Product Forums

Disclaimer and AdvisoryThis document and the guidance contained herein are provided by Netskope for informational purposes only and are intended to assist developers and administrators in configuring third-party tools to operate with the Netskope platform. "As-Is" Information: The information, scripts, and configuration examples are provided on an "as-is" basis. While Netskope makes a reasonable effort to ensure the accuracy of this information at the time of publication, we make no warranties, express or implied, regarding its completeness, accuracy, or suitability for any particular purpose. Third-Party Systems: The software, libraries, and tools discussed in this document are not owned, controlled, or maintained by Netskope. The configuration, commands, and behavior of these third-party systems are subject to change at any time without notice by their respective owners. Netskope assumes n

Hi all, I have a question, that maybe it’s already managed in other ways but I don’t know.I have many apps that use the same port, example 8080, but I need to have different application segment because of security access. Is there a way to do in a different way? For example my think is to have one or more application segment and one or more real-time policies but create a “service group” with the port number and indicate it in the police and not in the private application segment.

Hello Netskope Community,Managing endpoint client software across an entire organization is a critical task. A key part of this is having a clear strategy for updates and, when necessary, rollbacks. This guide outlines Netskope's recommended best practices for managing client versions to ensure stability, minimize risk, and maintain business continuity. Understanding the Netskope Client's Upgrade Behavior A common question we see is, "How do I roll back the Netskope Client?"It's important to know that the Netskope Client does not have a native, in-place "downgrade" feature. The installer is designed to prevent an older version from being installed over a newer one to maintain system and configuration integrity.The Official Rollback Procedure:If you need to revert to a previous client version, the required process is a full uninstall and reinstall, orchestrated by your endpoint management tool

Hello Everyone,I have a few questions regarding External User Access to On‑Prem Exchange via Netskope Private Access or Reverse Proxy.We are using Netskope Private Access (NPA) to publish our on‑premises Exchange Server behind a Netskope Publisher. Currently, only managed devices with the Netskope Client are allowed to access OWA and Outlook, and unmanaged devices are blocked who don’t have Netskope agent Installed — this is working as expected.This behavior is working as designed and aligns with our Zero Trust access policies.We now have a requirement to allow external users to access Outlook or OWA from non-managed devices and we have not exposed our OVA to Internet.Could you please confirm the following: Can Outlook or OWA access for external users be provided using Netskope Private Access without requiri

Hello Everyone,I have a few questions regarding  Reverse Proxy as a Service (RaaS) configuration with Microsoft Entra ID.We have configured Reverse Proxy as a Service (RaaS) with Microsoft Entra ID by following the official Netskope documentation below:Reference Document:https://docs.netskope.com/en/reverse-proxy-as-a-service-with-microsoft-entra-id-1 Configuration Summary Created an Enterprise Application in Microsoft Entra ID for Reverse Proxy Exchanged all required URLs and certificates between Entra ID and Netskope

Thee following topic covering how to block Google AI mode has been posted )How to Block Google AI Mode? | Community ) but now with Google presenting poor quality AI responses via “AI Overview” on nearly all AI searches, we are looking for a way to block these search results without completely blocking Google Search.There is a known way to block “AI Overview” by appending “&udm=14” to the search request URI, however Netskope does not appear to have any support for inline modification of URI’s. Has anyone been able to work around this limitation or found another way (such as HTTP header insertion) to block the “AI Overview”? 

With Netskope client enabled, macOS machines are failing to sync to Intune.  When I disable the client the sync works as normal.  I have all of the predefined cert pinned app exceptions for both Windows and macOS in place, and Windows machines have no issues.I found this thread in the community pages that discusses this issue on Windows, and one comment briefly discusses macOS but the thread is closed and I can’t see any of the replies so not even sure if there is more info in here I that can’t get to.  I did create and additional custom cert pinned app for macOS and included the below processes, and added ‘*’ to bypass all domains.  Nothing is working though.company portalomadmclientintunemdmagentmdmclientcompany portalmdmclientwdavdaemon_enterpriseHas anyone figured out ho

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

Hi Team, Blocking login / post activity on clasue.ai portal is not working as expected. we see discovery only in the app catalog. we do not see the login traffic on Skope-IT/Application events. requesting you bring in this enhancement for claude.ai URL. more details on the case # 602972With regardsKarthikeyan N

OverviewThis guide provides step-by-step instructions for integrating OneLogin with Netskope Security Posture Management (SSPM) using the Bring Your Own App (BYOA) feature. BYOA allows you to extend SSPM's security monitoring capabilities to custom SaaS applications that are not natively supported by Netskope.BenefitsExtended Coverage: Monitor OneLogin's security posture alongside other SaaS applications Centralized Monitoring: Single pane of view for all SSPM-supported and custom apps Integrated Reporting: Unified reporting and alerting across all monitored applications Custom Rules: Create custom security rules using Netskope Governance Language (NGL)PrerequisitesNetskope tenant with BYOA feature enabled (contact Netskope support)

