Product Forums

We tried with Iban (ALL) option but didn’t worked So Please provide an appropriate solution for this 

Disclaimer and AdvisoryThis document and the guidance contained herein are provided by Netskope for informational purposes only and are intended to assist developers and administrators in configuring third-party tools to operate with the Netskope platform. "As-Is" Information: The information, scripts, and configuration examples are provided on an "as-is" basis. While Netskope makes a reasonable effort to ensure the accuracy of this information at the time of publication, we make no warranties, express or implied, regarding its completeness, accuracy, or suitability for any particular purpose. Third-Party Systems: The software, libraries, and tools discussed in this document are not owned, controlled, or maintained by Netskope. The configuration, commands, and behavior of these third-party systems are subject to change at any time without notice by their respective owners. Netskope assumes no responsibility for errors, omissions, or outdated information related to these third-party s

I am struggling with the props.conf setup to pull web transaction logs via S3 bucket. I have set up per Stream Logs to Splunk - Netskope Knowledge Portal .This would replace my setup for using REST API v2 for transaction logs eventually.  I currently have logs going in parallel into a temp index for validation before cut over.I am using queries below to validate time stamp detection and proper data parsing. If you have this setup to your satisfaction, Can I request you to share your props.conf? Validation queries: #Check if _time matches x-cs-timestampearliest=-10mindex=nsweb_temp sourcetype="netskope:web:test"| eval payload_time = tonumber(coalesce('x-cs-timestamp','x_cs_timestamp'))| eval splunk_time  = _time| eval diff_seconds = splunk_time - payload_time| eval status = if(diff_seconds==0, "PERFECT", "OFFSET")| eval diff_abs_s = abs(diff_seconds)| eval diff_hms   = tostring(diff_abs_s, "duration")| table _time payload_time splunk_time diff_seconds diff_hms status| sort - _time| head

Hello I have NextGen API for Microsoft outlook. For 12 of my users I want to steer the outlook traffic via netskope.I know it is the pinned app and got a bypass, but is there any way to steer via Netskope

Dears, Q1 : I appreciate your confirmation and guidance of how Netskope ATP sandbox license can integrate with MS Sharepoint to analyze upload/downloaded files ?Q2 : Also if Netskope sandbox can be used for manual file submission for analysis ?Thanks in advance,

We are experiencing an issue where Cursor AI traffic stops working when routed through Netskope with SSL decryption enabled. Specifically, the Cursor agent fails to function when traffic is inspected via Netskope.For security reasons, we do not want to bypass or exclude the Cursor AI domains from inspection. We would like to understand if there is a recommended solution that allows Cursor to function properly without bypassing SSL decryption.Could you please advise on: Any best practices for handling similar AI/agent-based applications under SSL inspection As part of our troubleshooting, we attempted lowering the HTTP version to 1.0. While this has resulted in partial functionality for some users, the issue is not fully resolved and the agent remains unstable. 

With Netskope client enabled, macOS machines are failing to sync to Intune.  When I disable the client the sync works as normal.  I have all of the predefined cert pinned app exceptions for both Windows and macOS in place, and Windows machines have no issues.I found this thread in the community pages that discusses this issue on Windows, and one comment briefly discusses macOS but the thread is closed and I can’t see any of the replies so not even sure if there is more info in here I that can’t get to.  I did create and additional custom cert pinned app for macOS and included the below processes, and added ‘*’ to bypass all domains.  Nothing is working though.company portalomadmclientintunemdmagentmdmclientcompany portalmdmclientwdavdaemon_enterpriseHas anyone figured out how to get Netskope to not interfere with Company Portal on macOS?

Looking for recommendations here. We are currently trying to onboard a group of consultants and provided them a requirements document for use of Enterprise Browser. One office could not use EB due to network issues. So they are currently whitelisting the domains and ports from your list. Their question was what to replace MP with? Are there regional static MP domain names that can be used? Network Connectivity: Netskope Enterprise Browser needs access to the following domains/ports:https://nsbrowser-updates.<MP>.goskope.com: Browser updates and installer downloads. https://nsbrowser-config.<MP>.goskope.com: To retrieve tenant and user configurations.I assume if they whitelist by subnet instead, will that cover these MP domains, correct? Consolidated Whitelist CIDR Notation IP Address Range 8.36.116.0/24 8.36.116.0 - 8.36.116.255 8.39.144.0/24 8.39.144.0 - 8.39.144.255 31.186.239.0/24 31.186.239.0 - 31.186.239.255

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

Hiis it mandatory to provision on the tenant the users that will only have access to Browser Access apps? I mean, for third-party or contractors, that won’t install the Netskope Client and that only need access to browser access private apps, is needed to provision them via SCIM or manually?I have checked that having the user associated on the IdP, the user authenticates when trying to access the public URL of the BA private app, but if the user is not provisioned on the Netskope tenant, get a 401 error after authenticating even if the RTP policy allows “all users”The user only access the private app via BA after provisioning on the tenant. Is this correct? I wouldn’t like to provision all my contractors on the tenant Regards

Is anyone aware of a library of APIv2 scripts that can be shared?   Looking for scripts that can discover devices and details about them as well as automating some functions like URL list updates and such.

