Product Forums

HI Netskope TeamI was setting up autopilot and NPA, and came across this kb Windows Autopilot with Private Access Prelogon - Netskope Knowledge PortalIn the KB “User Accounts Enrollment and Provisioning with Netskope”, there was linked to https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/netskope-administrator-console-provisioning-tutorial where it reference DIrectory Tool→ SCIM Integration.  However, this info was already EOL. What is the correct steps for “User Accounts Enrollment and Provisioning with Netskope”? thankmunster    

HiI have a RTP with Source=User.  I input  user email aaa@xxx.com which was from AD via SCIM.When the aaa@xxx.com resigned, will the email be auto remove from the RTP? thank

Hi We have observed a significant increase in Fallback Action alerts, and are currently investigating ways to address this issue. These alerts primarily seem to be related to Microsoft updates. Advanced File Scanning has been disabled, yet we are still seeing Fallback Action alerts.As part of our troubleshooting, we have attempted to create steering bypass and allowed traffic related to Windows updates, but these steps have not resolved the issue.Any suggestions or further insight into addressing this would be greatly appreciated. 

I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Should the NPA web URL use the local gateway address for egress traffic?

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

When we first evaluated Netskope, visibility into non-org accounts within the Outlook desktop application was a known gap due to the application being certificate pinned. I recall that other vendors we evaluated were able to enforce DLP controls on other Outlook accounts, but these vendors often excelled in Endpoint DLP and leveraged more “legacy” approaches as opposed to Netskope’s reliance on the forward proxy.We currently block non-org accounts in the Outlook desktop app, but the allowance of client accounts within Outlook is a frequent request from our team users. With Netskope’s newer ventures into the Endpoint DLP space, are there any new or future-anticipated abilities to enforce DLP controls over these Outlook accounts/other certificate-pinned applications? 

In preparation for NPA for Android and iOS, we’re facing challenges. we only want to allow/steer the allowed Private Apps in terms of Android and iOS we want the client for reauthentication purposes users leveraging this will be authenticating with the same AD User Names and AD User Groups as they would on their work computers (MS Surface devices) as the bulk of these are personal devices approved/secured for work access, we cannot and do not want to steer, inspect, log any traffic other than Private Apps​@sshiflett ​@smonk 

Have Netskope configured with Microsoft Entra and SKIM provisioning.  I deploy the client via intune.I want some 3rd party users to use Netskope to access some onprem applications.We create them an account in entra bob@acme.com since they don't need email they don't specify an email address.I can manually install the client but it fails when trying to register.  Any thoughts? I don't want to waste a full office 365 license just to provide an email address.  I can put bob@hiscompany.com as an email address but that doesn't work. Does the email need to match the upn? 

If a customer environment only have an AD on-premises for their users, and want to set a MFA whenever their users try to access a private app, can it be configured somehow, or MFA integration witj Netskope is only supported on cloud IdP environments?

We checked and found Local Broker is not officially supported for use in deployments within China and the Kingdom of Saudi Arabia (KSA) yet.https://docs.netskope.com/en/local-broker-management/As planning to implement local brokers for internal access regulation in China afterwards, it will be nice to clarify on how licensing on NewEdge China will be affected in advanced.For the moment, we only focus on remote users, but will using local brokers in China region include all users at office, even though their traffic doesn’t really go through NewEdge China DC? 

HalloWhen adding a new Web Access rtp policy the presence of User Alert action depends on the Categories added in the destination.It sems that not all predefined Categories permits User Alert and so User Coaching popups.For example MIscellaneous allows User Alert , but Sports doesn’t.Is there a way or a doc to know in advance which Categories allow User Alert and which not ?best regards 

Does anyone know of a script that makes the process below easier? 😀 I’d like to automate the process as much as possible. Thanks.  

Hi All,While my team integrated Netskope with our SIEM, they struggled with understanding the properties and their usage. I’ve found out that Netskope Creating a tabular format view of all Alert and Event properties has been a game-changer for me and the community, especially for SIEM admins and IR analysts who are constantly looking at logs. By organizing the properties in a clear and structured manner, I can quickly identify key information, track changes, and make informed decisions. This approach not only improves efficiency but also ensures that important details are not overlooked.The impact of such a table is profound. It allows me to have a comprehensive overview of alerts and events, making it easier to spot patterns and correlations that might otherwise go unnoticed. This can lead to quicker response times and more effective problem-solving. Additionally, having all properties laid out in a tabular format aids in better communication among team members, as everyone has access

This use case is about Generative AI, but I've run into this issue with other categories as well.  I create a Generative AI block and then I'm adding exceptions as needed by the business. The issue is that I have to create a URL list for those applications that do not show in "CloudApp" options. (ie. Grammarly).  What I don't understand is why is the app not available? I get that Netskope can't distinguish between activities within the app, but when I look at the Alerts and logs it's clearly categoring the URL to the application. I'm now forced to create a rather large URL list to allow Gram

