Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

620 Topics

I
ivan.baracNew Member
asked in DLP

How to limit upload for WeChat Windows app

I have request from customer to limit file size for upload in WeChat Windows desktop up. Limit size is 25 MB. I created File profile for File Size and include all Types, but doesn’t work well, I have notification action is blocked, but file is uploaded. If someone have idea how to solve that problem, please help me.

0
I
1 day ago
S
simonmaNew Member
asked in Private Access for ZTNA

NPA - On-premise Detection Exceptions

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

1
S
1 day ago
prajakta.yadav
Netskope Partner
prajakta.yadavNetskope Partner
asked in CASB

Policy enhancement

Hi, How to determine the maturity of policies in our tenant. For example, we have Netskope tenant with all policies implemented, then how to check whether these policies are enough or any enhancement is required further?

0
prajakta.yadav
Netskope Partner
2 days ago
Deepak_InfoTru
Netskope Partner
Deepak_InfoTruNetskope Partner
asked in Next Gen SWG

Single Netskope Tenant with multiple tenant Idp

I have a very weird requirement for a client: Can we sync users in single Netskope tenant from multiple tenant Idp. In this case, clients have on premises AD integration with Azure AD/Entra ID? Each on-prem AD here represents separate organizations If above is possible: How can we do Netskope Tenant SSO login for different Admins from different organization? How can we do CASB API as each organizations has separate O365 presence? Is it even possible to do Reverse Proxy for different applications? What are other limitations we are looking here if we go with this set up?  

0
Deepak_InfoTru
Netskope Partner
3 days ago
J
jdavilaNew Member
posted in Private Access for ZTNA

how to automatically disable agent npa tunnel, when endpoints are in company internal network?.

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

16
S
4 days ago
S
simonmaNew Member
asked in Private Access for ZTNA

Publisher App Reachability

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

0
S
4 days ago
A
aldiazNew Member III
asked in Private Access for ZTNA

Modify keepalive time interval between publisher and private app

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

4
S
4 days ago
E
EmmanuelVNew Member III
asked in Next Gen SWG

Network Location automation

Hi all,Is there a way to create/modify/delete Network Location with API?I already do it with csv but i did not find it with API.Thanks for your help

1
ejang
Netskope Employee
9 days ago
C
CarlosNew Member III
asked in DLP

API Data Protection Policy - User Profiles

Seeking some assistance with API Data Protection Policies.Looking to leverage ‘User Profiles' so that API policies will only trigger on a subset of users. From what I can see, user profiles only allows importing the full user identity. Is there a way to set up domain wildcards so that it trigger for all users of a domain e.g. *@domain.com? Note: Currently using Classic API data protection policies for M365.Is this something that will be addressed with the Nextgen API? 

1
ejang
Netskope Employee
9 days ago
C
cgrahamNew Member
asked in CASB

Usage report for Generative AI category includes Adobe?

As per title. Wondering why Adobe products have been included in the AI usage report. Adobe CC is categorised as “Web Design” and Adobe document cloud is “Business Process Management”.

1
S
Netskope Employee
9 days ago
mherbinet
Netskope Employee
mherbinetNetskope Employee
posted in Next Gen SWG

Share your experience on AM2 Root Certificate Rotation

Hello all,This is the start of a thread about AM2 Certificate Authority Rotation as we are getting closer to August deadline.The goal of this thread is not to provide a guide of the migration. You can find plenty of great explanation in the official docs:https://docs.netskope.com/en/netskope-root-certificate-rotation-guide-1/and also in our recent webinar here: However, if you have any question, please feel free to ask questions here.Or if you don’t know who is your CSM or Sales Representative, we can help you as well in this transition.As feedback are provided, we will also put more comment here.

3
mherbinet
Netskope Employee
10 days ago
M
munster
asked in Next Gen SWG

Difference between Category vs Application

Hi NetskoperI will like to allow Reddit for “BROWSE and DOWNLOAD” and not worry about URL updated when change.In SWG, I can use Application=Reddit, but there was no “BROWSE” If I will to use custom Category, I can see “BROWSE and DOWNLOAD” but I have to keep monitoring if the URL has change. I like to know what is the difference between Category vs Application? When should I use them effectively?thank

2
S
Netskope Employee
11 days ago
Rajiv Prasad
Netskope Partner
Rajiv PrasadNetskope Partner
posted in DLP

need help to migrate from McAfee to netskope

we are planning to migrate existing proxy solution of an organization from  McAfee to Netskopeif any one have any prerequisite please suggest  

3
E
15 days ago
E
EmmanuelVNew Member III
asked in Next Gen SWG

Real-time Protection Policy Hits

Hi all,I would like to see the stats of our policies. I have a widget of Real-time Protection Policy Hits showing the top policies but as i will deploy shortly CFW, i want to check if a policy is used or not.How can i get the stats for each policies i have (report in NAA, other) ?ps: when i click on “View all active policies” it redirects me to a blank page https://mytenantforexample.goskope.com/ns#/inspectionThank

3
ejang
Netskope Employee
15 days ago
2
2022RossNew Member
asked in Cloud Firewall

Block internet access on servers

Try to deploy netskope on a server to block internet access  with an exception of  windows updates. I’ve been directed to the Cloud Explicit Proxy documentation but it seems like an overkill to what im trying to achieve.Anyone implemented this ?​​​​​​

0
2
16 days ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Private Access for ZTNA

Netskope Private Access: "Life of a Packet"

Introduction Netskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Ne

8
J
23 days ago
B
barrycuda72New Member
asked in CASB

Microsoft Company Portal on Windows will not sync.

