Product Forums

hi all!   We’ve been having great difficulties with Applications that are sensitive to SSL decryption.  Namely Software developer tools.    We have perhaps 2000 software devs, that could all potentially use a different dev tool, but many do use the same of course.  The issue is, the developers are either unwilling to help work with us to get the Netskope certs included into their application cert store, or they are unable to help us due to unknown OS type knowledge.    We have been charged with doing whatever we can to avoid any individualized “one off” type protections on the dev’s individual systems, as something that could be “deployed” would be very much more desirable.   We do have tamper protection enabled, so I know we’ll have to provide the NetSkope certs to whatever solution we find.     We have a few of their packages with a solution, but it usually requires us working with the user to implement.  We also have some cert pinned apps setup, and a couple DND’s setup as well.  Of

Implementing Zero Trust is a journey, not a single destination. The Netskope Zero Trust Inline Adoption Funnel provides a structured, progressive approach to gradually implementing Netskope's powerful security capabilities. This strategy is typically broken into the following key pillars or stages, building complexity and control as you gain confidence and visibility, while clearly defining roles and supporting compliance:Successful security programs, and the adoption of advanced models like Zero Trust, fundamentally rely on the harmonious interplay of people, process, and tooling. When one or more of these critical components is missing or misaligned – whether it's a lack of skilled personnel, undefined workflows, or unoptimized technology – the efficacy of your security initiatives, and thus the successful adoption of this vital Zero Trust model, will be severely hampered. This funnel, therefore, emphasizes the comprehensive engagement required across your organization.1. Threat Pill

Hello Netskope Community, we want to use netskope on a azure virtual desktop environment which uses FSLOGIX.But sadly we don’t get it running. We configured the installation of the client in the golden image with the multisuser modecommand:tenant=igz domain=de.goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=*token*enrollencryptiontoken=*token* autoupdate=on /qnthere would be a npavdimode as well but as far as I understood this mode is only needed when all  users should use the same tunnel on the vdi.We want that the user on the vdi needs to logon to the client with his azure user, so he has his personal tunnel up with his own private app permissions. On the first logon on sessionhost A it works without any problems.If I relogon and get on sessionhost B my npa will not connecting anymore. We think that on the first logon my client genereates an encryption key to safe the client settings. And on sessionhost B this wont match anymore.we are getting the following errors in t

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hi all, Nice to meet you! I'm currently distributing Netskope clients on company computers (both Windows and Ubuntu). I have configured the Netskope clients to Google Workspace accounts.This works fine for users without a passkey (Yubikey), but if they enable one, the client doesn't complete the login process. Has anyone else experienced this issue and found a solution?Thank you.  

 Issue Description: A customer needs to selectively block videos from playing on Facebook while still allowing users to browse the Facebook platform. This requires a targeted approach to block specific Facebook video-related URLs and domains without completely blocking access to the entire Facebook platform. Environment: Netskope tenant with web filtering capabilities Resolution: 1. Create a URL list with the following entries:video.*\.fbcdn\.netwww.facebook.com/watchwww.facebook.com/videofb.watch 2. Create a custom category in Netskope to encapsulate the URL list:  - Navigate to the custom categories section in your Netskope tenant  - Create a new custom category  - Add the URL list created in step 1 to this category 3. Create a block policy or add to an existing AUP Custom Category:  - Navigate to the policies section in your Netskope tenant  - Create a new policy or edit an existing one  - Set the action to "Block"  - Apply the custom category created in step 2 as the target 4. Save

Building on our discussions about traffic steering and the powerful Netskope Client, let's explore how to unlock the true potential of your Netskope SASE platform: achieving granular visibility.Deep visibility is built upon several layers of context, each with critical dependencies. Understanding these layers is key to extracting maximum value, enabling precise policy enforcement, and contributing directly to your organization's robust security and compliance posture. User, Group, and Organizational Unit (OU) Information: Value: This foundational context is paramount for establishing Identity-Centric Zero Trust. By knowing who is accessing resources, it enables explicit trust decisions, precise role-based access controls (RBAC), and granular auditing, aligning with the "never trust, always verify" principle. Compliance Reference: Essential for meeting NIST Cybersecurity Framework (CSF) Identify Function (ID.AM) - Access Management and ISO 27001 Annex A Control A.9 (Access Contro

Good morning!Can Netskope identify executable files or even other types within compressed files (zip), for example?

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security. Simplified Certificate Management: Provides native certificate management capabilities, removing the operational challenges of maintaining in-house Public Key Infrastructure (PKI) when leveraging the Netskope certificate. Flexible

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffic. It extends Netskope's security controls, including DLP, to personal or non-corporate devices, enhancing visibility and d

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance 

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should be able to pull different Client configurations anyone know if we maybe need to redirect the configuration fi

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create SAML groups using “memberof” values from the SAML assertion response and configure policies in advance even before intercepting user traffic Friendly group name mapping: Netskope administrators can manually map SAML attribute values to user-friendly group names for simplified management and improved clarity in policy configurat

Please let me know if there is another community thread for this issue, but I could not find one when searching.When I attempt to install CE v5.1.1, I get a failure for Docker and Podman because the installer cannot recognize the versions.  However, I have confirmed that these services are installed.  Do they need to exist in a specific file path in order for the installer to see them?

Since deploying the latest golden release of the NS client (v126.0.0.2387) the Last Event field for all systems shows 55 years ago. Is this going to be fixed? 

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) allows organizations to apply Threat Protection to web traffic (ports 80 and 443) for private applications, ensuring files are scanned for malware in real-time. When using Threat Protection with NPA, note that this feature:Requires Client as the Access Method. Scans all web traffic on HTTP (80) and HTTPS (443). Applies real-time scanning to protect private app access from malware and other advanced threats.Netskope One Private Access now a

The Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration…What is the default (new/recently created tenants) for Custom App Domains?What is the value in your tenant for Custom App Domains? Curious if it is best practice and/or common to have this set to *, empty, or specific values. This question comes as the OOB Microsoft Office 365 Outlook.com contains the process below, that is used throughout additional Microsoft products (such as Teams and the Microsoft 365 Copilot app). If your Custom App Domains is set to * for the  Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration, then all traffic (regardless of the Microsoft app) will bypass Netskope inspection (including DLP policies).Process: msedgewebview2.exe

We have created a policy for USB content control with size limit 50 mb.Issue faced here is if i share file of 40 MB and another of 15 mb it get shared.Use case is we want to restrict complete data transfer over 50 mb not file size The file size limitation is enforced per file, not per session. What we are observing is the expected behavior by design. If your expectation is for Netskope to track the cumulative file size uploaded within a session , for example, a user uploads a 40 MB file at 10:00 AM and then another 15 MB file 15 seconds later, totaling over 50 MB , this functionality is currently not supported.

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Rest API V2 token provisioning workflow. Previous Method: Historically, API tokens were provisioned through the user interface by navigating to Tools -> Rest API V2. Impact of RBAC V3 Enablement: Once RBAC V3 functionality is activated on a tenant, the aforementioned Rest API V2 tok