Product Forums

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

in one of our customer getting power shell attack in all users office 365 . how we can block .is it possible to block power shell access based on country using CASB or there is any other way to resolve this issue .

While accessing any sites on incognito mode is very slow for initial time. Once the page is loaded, all the sites are loading normally on new tabs. Once we reopen the browser with incognito mode again, the same issue happening again for initial time.any suggestions?

I am writing to inquire about the current roadmap and support for Manus AI within the Netskope NewEdge network. As Manus AI gains traction as a powerful general-purpose AI agent, our organization needs to ensure robust data protection and visibility over the sensitive information being shared with this platform.1. Current Status Inquiry: Does Netskope currently have a functional Cloud App Connector for Manus AI? Specifically, are the activities (such as "Post" or "Upload") already being indexed in the CCI (Cloud Confidence Index)?2. Development Suggestion (DLP Integration): If full support is not yet available, I would like to suggest the development of specific DLP controls for Manus AI, focusing on: Prompt Protection: Real-time inspection of text inputs to prevent the leakage of PII, PHI, or source code. File Transfer Control: Monitor

Team,Good morning. Is there a reason I'm getting DNS Leakage? Did I forget something in my configuration  See screenshots below.  All "DNS Traffic" is enabled in the steering configuration. DNS Profile is configured with resolver IP of 162.10.1.1 Real-Time Policy is configured. Thanks.  Expand Post

I am struggling with the props.conf setup to pull web transaction logs via S3 bucket. I have set up per Stream Logs to Splunk - Netskope Knowledge Portal .This would replace my setup for using REST API v2 for transaction logs eventually.  I currently have logs going in parallel into a temp index for validation before cut over.I am using queries below to validate time stamp detection and proper data parsing. If you have this setup to your satisfaction, Can I request you to share your props.conf? Validation queries: #Check if _time matches x-cs-timestampearliest=-10mindex=nsweb_temp sourcetype="netskope:web:test"| eval payload_time = tonumber(coalesce('x-cs-timestamp','x_cs_timestamp'))| eval splunk_time  = _time| eval diff_seconds = splunk_time - payload_ti

Does NS Client upgrade cause any impact on end user running traffic, especially on active web sessions, Audio/Video calls ? Version 132.0.7.2513_Windows 

User case :   Git Pull/Push basic commands does not work and throws connection timeout error when i enable NPA and even i have whitelisted git hub web site with ports 22,443 but when i disable NPA and use AOVPN it works . so need some advice ?Note: even i have enabled virtio proxy enabled at wsl setting but no luck 

We are supporting a client with two separate Azure tenants and using Netskope SSE for secure access. Our configuration allows certain Azure base URLs via NPA for PaaS services, while the Azure portal routes through SWG. We use the same client and steering configuration for users accessing both tenants.Observed Behavior:When accessing via GUI/browser, traffic is correctly segregated per tenant.When using CLI, traffic always routes to the primary tenant, even when attempting to access resources in the secondary tenant.CLI-based operations cannot properly enforce tenant-specific routing.Impact: CLI operations on the secondary tenant fail or incorrectly use the primary tenant context

Hello,We are looking to control access to a social media site with cloud app access real time policy. However, the site doesn’t exist as a selectable CASB cloud app today and we have to fall back to using SWG policy instead.The site in question is www.weddingpro.com.Can we get a new cloud application created for this website?Thanks,Nick 

Just wanted to see if any of you are servicing customers that have recently implemented NinjaOne for endpoint management and patching. If so, how have you approached the third-party patching? cert pinned app bypass?  domain bypasses? ssl no decrypt policies?  mix of all of the above? We have our endpoint management team working but we just foresee a massive maintenance task in the future for the needed and potentially changing domains? A wildcard approach seems like too much of a security hole. 

