Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

dwillisNetskope Employee

published in Netskope Cloud Exchange (CE)

Netskope Risk Exchange Ecosystem - Making User Based ChangesKnowledgebase, Cloud Exchange

Netskope wishes to make it easier for our customers and partners to identify and respond to high risk users, instances, apps, and workloads using automated enrichment and correlation actions. This will enable our customers to leverage multi-vendor sourced or single vendor correlated findings to continuously tune Netskope’s adaptive trust policy enforcement framework. This blog series will explore a number of different workflows that those comfortable using basic scripting, or enablement tools like Postman, can employ to programmatically update and inform your inline policy actions. These are just some of the functions that the newest version of Cloud Exchange, version 5.1, supports now and in the future. Look for it to hit the shelves at the end of October. One of the key value propositions of Netskope is its ability to correlate multiple user personas (Korg-lord-of-thunder, davidw@dwillis.com, and fluffythevampireslayer) to a single, unique identity - dwillis@company.com - managed by

400

3 months ago

kkhorramnejadNetskope Employee

published in Cloud Firewall

Navigating the Cloud: Evolution and Security of Hybrid Applications with Cloud FirewallArticle

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

3220

8 months ago

gcut

published in Security Posture Management

SSPM (SaaS Security Posture Management) template based rulesNews

In the 114 release, we are excited to introduce a new type of content for Netskope SSPM: template-based rules. These rule templates are designed to assist deploying environment-specific detections for known threats, noteworthy anomalies and address misconfigurations. Using templates makes it easier to establish a more expedient and proactive defense strategy for your SaaS ecosystem.Each template is composed with the same Netskope Governance Language (NGL) rule logic which is also used in the hundreds of built-in detections bundled within Netskope SSPM. Kindly refer below steps Template based rules are predefined detection rules, which contain placeholders intended to be filled by the user. By simply populating the placeholders within the rule, users can effortlessly generate rules tailored to their specific business requirements and constraints. For example, you might want to ensure every user account in a SaaS application is registered with a company provided email-address? Or creat

1360

8 months ago

pppNew Member III

asked in Private Access for ZTNA

Problem with auto update

Hello Community,some of our clients stuck on version 114 or 117 - most updated without a problem. Has anyone encountered something similar and maybe solve it? Best regards

601

23 hours ago

CuriousExplorer II

posted in Private Access for ZTNA

NPA Publisher SSH auth via AD and Radius for MFA

Hi Everyone, Thought I would share some information about Authentication to AD and using Microsoft NPS for radius auth providing MFA when connecting to the Publishers with SSH. This is useful instead of using the default shared account. The information I obtained to get this working was obtained from the following sources, it was quite straight forwarded and implemented without much difficulty… and I am no Linux admin. Introduction to network user authentication with SSSD | UbuntuHow to set up SSSD with Active Directory | UbuntuTroubleshooting SSSD | UbuntuAzure MFA for SSH using NPS/MFA Extension Good luck with it, hope someone else finds this helpful.

1021

1 day ago

eranNew Member III

asked in Next Gen SWG

REST API V2 - /adem/

Hi,I’m trying to use /api/v2/adem/deviceoslist on the REST API v2.Before adding the specific permission for the endpoint - I’m getting "You cannot consume this service".After adding it, I’m getting "Unauthorized".Both times the error code is 403.How can I use this Endpoint?Thanks

931

1 day ago

cswordNew Member III

asked in Netskope Cloud Exchange (CE)

Web Scraper Plugin for Threat Exchange not recognizing CIDR blocks to push to URL list

Can CIDR blocks be scraped and pushed to a Netskope URL list using the web scraper plugin for threat exchange? I have one setup to pull from the Proofpoint Emerging Threats IP block list (https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) but it seems to only push individual IPv4 addresses and ignores anything with a CIDR.

4 days ago

secproceoNew Member

asked in Private Access for ZTNA

Creating Subnet for NPA Access

Team, Good morning, and Happy Friday! I had a meeting with my server admins and network engineers. I was told they must access hundreds of servers through RDP and network gear, such as routers, switches, and administration consoles. In addition, smaller subnets /24s may be created. My plan is to make administration of NPA easier, I was going to add a /16 or /8 subnet range in my NPA configuration that includes all the above devices. I wanted to know if anyone had any issues or limitations with NPA using large subnets. The extensive subnet ranges will only be used for two groups. All other teams will have one-to-one NPA configuration. Thanks again for your time and input.

