User detailso Device informationo Type of activity (Allow/Block/Alert)o Files accessed or transferredo Accurate timestamp of the activityAt present, while these activities are visible in the Alerts/Events section, the scheduled 24-hour reports do not provide complete visibility, especially for all actions (Allow/Alert/Block) in a timely manner.Therefore, we request you to:1. Validate this requirement from a product capability standpoint.2. Confirm whether real-time or near re

I am experiencing intermittent periods when I am unable to update incidents (In Progress/Resolved/False Positive) which last for hours at a time. Is it possible that another user making changes is causing this?

This is not an improvement for administrators, in my opinion.The Last Event filter used to have “Admin disabled” and “User Disabled” making it easy.Now one has to select “Actor” and “Status disabled”

Hello.Netskope was installed to replace a competitor product and I have been having intermittent issues ever since. Sometimes the laptop can be up for days without issue - sometimes I have to reboot multiple times in a day. - I cannnot replicate this issue at will.After a reboot the laptop Non-Paged Pool is approximately 1.2GB - that looks high but I had no reason to look at this before the Netskope client was installed.Usually the first I am aware of an issue is in a Teams call - when it becomes unresponsive - but not every Teams call.When I look at the non-paged pool size it is up to about 26GB. at this point nothing much works and I have to Hard reset the laptop (Hold the power button down for 20 seconds),I have a higher end DELL laptop with 32GB of Physical memory installed (the standard is 16GB).I now find myself camped in Task Manager watching the value to see if it is rising - and rebooting the laptop before every important eams call,

Hello fellow Skopers,if you are like me, you sometimes struggle analyzing Netskope client logs because they are so noisy, span multiple files, and are difficult to filter. Especially if you are faced with a problem where you’re not quite sure what to look for. The fact that there is no reference guide available for these logs complicates things further.That’s why I built a little CLI tool to help me analyze the logs and separate the signal from the noise.It’s very early in its development, but it can already do these things:Output a chronological, scoped timeline of high-signal events, showing errors and client status changes Filters relevant events like client lifecycle and UI status, config and update activity, tunnel and gateway events, DNS/proxy/PAC problems, Fail Closed and captive portal signals, NPA connection events, and TLS/certificate issues Analyze and inventory client log bundles (the zip files) with useful information

In our environment, we found that M365 Copilot Cowork is not working when user’s connection is protected behind Netskope. Other customers using Netskope seems to be reporting the same issue as well.Microsoft’s documentation on network requirements for Copilot Cowork has been published here Cowork network endpoints (Frontier) | Microsoft Support and they cited requirements around supporting long-lived connection. Microsoft support has also shared an internal document that mentioned about the use of Server-Sent Events--which based on Internet research is not something SASE/SWG products support by default.Do you have a recommended configuration that we can use to make Copilot Cowork to work behind Netskope? Any plan to make this configuration to be part of the standard M365 policy from Netskope so that we don’t ne

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

We are currently observing multiple “Compromised Website” alerts in Netskope for several local news websites and some insurance company websites that users frequently access.These appear to be legitimate websites, but Netskope is flagging them as compromised or malicious. We would like to understand: What threat intelligence source/classification is being used for these detections? Has anyone else experienced similar alerts with legitimate local news websites? Could this be related to shared hosting reputation or a temporary website compromise? What is the best approach to validate whether these are true positives or false positives? We are trying to determine whether the websites are genuinely compromised or if additional tuning/exclusions may be required.Any guidance or similar experiences would be appreciated. 

There is currently no available RTP App for the AI platform Draftwise. This makes it very difficult to bypass all Draftwise traffic.