Hi Team,I have a query regarding one of our customers who is currently using an existing DNS SEC setup for both outbound and inbound traffic. Customer already have NGSWG procured. Their current traffic flow is as follows:[Roaming user] USER Endpoint >>> Active Directory DC >>> DNS Forwarder >>> DNS SEC CLOUD.For Internal their is a differ IP configured for them to resolve but need to connect with Citrix VPN.They want to understand how the traffic flow works with Netskope DNS SEC, which differs as it intercepts DNS queries for inspection.Here’s the scenario: When a user queries a domain, the request first goes to the Netskope cloud for Deep Packet Inspection (DPI). If the domain is malicious, it gets blocked; otherwise, it is allowed and forwarded through the Secure Web Gateway (SWG).My question is: If the user’s machine is configured with the DNS IP of the Active Directory (AD), does Netskope return the allowed traffic back to the client machine and then forw

How can we check which category and URL list a specific URL belongs to?Rest API provides a useful method to extract this information. How to use Rest API:-Go to Settings/Tools/Rest API v2  Select API DocumentationEnsure there is a token which has:- /api/v2/nsiq/urllookupSearch or scroll down to /api/v2/nsiq/urllookupClick to try out the API Edit the text to select the URLs  you want to check for category and URL list Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your API token, and any brackets, or commas in the requested body above. The response will show the categories (pre-defined & Custom) and URL lists To verify the categories are correct, check the tenant UI If you need to modify the URL lists, check out:-https://community.netskope.com/real-time-protection-key-policies-72/how-to-automate-url-list-updates-via-api-7167 

Hi Guys,I was trying to figuring out on Windows Updates or Windows Store failing to check for updates or downloading apps. While i was moving around to check on SkopeIT logs for some clue to it and i could not see anything that shows any failure or etc may i know does SkopeIT do shows any signs of failing SSL inspection or any sort? Because the last resort that i did was to do a bypass on Windows Update’s URL then everything started to work and update can continue, i do see logs only reflecting that it is passing through properly but anything that failed before i applied the bypass is not reflected. Thanks in advance~

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

Sumo Logic has a Netskope app that can be installed and configured to use API v2 to ingest logs. I created a new token in Netskope as described in the doc. I then installed the Netskope app and created the collector in Sumo Logic. It shows healthy, but there is an error saying “ 403 - error connecting to endpoint, received 403: {“message”: You cannot consume this service”}. Any ideas whats wrong? 

Hello, New to Netskope.  I was able to find the v1 API documentation https://docs.netskope.com/en/netskope-platform-rest-apis.html as well as the v2 API documentation https://<tenant>.goskope.com/apidocs/?include_beta_routes=0 We're looking to utilize the versatility of the v2 permission based token.  I didn't see the v1 API endpoints available in the v2 API documentationexample: https://docs.netskope.com/en/manage-quarantine-files.html for v1 wasn't in the v2Is there additional documentation that I'm missing?  or is there a roadmap/timeline to when the v1 endpoints will be available in v2? Thank you for your time and insight into this. -Han Park

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

Hi,I'm working on implementing Netskope, and I need assistance with configuring an exception for Tailscale VPN. Since Tailscale operates differently from traditional VPNs, I’m facing challenges in setting it up as an exception. Has anyone successfully added Tailscale VPN as an exception in Netskope tenant?

Hi guys I need your help, I’ve created an REST API V2 token and added the relevant endpoints as described in this doc: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/after trying every combination to create a new publisher app with the Swagger UI, I get this response:{ "message": "User Portal App cannot be created.", "status": "error"}what am I doing wrong? 😤

Team,Good morning and Happy Friday.I wanted to create a separate topic from my previous question. :)I'm creating a large NPA subnet for my networking and server teams, which will need access to the same resources.Instead of having 50 different subnets that include all servers, routers, switches, etc. I created the configuration below. I will also enable the use “Use Publisher DNS” option.  Question: Should I include the wildcard hostnames of our internal domains? Below is an example.Thanks again for your input.   

Hello all,I’m looking for recommendations/examples of global default DLP policies.Currently, my organization has a default block policy at the bottom of the tenant for categories that we’ve deemed to have no business use case (weapons, security risk, etc) or to be risky for usage (cloud storage, social media, etc.).In a similar fashion, I’d like to have DLP rules at the bottom of the tenant to act on web traffic before Netskope allows it through. I’ve done some testing with just outright blocking any activities that could be used to exfil data (upload, post, send, edit, etc.) and very quickly ran into issues, and example being background traffic for the Microsoft Edge browser being classified as upload and resulting in a large number of user notifications. I’m currently working through using app tagging to exclude any standard user applications from this policy.Given that not all websites have support for DLP, I’d ultimately like the behavior to be “If the website supports DLP, check t