464

7 days ago

MM_NSNetskope Employee

posted in Next Gen SWG

Netskope Client and PAC files

If you have PAC files or WPAD deployed to user base here are recommended settings:   1. Following traffic needs to go via PAC addon-<TENANT-NAME>.goskope.com     2. Following traffic needs to go DIRECT gateway-<TENANT-NAME>.goskope.com gateway-backup-<TENANT-NAME>.goskope.com dns.google     3. Do not use Netskope consolidated IP ranges in the PAC file. If you add global range the "addon" traffic will also fall under that range.     Sample PAC file:   Here is a typical PAC file syntax. Check what's the ultimate "return" statement. The address "163.116.128.80:8080"  in this PAC file is the Netskope Explicit Proxy over Tunnel IP address.    { <snip> .. .. /* Don't proxy to access to Netskope URLs for clients     */       if (shExpMatch(host, 'gateway-<TENANT_NAME>.goskope.com'))          { return 'DIRECT'; } (repeat for

11662

9 days ago

Sushil007Netskope Partner

asked in Next Gen SWG

Trend Micro Security Agent No internet Connection error

When I have installed the netskope client, my trent micro security agent gives the error Check you internet Connection and I am not able to scan. What should I configure in my netskope tenant to allow the internet connection?

533

10 days ago

jpark124New Member III

posted in CASB

v2 API documentation parity to v1 available endpoints

Hello, New to Netskope.  I was able to find the v1 API documentation https://docs.netskope.com/en/netskope-platform-rest-apis.html as well as the v2 API documentation https://<tenant>.goskope.com/apidocs/?include_beta_routes=0 We're looking to utilize the versatility of the v2 permission based token.  I didn't see the v1 API endpoints available in the v2 API documentationexample: https://docs.netskope.com/en/manage-quarantine-files.html for v1 wasn't in the v2Is there additional documentation that I'm missing?  or is there a roadmap/timeline to when the v1 endpoints will be available in v2? Thank you for your time and insight into this. -Han Park

28010

11 days ago

elawaetzExplorer III

asked in Private Access for ZTNA

Providing URLs in the NPA block pop-up / user notification

We have configured a User Notification / pop-up when users receive a Block action in NPA, to advice them, that they have tried to access an application which is blocked.We also coach them to raise a ticket for this on our ServiceNow system, and ideally we would like to provide a link in the pop-up, that leads users directly to our ServiceNow instance.It says in the description:“The "User Notification" template can be customized by directly editing the HTML below. Use the insert button to insert Netskope template variables. Only simple text and links are supported.”I have already learned, that apparently variables are not an option for the NPA pop-up.How about inserting URLs into the notification?I have tried various options, but it doesn’t seem to make its way into the pop-up. --Erik

230

12 days ago

Michael Horne OCDNetskope Partner

asked in Private Access for ZTNA

NPA access without a client from branch sites

Hello,I want to clarify if the Netskope client is required for NPA access for users who are at the office.We have deployed NPA so that we can force an external public Application traffic through a publisher to get a fixed public IP address due to public IP address whitelisting requirements. As we have IPSec tunnels connecting the site to Netskope cloud, do we still need to have the client installed on the users device? Do we need to have browser based access configured for this to work?For Zscaler this is not a requirement. We use Zscaler ZPA for another customer to route Guest Wifi clients to the self-registration portal. The Guest traffic goes over IPsec tunnels to the Zsclaer cloud and Zsclaer send to to a ZPA connecter. This allows the routing of Guest traffic without having to send it over the customers internal network.This set up does not seem to work in Netskope. If application trafic is sent over the IPsec traffic Netskope, it is not sent to the Publisher. It works when the

585

14 days ago

sean.clowesNew Member

asked in Next Gen SWG

Agent Deployment after macOS 15+

Hey folks, does anyone have any experience so far deploying Netskope Steering Agent to macOS in versions above 15? Our Jamf policies that have worked for some time have stopped. Specifically the VPN configuration profile fails to deploy with the error:The ‘VPN Service’ payload could not be installed. The VPN service could not be created. This continues to work on anything below 15. Anyone needed to update their Jamf policies in order to get this to work? And by policies I mean the configuration profiles?

56326

17 days ago

john.gaoNew Member

asked in Cloud Firewall

Inquiry Regarding Server-Side Events and Traffic Inspection

Hello,We have quite a few joint customers who utilize your security solution. Recently, we’ve observed that some of these customers are encountering challenges with server-sent events (SSE) that we employ in our production environment for near real-time communication.Could you kindly clarify if Netskope buffers SSE streams for traffic inspection? If so, is there a recommended configuration or approach to ensure uninterrupted SSE functionality? Thank you for your assistance. Best regards,John

314

17 days ago

maxkorNew Member III

asked in Private Access for ZTNA

Devcie classification unmanaged

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.

15710

17 days ago

adebrattoNew Member

asked in Private Access for ZTNA

Breaking out printer traffic - Is this possible?

We are just kicking the tires on the Netskope Private Access functionality. We are trying to understand if it would be possible to drop certain traffic out of the Netskope tunnel and onto the local wire. For example, we do not want to send print jobs from the endpoints to the publishers if we can just break that traffic out of the tunnel and drop it right to the printers in office.Any advice? We have been tinkering with on-premise / off-premise steering configs but cannot put a finger on how this could/shoudl work.

842

17 days ago