Product Forums

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

Is anyone aware of a library of APIv2 scripts that can be shared?   Looking for scripts that can discover devices and details about them as well as automating some functions like URL list updates and such.

Hello Community,  we have an Netskope Elite offer for China and have difficulties to have WECOM working with Netskope. A lot of delay in the message exchange. Before going full bypass, which is a clear security problem for my company, I would like to know if someone managed to make this app compatible with Netskope.  Official doc: https://work.weixin.qq.com/h5app/wework_domain_ip/latest Thanks! Robin

Hiis it mandatory to provision on the tenant the users that will only have access to Browser Access apps? I mean, for third-party or contractors, that won’t install the Netskope Client and that only need access to browser access private apps, is needed to provision them via SCIM or manually?I have checked that having the user associated on the IdP, the user authenticates when trying to access the public URL of the BA private app, but if the user is not provisioned on the Netskope tenant, get a 401 error after authenticating even if the RTP policy allows “all users”The user only access the private app via BA after provisioning on the tenant. Is this correct? I wouldn’t like to provision all my contractors on the tenant Regards

In corporate environment there are scenario where endpoint machine needs to perform patching for their drivers, application, OS and sync-ing / upload files to corporate sanctioned file storage. How do we overcome the Advanced File Scanning’s DLP, File Profile and Threat Protection without editing the fall back behavior if we deem the destination or the source is sanctioned  ? I explore the options to use real time policy’s file constraints to overcome, however it seems to be not working just wish to check anyone have any idea to overcome it? Thanks in advance! 

We are experiencing an issue where Cursor AI traffic stops working when routed through Netskope with SSL decryption enabled. Specifically, the Cursor agent fails to function when traffic is inspected via Netskope.For security reasons, we do not want to bypass or exclude the Cursor AI domains from inspection. We would like to understand if there is a recommended solution that allows Cursor to function properly without bypassing SSL decryption.Could you please advise on: Any best practices for handling similar AI/agent-based applications under SSL inspection As part of our troubleshooting, we attempted lowering the HTTP version to 1.0. While this has resulted in partial functionality for some users, the issue is not fully resolved and the agent remains unstable. 

Are only predefined Profiles are Working? If Any Regex is there Kindly Provide!

Hi all, Hoping for some advice. We have a user that is experiencing intermittent issues with Google Workspace suite. Namely, when he is using Sheets, Docs, Drive, etc, it throws up errors such as; “Trying to connect”, “Working offline”, etc. We have disabled QUIC on the users browser. Nobody else has reported this issue.We have raised this with Netskope Support but we are stuck in an endless loop of capturing HARs and Netskope logs. As it is intermittent, it is difficult to capture logs at the right time / on a call with support team.Does anyone have any additional troubleshooting advice or have experienced the same thing?

I have Slack API DLP policies generating incidents that include non-domain accounts in the “Shared With” field (e.g. mycompany, wf_bot_sd0fd333). This recently started as Agentic (AI) workflows have been created to automatically perform process functions within the app. I am currently unable to create either a Domain or Usr Profile to be used in a Exposure Exclusion because they don’t contain domains. This is creating an enormous amount of false-positive that must be triaged. Thoughts on what can be done, or whether this is something thats being worked on by Netskope? Thx

SummaryAllow administrators to configure an active/passive failover mode for publishers on a per-application basis, instead of the current active-active only model.Business justificationWe route SAP S/4HANA traffic (SAP GUI thick client) through two Private Access publishers. The SAP GUI client does not tolerate network path changes: any publisher switch immediately resets the TCP session, causing a SAP_GUI_DISCONNECT error.Hundreds of unique users experienced repeated disconnections due to publisher switching. Each Netskope "Change in Network" event triggered a PoP or publisher change, breaking the active SAP session.Current situationActive-active (current): redundancy is maintained, but publisher switching causes mass disconnections for session-sensitive applications. Single publisher (our workaround): disconnections are resolved

We have facing the issues private access re authentication issues. to resolved the issues we have restarted issues user machine. but restart option is not a solution. 

This feature is available in realtime protection. Can we make this expiration feature available in USB DLP as well so we dont need to manage removing the exemptions manually?