In the world of modern cybersecurity, speed and scale aren’t just "nice-to-haves"—they are requirements. As organizations grow, so does the volume of telemetry. If you’re a Netskope customer, you already know that our platform generates incredible insights into your data movement and threat landscape. However,the real magic happens when you can automate the response to those insights at scale.Today, I want to highlight two new incredible workflows in Tines created by my colleague, Andre Srinivasan. These stories represent the "gold standard" of how to bridge the gap between cloud security and automated response.1. Create Tines Cases for Netskope DLP Incidents (with AI!)

Netskope Cloud Exchange is cybersecurity industry’s leading technology integration platform empowering global organizations to unify their siloed security tools & optimize their ROI.We are announcing the general availability of Netskope Cloud Exchange (CE) v6.0.1 patch release with the business critical security updates described atRisk Assessment, Remediation, and Mitigation Plan for Netskope Cloud Exchange Deployments - Netskope Knowledge PortalBased on recent security market research data, 42% of cloud environments (87K potentially vulnerable instances) worldwide have at least one instance of MongoDB in a version vulnerable to CVE-2025-14847, including both publicly exposed and internal resources.We strongly recommend customers to deploy/upgrade/migra

Please tell your CSM/TAM you support IDEA-839 - local account / non-interactive supportThe IDEA has been accepted but does not have a schedule for implementation. If you are using Active Directory to establish identity on workstations, local accounts will bypass policy - allowing the computer to browse the internet without policy restriction nor SSL inspection for DLP or malicious code. If you have non-interactive devices, like servers, the only viable solution is to shift network traffic to Netskope via IPSEC. That lacks the reporting and accountability functionality, and application-level bypasses.  This IDEA seeks to have another solution possibility.

Hello CommunityHas anyone attempted yet to detect via Netskope endpoint agent traffic toward internet-facing Clawdbots AI agents exposed via unauthenticated public endpoints?thanksAndrea

While accessing any sites on incognito mode is very slow for initial time. Once the page is loaded, all the sites are loading normally on new tabs. Once we reopen the browser with incognito mode again, the same issue happening again for initial time.any suggestions?

Hello,I received the IoC list shared by my partner, but accessing it requires a username and password.However, for the Web Page IoC Scraper Plugin, credentials should not be necessary.Is there any alternative solution available?  

Anyone else seeing steering issues when it comes to Microsoft.  For general O365 traffic, getting steered.  But with Intune and some authentication traffic, its a mix of steered and non-steered (direct to Internet).  

Overview Some environments using Netskope Client may encounter SSL or certificate validation issues when running Google Cloud CLI (gcloud) commands.This happens because gcloud relies on its own embedded cacert.pem bundle (under the SDK’s certifi package), which doesn’t automatically include enterprise root certificates — such as Netskope’s Root CA. Important note about bypassing *.googleapis.com In many enterprise deployments administrators add bypass rules for *.googleapis.com (so some Google APIs are sent directly to Google). However, simply configuring core/custom_ca_certs_file with only the Netskope root certificate — or relying only on the Netskope root in a custom bundle — frequently does not resolve SSL errors for these bypassed domains.Why this happens (observe

Hi Team,Quillpad is showing unknow in CCL is it safe to allow this translation app to our users. In virus total I don't see any malicious tag to the application/website. Please check and suggest.   Regards,Zakeriya Shaikh

We've enabled the new transaction logs feature and sending it to our AWS S3.We have came across something which we wanted to point out which is the directory structure is in hours/days/month/year this is not how standard logging folders are created and is different from your old approach too. This can be an issue during manual searching or programatic querying in tools like AWS Athena. I suggest changing this to a normal directory structure to avoid these pains.

in one of our customer getting power shell attack in all users office 365 . how we can block .is it possible to block power shell access based on country using CASB or there is any other way to resolve this issue .

I am writing to inquire about the current roadmap and support for Manus AI within the Netskope NewEdge network. As Manus AI gains traction as a powerful general-purpose AI agent, our organization needs to ensure robust data protection and visibility over the sensitive information being shared with this platform.1. Current Status Inquiry: Does Netskope currently have a functional Cloud App Connector for Manus AI? Specifically, are the activities (such as "Post" or "Upload") already being indexed in the CCI (Cloud Confidence Index)?2. Development Suggestion (DLP Integration): If full support is not yet available, I would like to suggest the development of specific DLP controls for Manus AI, focusing on: Prompt Protection: Real-time inspection of text inputs to prevent the leakage of PII, PHI, or source code. File Transfer Control: Monitor