We see a discrepancy in file names being visible in DLP incidents. Currently we have a DLP policy to detect exfiltration of sensitive information using file converter tools. While we are getting the file information using forensics for https://www.sejda.com/, the same is not happening for ilovepdf and ilovepdf only captures “blob” as an object and does not show any information. Is this a known limitation? 

Hello Community,  we have an Netskope Elite offer for China and have difficulties to have WECOM working with Netskope. A lot of delay in the message exchange. Before going full bypass, which is a clear security problem for my company, I would like to know if someone managed to make this app compatible with Netskope.  Official doc: https://work.weixin.qq.com/h5app/wework_domain_ip/latest Thanks! Robin

In corporate environment there are scenario where endpoint machine needs to perform patching for their drivers, application, OS and sync-ing / upload files to corporate sanctioned file storage. How do we overcome the Advanced File Scanning’s DLP, File Profile and Threat Protection without editing the fall back behavior if we deem the destination or the source is sanctioned  ? I explore the options to use real time policy’s file constraints to overcome, however it seems to be not working just wish to check anyone have any idea to overcome it? Thanks in advance! 

Are only predefined Profiles are Working? If Any Regex is there Kindly Provide!

Hi all, Hoping for some advice. We have a user that is experiencing intermittent issues with Google Workspace suite. Namely, when he is using Sheets, Docs, Drive, etc, it throws up errors such as; “Trying to connect”, “Working offline”, etc. We have disabled QUIC on the users browser. Nobody else has reported this issue.We have raised this with Netskope Support but we are stuck in an endless loop of capturing HARs and Netskope logs. As it is intermittent, it is difficult to capture logs at the right time / on a call with support team.Does anyone have any additional troubleshooting advice or have experienced the same thing?

I have Slack API DLP policies generating incidents that include non-domain accounts in the “Shared With” field (e.g. mycompany, wf_bot_sd0fd333). This recently started as Agentic (AI) workflows have been created to automatically perform process functions within the app. I am currently unable to create either a Domain or Usr Profile to be used in a Exposure Exclusion because they don’t contain domains. This is creating an enormous amount of false-positive that must be triaged. Thoughts on what can be done, or whether this is something thats being worked on by Netskope? Thx

SummaryAllow administrators to configure an active/passive failover mode for publishers on a per-application basis, instead of the current active-active only model.Business justificationWe route SAP S/4HANA traffic (SAP GUI thick client) through two Private Access publishers. The SAP GUI client does not tolerate network path changes: any publisher switch immediately resets the TCP session, causing a SAP_GUI_DISCONNECT error.Hundreds of unique users experienced repeated disconnections due to publisher switching. Each Netskope "Change in Network" event triggered a PoP or publisher change, breaking the active SAP session.Current situationActive-active (current): redundancy is maintained, but publisher switching causes mass disconnections for session-sensitive applications. Single publisher (our workaround): disconnections are resolved, but redundancy is completely lost. If the publisher fails, all SAP access is down.We are forced to choose between reliability and availability.Requested fe

We have facing the issues private access re authentication issues. to resolved the issues we have restarted issues user machine. but restart option is not a solution. 

This feature is available in realtime protection. Can we make this expiration feature available in USB DLP as well so we dont need to manage removing the exemptions manually?

Hello Everyone,I have a few questions regarding External User Access to On‑Prem Exchange via Netskope Private Access or Reverse Proxy.We are using Netskope Private Access (NPA) to publish our on‑premises Exchange Server behind a Netskope Publisher. Currently, only managed devices with the Netskope Client are allowed to access OWA and Outlook, and unmanaged devices are blocked who don’t have Netskope agent Installed — this is working as expected.This behavior is working as designed and aligns with our Zero Trust access policies.We now have a requirement to allow external users to access Outlook or OWA from non-managed devices and we have not exposed our OVA to Internet.Could you please confirm the following: Can Outlook or OWA access for external users be provided using Netskope Private Access without requiring the Netskope client on the user device? is there any other supported approach  to provide external user access to an on-premises Exchange server? Thank you for your confirmatio

Hi all, I have a question, that maybe it’s already managed in other ways but I don’t know.I have many apps that use the same port, example 8080, but I need to have different application segment because of security access. Is there a way to do in a different way? For example my think is to have one or more application segment and one or more real-time policies but create a “service group” with the port number and indicate it in the police and not in the private application segment.