Product Forums

This procedure aims to illustrate the implementation of a network control based on an application tag associated with an app that does not exist as Cloud App in policies but exist in CCI catalog (for example Scaleway), then used in a policy rule to allow the corresponding traffic.  Why Can’t I Select Every Catalog App Directly in Real-Time Policies?When browsing the Netskope App Catalog (CCI), you can see tens of thousands of applications with detailed risk ratings. However, when you create a Real-Time Protection (RTP) policy, you might notice that some applications appear in the Cloud App picker, while others—marked as "Discovery Only"—do not.Here is why:1. Predefined Cloud Apps ("True Cloud Apps" with Dedicated Connectors) What they are: Popular SaaS applications (like Microsoft 365, Google Workspace, Salesforce, Box, Slack). How Netskope sees them: Netskope has built a dedicated API/protocol connector specifically for each of these apps. Netskope doesn’t just see web traffic; it d

BWAN bare metal/KVM deployments can be a bit more involved than other preconfigured IaaS alternatives such as using an OVA. And so I thought, if we could just automate the first half of the setup, it would “even the playing field”. And though I don’t consider myself a master scripter by any means, I thought putting together this open-source project on GitHub might be helpful to the community. Hopefully it proves itself helpful! https://github.com/WhiteHatHero/BWAN_Bare_Metal_U22

A heads-up for anyone blocking Newly Registered Domains at the web proxy/SWG layer.We recently had a legitimate new business site we wanted to use quickly appropriately classified as a newly registered domain and therefore blocked by policy.  There is data that supports that newly registered sites could be platforms for malicious activities including phishing and is a recommended practice in general to block the site until it’s legitimacy can be established.Historically, our process was to request recategorization, allowing the Netskope to validate the site, assign the appropriate category, and remove the category “Newly Registered or Parked” category .  Internally I called this “vouching for the site”.   In effect, we were saying the site was legitimate for use despite for being new, and Netksope would confirm it wasn’t a security risk.The Netskope current approach appears to preserve the Newly Registered Domain designation even after assigning an appropriate content category. The ope

Greetings,We are pleased to announce Netskope Cloud Exchange (CE) v7.0.0 GA with the following new features and enhancements: CE Copilot AI Powered UI/UX with Guided and Conversation modes for CE Module/Plugin Configuration & Management. Holistic Posture Assessment for optimized troubleshooting. LLM Provider Support for Claude Sonnet and Opus models with UI tracking for cost & token usage. Universal/Unified Schema Phase 1 (CTE + CRE) Enriched security context through cross correlation of CTE and CRE telemetry driving: CTE sharing to NTSK destination profile, DNS profile etc., using CRE security context (users, apps, devices) CRE actions at NTSK like UCI impact, private app tag, device tagging/classification using CTE security context (malicious file hashes & URLs) Empowers NTSK, CE, 3rd party administrators to enforce zero trust security policies based on enriched CTE + CRE context. Automated CRE Entity Field Mapping CE administrators can now take advan

Hi community members, We’ve been troubleshooting this issue for the past weeks. We want to allow corporate instance of ChatGPT for all users and block the rest of non-corporate GenAI traffic. We’ve created the necessary RTP policies:Allow corporate instance ChatGPT app Block GenAI categoryWe found on MacOS (tested on Edge and Safari) sometimes the Netskope blocks and sometimes it doesn’t. Ticket has been raised but no solution yet so far. Have any of you encounter similar issue?

Hello community,We are investigating an inline DLP visibility issue using two small, synthetic TXT files uploaded through Google Drive in Microsoft Edge on Windows with Netskope Client. No real business data was used.Google Drive reported both uploads completed. However, more than 30 minutes later, we had not located corresponding Upload application events, DLP incidents, or file metadata in the searches described below.What we have confirmed:- A Google Drive Page Event spans the browser session. Its start time is earlier than the actual file submission, so widening the time range was necessary to find it. Bypass Traffic is “no”.- Transaction Events show two requests at the submission time to drivefrontend-pa.clients6.google.com/upload/v1/items:upload.- Both requests are OPTIONS, HTTP 200, classified as Browse, allowed by an existing browse policy, with SSL Bypass: No and SSL Action: Decrypt (DefaultAction).- Both show no object name and File Size 0. We understand these are preflight r

Hello Team,I would like to restrict access to Perplexity AI based on the following requirements:Block access for unauthenticated users. Allow access only to users who sign in with the company's authorized instance ID. Block access to any other instance IDs after authentication.Could you please provide guidance on configuring the necessary policies in Netskope?Thank you.

Hello Team,We are observing an issue while deploying applications through Microsoft Intune. The Netskope Client takes significantly longer to download and become available on the end-user machine compared to other applications.Once the Netskope Client is downloaded, the remaining applications are downloaded successfully.Could anyone help us understand why the Netskope Client takes longer to download during deployment via Microsoft Intune? Are there any specific configurations, prerequisites, or troubleshooting steps we should check to resolve this issue?Any suggestions or insights would be appreciated.

