Product Forums

As a customer facing company, we regularly receive booking-related emails from customers and partners that contain Personally Identifiable Information (PII) such as passport numbers, ID documents, and travel itineraries. To prevent external data leakage, we’ve implemented Netskope DLP to monitor outgoing emails for PII. However, we’re facing a challenge: When our employees reply to incoming emails (even without including any PII in their response), Netskope DLP still quarantines those replies. This is because it detects the original PII from the customer’s message in the reply thread. We want to understand if there’s a way to configure DLP policies so that it only quarantines emails that are originated internally and contain PII, and not block replies to incoming messages that happen to include previously received PII. Is there a solution or best practice to achieve this behavior?

Hi Netskopers, For those of you which have published Active Directory via NPA, using the following guide...Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge Portal The Windows client can then always connect to and authenticate with AD (since its always available via NPA). Due to this, Windows is always applying the less restrictive Domain Firewall Profile even when the remote device is connected to an untrusted network (home wifi, public cafe etc). Normally the more restrictive Public Firewall Profile would be applied. Is this a concern for others?Have you solved this somehow?Are there any other options other than make the Domain Profile more restrictive.

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks

This is just in reference to this thread that I found very helpful but am unable to add a comment.All microsoft delivery optimization - regex.... | CommunityJust in case people find it helpful, I found that the regex wasn’t capturing everything and had to add a few of my own.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b.*\/msdownload\/.* I found that the following examples were being blocked:70.156.87.153/c/msdownload/update/software/updt/2025/03/windows11.0-kb5054980-x64-ndp481_d8ca7b3b24823cc8480dbe3cf3355ae0ca0c311e.cab?cacheHostOrigin=2.au.download.windowsupdate.com177.128.21

It was mentioned that the setting can be configured under Settings > Manage > Multi-Factor Authentication Integration, but in my environment, the Multi-Factor Authentication Integration tab does not appear, as shown in the screenshot below.Has there been an update?Could you let me know where I can configure this?https://docs.netskope.com/en/multi-factor-authentication/ 

Hi all,Has anyone had any issues with using the Netskope proxy and Microsoft Safelinks?We currently use Microsoft safelinks to protect clicks within the Microsoft suite.It is sporadic, but if a user clicks a link within an email, (typically marketing emails) Netskope correctly blocks access due to a SSL mismatch.if we use the safelink decoder to get the actual URL,  we can get to the website without any issues.its two popular products, so i’m assuming others have this same issue, any ideas? We don’t want to bypass the SSL Host Mismatch error. thanks  

I understand that Netskope’s DLP supports multiple languages and offers high detection accuracy. Could you please share whether the keyword matching inspection is performed using external libraries, or if Netskope uses an in-house developed engine?If external libraries are being used, would it be possible for you to disclose information about them?I am particularly interested in how Netskope has addressed challenges such as multilingual support and detecting word boundaries accurately.

When creating a policy to detect email addresses, I used the following regular expression:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}However, the string "csv test" triggered a detection, even though it does not contain an "@" symbol and therefore should not match the expression above.Is there any limitation or specific behavior in how regular expressions are interpreted on the Netskope side that might explain this?

I have configured Dynamic Steering.Here are the steps I took: In the Client Config, I specified the internal web server (192.168.10.156). In Traffic Steering, I enabled the Dynamic Steering option. However, after completing the above configurations, when I check the configuration of a server located in the same network as the web server set in step 1, it shows On-premises check: Remote.Could you please advise on how to resolve this issue? Step1  Step2  It shows On-premises check: Remote 

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in

Looking for any information about how to best configure steering for private app access when DNSSEC is enabled on the on prem DNS servers, or if this is even possible.  I have verified my NPA publisher is able to query DNS and get proper RSIG response. However remote clients do not get a valid response from the domain even with the Netskope suggested Active Directory configuration from: Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge PortalAll nslookups come back as unsecured and Non-authoritative

Hi, Some customers asked about DLP support for Claude.AI and Perplexity.AI.They are on the roadmap? If so, there’s any estimate on when will it be available? Regards,Rodrigo Borges

What is the definition of "Formpost," which is one of the activity types?

ZTNA is not functioning as expected.Here is what I have done so far: Built the Publisher Registered the Private App Created an RTP policy   2.Here is the configuration of the private app I created.3.Here is the configuration of the RTP policy I created. When I performed troubleshooting for the Private App, I encountered an error.However, the publisher status is shown as "connected."What could be the possible causes? Here is the error message.  Here is the status of the publisher: it is showing as "connected". 

Verbally, Netskope indicates that installation of client on servers because the client is dependent on login for policy. I am looking for that documented.   Has anyone seen that?  

we are managing multiple Kubernetes clusters hosted on GCP and AWS. While everything works as expected on Widows, users on macOS are facing connectivity issues when interacting with these clusters using tools like kubectl. when the Netskope client is enabled, users are encountering this error “Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority”Since we are dealing with critical production workloads spread across multiple clusters. we want to avoid any manual modification of kubeconfig files. Can you suggest any possible solutions to resolve this issue.

Check how the VNC application works through Netskope. Can this application be included in Private Apps to connect via remote desktop to user machines?

Anyone concerns about Email draft can not be detected by Netskope?On App Catalog it says “Create, Edit, Post, Send” support DLP.On the Application Events, ObjectID can successfully be fetched and we also can clearly saw the activities and content through DevTools.However, DLP policy is not triggered but the action is recorded.We also created a support case on this but L3 support responded and claimed it should be related to SMTP DLP module. We are curious if anyone else has encountered this and have similar concern as we do. 

Howdy!I'd like a breakdown of how publishers make the best determination for traffic that is routed through them. I understand that you need a publisher CLOSET to the source of what you're trying to connect to (destination) however, there isn't anything that prevents me from adding ALL my publishrs to a private app. If I do this though, what happens exactly during the publisher selection? how does the traffic decide what the most efficient route is? What is the logic behind this routing? Also if there’s a “publisher” doc that I just haven't found that someone has, I’ll accept that as well :)  thanks!  

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

Note: I understand that traffic to Zoom is generally recommended to be bypassed.If I want to prohibit the use of Zoom's camera and microphone features, what kind of policy should I write?I was under the impression that writing a blocking policy in CFW would be sufficient to block usage, but the traffic does not seem to be getting blocked. Here is the configuration I applied:Under Settings > Security Cloud Platform > App Definition > Cloud & Firewall Apps, I added the following configuration.After that, I created a block policy under Real-time Protection. I expected that Zoom’s camera and microphone functionalities would be disabled as a result of the policy.However, users are still able to use those features.I would appreciate it if you could point out any mistakes or misconfigurations in my setup.

We had someone upload files to their personal Dropbox account and the DLP incident forensic information is missing the file names; its replaced by a hash only. Is this a known issue, or feature?

Hello, I have 2 tenants, 1 for QA and 1 for production. Has anyone figured out a way to switch clients from one tenant to another without having to uninstall and reinstall? especially on a MAC system?

HiIs there anyway to block python from access internet to download packages?Whether from VSC or cmdline, etc? thank 

Are there any planned integrations with Cyera for data classification label usage in DLP policies?Does anyone have experience with this product and use case?Thanks