Hello Everyone,I have a few questions regarding  Reverse Proxy as a Service (RaaS) configuration with Microsoft Entra ID.We have configured Reverse Proxy as a Service (RaaS) with Microsoft Entra ID by following the official Netskope documentation below:Reference Document:https://docs.netskope.com/en/reverse-proxy-as-a-service-with-microsoft-entra-id-1 Configuration Summary Created an Enterprise Application in Microsoft Entra ID for Reverse Proxy Exchanged all required URLs and certificates between Entra ID and Netskope

I would like to find out whether the Netskope POP IP addresses change frequently.We currently have a cloud-hosted application that only permits access from our organization’s public internet IP address. However, the monitoring TVs are connected to the same LAN as the User LAN and their traffic is routed through the Netskope tunnel.Due to this setup, the source public IP seen by the cloud application may become the Netskope tunnel IP instead of our normal internet public IP.Kindly advise on the following:Should we whitelist the Netskope tunnel/POP IP addresses on the cloud application side?Is there a way within the Netskope proxy configuration to bypass the Netskope tunnel for this specific application or traffic, so that it uses our normal public internet IP instead?If bypass is possible, what would be the recommended approach or best practice? 

Hello TeamI'm setting up the Log Shipper plugin in Cloud Exchange and I'm getting the error shown in the attached image. Steps taken:I've already updated the API token generated in the Netskope tenant (with the necessary permissions for integration with CE).I have verified connectivity between Cloud Exchange and the tenant.Despite this, the system won’t let me complete the plugin creation. Has anyone experienced a similar issue, or do you know if there are any additional settings in the Log Shipper configuration that I should check?Best regards :)

From the investigation:The primary application itself is not being blocked. During the session workflow, the application initiates requests to external third-party tracking/analytics domains. Netskope identifies the traffic under the application context, but the actual blocked request is towards a third-party analytics/tracking endpoint. The current policy categorizes the request under a risk/control policy and blocks it, resulting in a user-facing warning/interstitial.Requirement:Allow the application workflow to continue without user interruption. Avoid broadly allowing all third-party tracking traffic globally. Maintain the existing security posture and policy controls.Questions:What is the recommended Netskope approach for handling embedded third-party analytics/tracking requests initiated from applications?  embedded third party urls are connect.facebook.ne

Hi there,Currently Netskope has a process to encrypt the forensic data collected via DLP incidents. However once encrypted this data can the only ever be accessed the netskope, which prevents legal investigations or ever migrating this data away from netskope.Therefore there should either be a way for user to bring their own keys for this encryption, so it can also be managed separately or have a break glass process so in the need of accessing outside netskope it is possible.Thanks

Expanded Pulumi provider for Netskope Publishers: now targeting 25+ infrastructure platformsWhen deploying Netskope Private Access, one of the recurring operational tasks is provisioning and registering Publishers. A Publisher is the lightweight connector that sits in your data center, cloud environment, or virtualization platform and establishes the secure path between users and private applications, without exposing those applications directly to the internet.I built an unofficial Pulumi provider for Netskope Publishers to make that process easier to automate across different environments.The project started with support for AWS, Azure, GCP, Kubernetes, and vSphere. Since then, support has expanded significantly, and we are now adding support for even more cloud and infrastructure platforms.The provider currently supports, or is being extended to support:Platform Pulumi component

Note: This is a open source community project and not supported by Netskope Engineering/Support. For support with issues contact John Neerdael @jneerdael@netskope.com After publishing my unofficial Pulumi provider that leverages this helm chart  for provisioning Netskope Publishers, I also wanted to share a second community project: an unofficial Helm chart for deploying Netskope Private Access Publishers on Kubernetes.The chart is called kubernetes-netskope-publisher and is designed to run Netskope Private Access Publishers on Kubernetes distributions such as k3s, kind, EKS, AKS, GKE, OpenShift, and bare-metal Kubernetes from a single Helm chart.This is not an off

Hello,I'm building an internal framework for safely adopting MCP (Model Context Protocol) servers at FCBT. I came across the Netskope community articles on the MCP penetration testing methodology, the Netskope MCP Server (technology preview), and AI behavioral security — all directly relevant to what I'm scoping.A few questions on what's available in our tenant today:1. Does our current Netskope subscription include visibility into AI host traffic (Claude, Copilot, ChatGPT) and MCP server endpoints (e.g., URLs containing /mcp or /sse, domains like mcp.atlassian.com)? If yes, can you share or point me to the dashboard/report?2. Is the AI behavioral security capability (the "Invisible Insider" feature) available to us, or does it require a different SKU?3. Can our team get access to the Netskope MCP Server technology preview? I'd like to evaluate it as part of the framework.4. For the next 90 days, can you pull a report of FCBT user traffic to AI