Hello Everyone,I have a few questions regarding External User Access to On‑Prem Exchange via Netskope Private Access or Reverse Proxy.We are using Netskope Private Access (NPA) to publish our on‑premises Exchange Server behind a Netskope Publisher. Currently, only managed devices with the Netskope Client are allowed to access OWA and Outlook, and unmanaged devices are blocked who don’t have Netskope agent Installed — this is working as expected.This behavior is working as designed and aligns with our Zero Trust access policies.We now have a requirement to allow external users to access Outlook or OWA from non-managed devices and we have not exposed our OVA to Internet.Could you please confirm the following: Can Outlook or OWA access for external users be provided using Netskope Private Access without requiri

Hi all, I have a question, that maybe it’s already managed in other ways but I don’t know.I have many apps that use the same port, example 8080, but I need to have different application segment because of security access. Is there a way to do in a different way? For example my think is to have one or more application segment and one or more real-time policies but create a “service group” with the port number and indicate it in the police and not in the private application segment.

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

Disclaimer and AdvisoryThis document and the guidance contained herein are provided by Netskope for informational purposes only and are intended to assist developers and administrators in configuring third-party tools to operate with the Netskope platform. "As-Is" Information: The information, scripts, and configuration examples are provided on an "as-is" basis. While Netskope makes a reasonable effort to ensure the accuracy of this information at the time of publication, we make no warranties, express or implied, regarding its completeness, accuracy, or suitability for any particular purpose. Third-Party Systems: The software, libraries, and tools discussed in this document are not owned, controlled, or maintained by Netskope. The configuration, commands, and behavior of these third-party systems are subject to change at any time without notice by their respective owners. Netskope assumes n

Hello Netskope Community,Managing endpoint client software across an entire organization is a critical task. A key part of this is having a clear strategy for updates and, when necessary, rollbacks. This guide outlines Netskope's recommended best practices for managing client versions to ensure stability, minimize risk, and maintain business continuity. Understanding the Netskope Client's Upgrade Behavior A common question we see is, "How do I roll back the Netskope Client?"It's important to know that the Netskope Client does not have a native, in-place "downgrade" feature. The installer is designed to prevent an older version from being installed over a newer one to maintain system and configuration integrity.The Official Rollback Procedure:If you need to revert to a previous client version, the required process is a full uninstall and reinstall, orchestrated by your endpoint management tool

Hello Everyone,I have a few questions regarding  Reverse Proxy as a Service (RaaS) configuration with Microsoft Entra ID.We have configured Reverse Proxy as a Service (RaaS) with Microsoft Entra ID by following the official Netskope documentation below:Reference Document:https://docs.netskope.com/en/reverse-proxy-as-a-service-with-microsoft-entra-id-1 Configuration Summary Created an Enterprise Application in Microsoft Entra ID for Reverse Proxy Exchanged all required URLs and certificates between Entra ID and Netskope

Thee following topic covering how to block Google AI mode has been posted )How to Block Google AI Mode? | Community ) but now with Google presenting poor quality AI responses via “AI Overview” on nearly all AI searches, we are looking for a way to block these search results without completely blocking Google Search.There is a known way to block “AI Overview” by appending “&udm=14” to the search request URI, however Netskope does not appear to have any support for inline modification of URI’s. Has anyone been able to work around this limitation or found another way (such as HTTP header insertion) to block the “AI Overview”? 

With Netskope client enabled, macOS machines are failing to sync to Intune.  When I disable the client the sync works as normal.  I have all of the predefined cert pinned app exceptions for both Windows and macOS in place, and Windows machines have no issues.I found this thread in the community pages that discusses this issue on Windows, and one comment briefly discusses macOS but the thread is closed and I can’t see any of the replies so not even sure if there is more info in here I that can’t get to.  I did create and additional custom cert pinned app for macOS and included the below processes, and added ‘*’ to bypass all domains.  Nothing is working though.company portalomadmclientintunemdmagentmdmclientcompany portalmdmclientwdavdaemon_enterpriseHas anyone figured out ho

Hi Team, Blocking login / post activity on clasue.ai portal is not working as expected. we see discovery only in the app catalog. we do not see the login traffic on Skope-IT/Application events. requesting you bring in this enhancement for claude.ai URL. more details on the case # 602972With regardsKarthikeyan N

OverviewThis guide provides step-by-step instructions for integrating OneLogin with Netskope Security Posture Management (SSPM) using the Bring Your Own App (BYOA) feature. BYOA allows you to extend SSPM's security monitoring capabilities to custom SaaS applications that are not natively supported by Netskope.BenefitsExtended Coverage: Monitor OneLogin's security posture alongside other SaaS applications Centralized Monitoring: Single pane of view for all SSPM-supported and custom apps Integrated Reporting: Unified reporting and alerting across all monitored applications Custom Rules: Create custom security rules using Netskope Governance Language (NGL)PrerequisitesNetskope tenant with BYOA feature enabled (contact Netskope support)