Hi team,Can we use  New Policy Group based on location and move all private access Policies on this group?  Example: Site A Private Access ( Group Name)          Site A Private Access Policy 1( Example Policy Name :File Server Site A Access)          Site A Private Access Policy 2 ( Example: Private Web Application Site A Access)         Site A Private Access Policy 3   ( Example: Backup Server Access Site A Access) Site B Private Access( Group Name)         Site  B Private Access Policy1 ( Example Policy  : File Server Site B Access)          Site B Private Access Policy 2  ( Example Policy: Private Web Application Site B Access)         Site B Private Access Policy 3   ( Example Policy: Backup Server site B Access) Challenge what I am trying to solve here is that group policy based on Physical location of offices, so that i dont need go through long list of Policy and navigating throu

Why sometimes on-premise detection shows “remote" and sometimes it shows “off-premise” when users are not in intranet, such as office environment.

It seems that users under SkopeIT are only displayed when accessing Cloud Apps or the Web.Events from Cloud Firewall or Private Apps are not included, resulting in limited visibility.Do you have any suggestions on how we can monitor user activity in these cases?

ObjectiveThe current Private App Segment definition conflicts with what is described in the Netskope Knowledge Base article.When Publisher DNS is enabled, both IP and URL must be defined in the host configuration of a private app segment.Reference:https://docs.netskope.com/en/private-access-best-practices#idm46139539889184In docs.goskope.com, enabling Publisher DNS can still only use URL to define Private app, 2026/1/6 PrerequisiteThis issue generally applies to Netskope Private App Segments Definitions. Context

I would like to get some clarification on a Netskope SWG + DLP deployment scenario.We have established a firewall tunnel to the Netskope cloud and integrated ADFS for user authentication. Both corporate-managed devices and BYOD devices (phones and personal laptops) are connected to the same LAN and their traffic is forwarded to Netskope through the tunnel.My question is regarding BYOD behavior: When ADFS authentication is enabled, are BYOD devices expected to experience browsing or authentication issues? How does Netskope handle user identification and authentication for non-domain-joined devices in this setup? Are there recommended best practices for handling BYOD traffic when using ADFS with a firewall-based forwarding architecture? Any guidance or real-world experience would be appr

 Ref Link Quarterly Product Release Webinar – December 2025 | Community   

Dear Team, We have implemented a policy to block the sharing of source code when a user attempts to send it via file attachments (such as TXT, PDF, DOC, etc.) to personal email domains like @gmail.com. The policy is working as expected when the source code is shared directly as plain text within the email or message body. However, when the same source code is included inside a file attachment and sent, the policy does not trigger. We have already raised this concern with the Netskope Support team, and the response received was that this use case is not supported. However, we request you to please re-check and confirm if there is any possible way to achieve this requirement. Note:We are able to block uploads entirely, but our specific requirement is to block the transfer only when the to_user does not belong to the corporate domain

There is a business need to have a desktop shortcut created to complete Re-authenticate Private Access.

Hello Community, Is it possible to implement Netskope in a workgroup environment? The customer doesn't have any AD or IDP solution in their environment and have a distributed environment.If possible what would be procedure? 

Currently, Netskope identifies certain IP addresses as malicious based on threat intelligence; however, due to the absence of SNI inspection, traffic to these IPs is sometimes allowed to pass through. This behavior results in an inconsistent security posture because malicious IPs should be blocked unconditionally to minimize risk.We kindly request a feature enhancement to ensure that any traffic destined for an IP flagged as malicious is blocked unconditionally, regardless of whether SNI visibility is available or not.This improvement would strengthen the security logic by guaranteeing that malicious IPs never bypass protection simply because SNI information is missing or cannot be inspected.Impact: Prevents risky connections to known malicious IP addresses even when SNI cannot be inspected Aligns enforcement with expected security best practices Minimizes potential attack vecto

Hi All, Has anyone integrated Crowdstrike NG SIEM with Netskope. In Crowdstrike i can see that their is native integration with Netskope and require API Key.  API V2 Document which is available in Crowdstrike portal is outdated. In Netskope, we need to create role and then generate API key. Not sure which role we should assign in Netskope Tenant before generating API key.and  also correct me if role creation in Tenant Admin and generating API key is wrong method. Thank you in Advance.Govi33