If Netskope client is enabled, I cannot sync the company portal app (Microsoft Intune). it just fails.  Disable NS client and it works just fine.  All the default pinned apps for Microsoft Intune is enabled and assigned to the steering config my client is assigned.  Packet Capture shows that it is still trying to use the NS cert which I thought would be by-passed by the certificate exception.

6
S
Netskope Employee
23 days ago
Y
yunsNew Member
asked in Security Posture Management

Establish an access control system(s) : IAM Policies with Effect as Allow and Action with sts:AssumeRole for CrossAccountArn

hello,in reagrds to this CSPM findings “Establish an access control system(s) : IAM Policies with Effect as Allow and Action with sts:AssumeRole for CrossAccountArn”which is being flag for AWSControlTowerExecution, based on some research i have dont the issue is bc this roles have an excessive permissions, however this are default roles created by controltower, hence how can we work this finding out to remediate ? or is this a false positive as im being advice bc control tower has a principal in it limits who can use the role.however I wanted to bring it to the community to see if some has a better understanding of this and can help me understand if it is in fact  a FP or how can this be remediated effectible? 

0
Y
24 days ago
Quan
Netskope Partner
QuanNetskope Partner
asked in Cloud Firewall

Can borderless WAN hardware be purchased locally in china?

Is there any local distributor/partner in china mainland? Can customers in china place the local order to these distributor/partners (if available) for Netskope services? 

0
Quan
Netskope Partner
26 days ago
mazam
Netskope Partner
mazamNetskope Partner
asked in Next Gen SWG

How to block Microsoft copilot by going through bimng.com

Please share any solution to block copilot by going to bing.com and clicking copilot. Adding copilot.microsoft.com/ to custom block list does not work, Blocking AI category does not work. No application event or page event indicating any other specific URL that can be added to custom category.

3
jforrest
Netskope Employee
29 days ago
M
munster
asked in Next Gen SWG

Group Sequence of Event

HiHow do you group to view the sequence of event for web access?Eg, Access to website, aaa.com which redirect to okta.com and redirect to bbb.com, etc ……If you can image it will be like “Wireshark Follow TCP Stream”.  I can view go thru each event but is inefficient and can missed out detail.  thx

1
jforrest
Netskope Employee
29 days ago
A
AlfaBaneExplorer III
asked in Next Gen SWG

HTTP Header Guidance

We’ve yet to implement any HTTP Header elements and policies but have a use case where I believe this is the best solution. However, I wanted to get some guidance.Use Case: Dept wants a specific account (ex. - staff1@email.com) to only be able to access 3 sites (I’ll use examples):  newssite1.com newssite2.com one.teamspace.com All other sites are to be blocked completelyWe tested this by:building out URL List + Custom Category for the above list of URL’s creating a RTP policy to allow the sites via Custom Category for staff1@email.com creating a RTP policy to block remaining categories for staff1@email.com placing this well below the allow policy With the nature of news sites, though, everything feeding the content for the site (content servers, ads, other domains, etc) were blocked and unusable. Since “browse” for the rest of the web needs to be blocked, RBI wasn’t an applicable solution. I’ve since set the “block” policy to “alert” to glean more information on the web categories

1
jforrest
Netskope Employee
29 days ago
J
jweaverNew Member
posted in Next Gen SWG

Referrer Allow Rule Not Working

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.co created a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit allow. I h

3
jforrest
Netskope Employee
29 days ago
Edison_VaLbuena
Netskope Partner
Edison_VaLbuenaNetskope Partner
asked in Next Gen SWG

Rename groups in postman

Hello,An integration was carried out between Netskope and Postman version 11.1.25, groups and users are already synchronized, but it does not allow the names to be modified once they are created. You are trying the following json: POST /groups/{groupId}/rename { "name": "New group name" } When the change is made it does not throw any error, on the contrary it sends 200 OK. Thank you

1
ejang
Netskope Employee
29 days ago
O
osintphNew Member
asked in Netskope Cloud Exchange (CE)

Netskope to Syslog vs Storage Bucket

First of all, sorry if that sounds like a stupid question, but i did try to find a straight forward way online, and, all points to certain configurations via Cloud Exchange Plugins.Here is my szenario, it actually is fairly simple.I need to integrate a customers Netskope Environment (and no, I have no other details at this point as this is still exploratory) to a SIEM, the SIEM is not one of the big names. In most other cases, we have done Integrations either via an API that is available, via Storage Buckets, or, usually the most straight forward, via simple Syslog.Given this, aside from this link:  - are there other ways for Syslog integration? I found this one somewhere but i do not think this is still or ever was applicable? 2.1.1    Log in to the Netskope Admin Console:•    Open your web browser and navigate to the Netskope Admin Console.•    Enter your credentials to log in.2.1.2    Navigate to Settings:•    Once logged in, go to the Settings menu, usually found on the left sideba

0
O
1 month ago

Badge winners

Show all badges
Terms & ConditionsCookie settings