I am looking for best-practice advice on how to tune our inline Real-Time Protection policies to eliminate high-volume DLP false positives caused by automated tracking and analytics scripts logging standard website content. Because the script scrapes raw elements directly from the page framework, the payload packages underlying site styling code and public reference strings side-by-side. Our Predefined PII rule triggers on a standard threshold count, but a single tracking transaction easily multiplies that count and floods our incident logs because the inspection engine captures things like Raw CSS Styling Frameworks: The payload packages background font layout code from icon libraries (e.g., .fa-square-1{--fa:"\\e256"} ... .fa-birthday-cake,.fa-cake).       75\"}.fa-square-1{--fa:\"\\e256\";--fa--fa:\"\\e256\\e256\"}.fa- birthday -cake,.fa-cake,.fa-cake-candles{--fa:\"\\f1fd\";--fa--fa:\"\\f1f ...Kolodzey, Evan Hughes\",\"Publication date\":\"2026- 07-10 \",\"Name Public Directory / A

A running Netskope Client service does not necessarily mean that traffic is being steered as expected.Administrators may see the agent/services running normally while the client is not effectively steering traffic due to conditions such as:Enrollment or token issues User not included in the applicable steering configuration/group Client disabled Other user-specific enrollment or client-state issuesTo improve visibility, we are leveraging: nsdiag.exe -fwhich return the result ; Client status:: enable./disableWe collect this result through our endpoint/client management custom inventory and create a report showing the actual reported client status across managed endpoints.

Dear Netskope: Why is there always a serious miss-communication between the new release documentation and other services within Netskope? There is a new category, paste sites, which specifically lists pastebin.com, controlc.com but NO mention of sites changing categories on notify.netskope.com.  I can’t run a report on how this is going to affect my organization unless I have this information, which possibly leads people to not be able access sites 

Hi Team,We are observing inconsistent UBA alert generation in our Netskope tenant for multiple failed login attempts to Naukri.com.In one instance, an alert was generated when a user had 3 failed login attempts within approximately 15 minutes. However, in another instance, the same user had 10–20+ failed login attempts within just 6–7 minutes, but no alert was generated.We would like to understand how Netskope UEBA detects and generates alerts for repeated failed login attempts.Is there a specific threshold or detection logic for this type of activity? Could the behavior differ depending on the application, browser, desktop client, or authentication method? Is this use case covered under the UEBA Standard license? Are there any known limitations or configurations that could explain this inconsistent behavior? Has anyone encountered a similar issue or can share insights into how this detection works in Netskope?Any guidance or suggestions would be greatly appreciated.Thanks!

Hello Community,We have a client who uses Amazon Connect as their contact center solution. The agents also have Netskope agents installed. According to our monitoring system, about 3.5% of calls are considered to have Poor Audio, and we are investigating possible causes. When we checked the Netskope Steering exceptions, we currently have some steering exceptions configured, however, the one I’m concerned about is regarding the STUN (Media) UDP 3478 traffic. According to the Amazon documentation (see Set up your network to use the Connect Customer Contact Control Panel (CCP) - Amazon Connect Customer), we need the following FQDN allowed:TurnNlb-*.elb.region.amazonaws.com When we check our steering profile configuration, this is the FQDN exception is configured:*.amazonaws.comFrom what I have been told, and by what I read in the Netskope documentation for Steering Profile Exceptions, it states:“Wildcard domains (e.g., *.example.com) include the root domain and all subdomains.”However, in

Hi,I would like to block Generative AI applications. Users should not be able to submit prompts without logging in. Users should be allowed to access and use Generative AI applications only after successful authentication. However, they should be able to use any instance ID, such as Gmail, a company account, Outlook, Yahoo, etc. Could any one  help on the best way to configure this policy?

Has anyone faced any problem related to email DLP where any code can be leaked via email if it is tagged between HTML tags?

We are trying to implement DLP on our MacBooks. First of all, it is unable to protect our source code and allowing randomly on some websites. Secondly, the source code is getting leaked via email if sent between HTML tags.

Hi,I want to block PWA in web browser. What and how can I apply policies.

Hi, We have set up a block policy for people not using our chatgpt instance but for a few days now, the upload activity doesn’t report the instance name so people can’t attach files to theirs conversations.In the alerts we can see for a user the activity with the instanceID and when uploading, the application name change and there is no instance ID anymore : Is this a temporary bug or do i need to implement a workaround? RegardsEmmanuel.

Currently, when reviewing Admin Audit Logs in the Netskope tenant, events recording that an administrator disabled or altered a Netskope Client state do not indicate which specific user, endpoint, host, or tenant device was affected.The audit log captures who (the performing admin) initiated an action, but omits the target entity (the impacted user or machine). We request that Netskope enhance Admin Audit Logs to capture the target user identity (UPN/email), device name/hostname, and client ID directly in the event details and log payload.Problem & Impact Security & Compliance Gap: Lack of Accountability: Reviewers and SOC analysts cannot determine whether a client disable was an authorized support action or unauthorized administrative tampering. Audit Blindspot: Internal and external compliance audits require full attribution (Subject, Action, Target/Object). Without target details, client disablement events cannot satisfy traceability standards. Operational & T

Hi guys Actually im planning to create a DLP rule for the Blockage of PAN card data from my organisation. The File upload is getting detected while the Copy/ Paste is not getting detected, and i have added all the action like - Post, Create, etc.1.is it possible to create a general Copy/paste restriction (without any DLP Profile) to any apps or website.2.is it possible to create a Copy/paste restriction (Pan card / SSN data) to any apps or website. 

We have created a client config such that user connected to office network, their private access should be disabled. When they are outside office network, they are getting Netskope IP. But when in Office network, they are getting ISP IP. Why such behaviour in above steering config. This is the Steering config which we have created. Why it is taking ISP IP instead of Netskope IP when connected to office network.