Product Forums

hey all,How to create device classification based on Netskope private app registry value? attached screenshot i want to monitor on these value when private app is connected value device will be managed . thanks

Crowdstrike customers, how are you doing the exclusions for MacOS listed here, https://docs.netskope.com/en/netskope-help/netskope-client/netskope-client-interoperability/antivirus-applications/exceptions-for-anti-virus-applications/Specifically, I’d be curious to see what your exclusion patterns are. For paths with spaces (i.e. /Library/Application\ Support/) are you using “/Library/Application\ Support/” or “/Library/Application Support/”. Crowdstrike documentation states we shouldn't need the \ but does that work in practice?

Hi, anyone have experience running both the Netskope Client and Digital Guardian (DG) DLPE Agent at the same time? We are using Netskope for CASB and NPA. The DG Agent will have the WIP feature enabled for web traffic visibility. Thx

I'm doing a deploy of NPA across my environment and hitting a series of snags.  The issue seems to be related to my Mac users having issues with DNS resolution or pages loading failures.  These are largely my SaaS based SSO apps but they can be anything.  We are using Duo Security for MFA but that has been added as an exception.  The problem is intermittent.  Some users experience it all the time, I only experience it periodically though it used to be all the time for me too.  All users are in the same Steering Configuration.   We are all using MacOS Ventura so this may be related to the bug from last year.  

When some users are at the office, every now and then they become unable to access private apps Chrome simply hangs.When that happens, if they disconnect and reconnect from Wi-Fi, the issue is fixed, until it breaks again after a few hours/minutes.This doesn't happen when they are working from home.

Check out the demo to get a sneak peek into the advanced capabilities launched with the Kadiska integration at the core of our Proactive DEM!  Proactive Digital Experience Management (Proactive DEM) Enterprise offers a powerful site-centric view that when combined with user monitoring, helps pinpoint the source of user experience issues—whether at a specific site, connecting to the Netskope NewEdge POP, or the ISP. This ensures full performance visibility, empowering organizations to achieve unparalleled visibility, optimize performance, and elevate user experience across their network infrastructure.  

September 10, 2024Official Launch: Proactive Digital Experience Management (P-DEM) Enterprise Proactive DEM Enterprise delivers granular telemetry and flexible monitoring with true user experience management capabilities at both the user or site level, supporting the business objectives of midmarket to large enterprises. Building upon Netskope’s DEM offerings, the newly added DEM solution uses AI/ML-driven network performance diagnostics to help reduce operational costs by providing faster time-to-resolution when troubleshooting, ensuring organizations maintain optimal performance and user satisfaction. This edition represents the culmination of the Kadiska advanced capabilities integration at the core of our Proactive DEM.  To learn more about how Proactive DEM Enterprise groundbreaking innovations are redefining network monitoring, read our blog, watch this demo, and register for our upcoming webinar below:   Unveiling New Capabilities of Proactive Digital Experience Management Ent

Hi,I have a question (or two) about netskope publisher auto update feature.Does this auto-update feature only work i.e. kicks in when there’s a new version of netskope publisher? assuming I set it to latest update on weekly basisLet’s say I’m on version 117.0 and there’s a new version 118.0. This will get updated to 118 during whatever time I configure the auto update.If there’s no new version of netskope publisher, will it still update the underlying OS/system packages?Thanks 

Hi community, We are exploring the DEM feature ad under DEM>Settings>Monitored Applications. What does this “Monitored Applications” feature do? Is there any extra costing involved after enabling this option? Does this require any different licenses? Where the data can be seen form this “proactively monitored apps”? 

How to block Upload and download whatsapp activity in Virtual desktop machines.We have already attempted to create a policy based on Cloud app, Custom app, and Category, but we are still unable to block upload/download activities on WhatsApp using the PAC file on the WVD machine.Any suggestion much appreciated.

In order to ensure the correct functioning of the Azure Virtual Desktop or Windows 365 machine when deploying the Netskope Agent on it we have to take care of some Steering Exceptions: MANDATORY: Destination Location Steering Exceptions for Azure Virtual Desktop RDGateways IPs (Remote Desktop Gateways service tags related IPs) OPTIONAL: Destination Location Steering Exceptions for Azure Virtual Desktop Monitoring IPs (Azure Monitor service tags related IPs) OPTIONAL: Application/Process (Certificate Pinned Application) Steering Exceptions for Azure Virtual Desktop agents running on the Virtual Desktop Destination Location Steering Exceptions Microsoft provides a Json file with all the Azure destinations at the address: https://www.microsoft.com/en-us/download/details.aspx?id=56519 Unfortunately though this list contains all the destinations used by the Azure infrastructure, divided by “Service Tags” (services). As we definitely don’t want to exclude all the Azure destination fr

We use Jamf to deploy the NS Client to our Mac fleet. After enabling the new secure enrollment features (Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment) and generating the access tokens, it appears we add them to our existing Jamf deployment policy. If I am reading the directions right the tokens must be renewed, and the Jamf policy updated, every 90 days by default. Is that correct? 

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

We are having an issue where user can`t access a private app via publisher and we have checked all the configuration is correct in Netskope Tenant and the same has been confirmed with Netskope Support engineering as well.However, we can telnet the same application on the same port from publishers itself.Both publishers and private applications are on the same subnet.  When we run a TCPdump on the publishers we can see SYN packet from user`s machine is reaching to the publisher, but publisher is not getting SYN-ACK packet from the private applications. There is no firewall blocking it as publishers and private apps are in the same subnet. Let me know what your thoughts on this. 

We are being asked to create documentation on identifying and addressing scenarios within our environment to recover if there are issues with Netskope.  Then we will walk through a table top recovery exercise. Scenarios we have identified:   Unable to login to console (failure of SSO)   Failure of Netskope Management plane   Failure of Netskope data plane Has anyone done something like this and if so, is there something you can share.

Has anyone been successful in making the DLP work while using preview Copilot in the Windows 11? I don’t see the traffic alerts/page events in the SkopeIT. My assumption is it is using msedgewebview2.exe websocket which means Netskope is not capable of doing MiM inspection? Thanks.

Deploy Netskope Agent with JAMFWhen you deploy with JAMF you do not have to modify the script, JAMF allows you to enter the values ​​of the variables that the script will then take automatically. Deployment PrerequisitesAdministrators must possess fair knowledge of JAMF/JSS/Casper suite. Download the JAMF scripts from the Download page in Netskope Support portal. The file contains the essential command-line executable scripts to install and configure the client. The script file is available from the Netskope support portal.  You have to download the JAMFScripts.zip and you will find the files to install and uninstall the agent.    User Configuration: Execute the downloaded script to get the configuration file. This script locates active (online) AD users and downloads user specific configuration files from the Netskope cloud to the end point. Ensure that the AD devices are accessible before executing the script. Follow the documentation and when you have completed the previous steps a

When working with queues, you can send data in the message body.  A lot of questions come up while working with the map fields in CTO queues. In the below example, I am using the Notifier plugin but this same workflow is valid with all of the CTO plugins like ServiceNow, TEAMS, SLACK and others. I am not going to review how to setup the Notifier plugin but this link goes over it - https://docs.netskope.com/en/notifier-plugin-for-ticket-orchestrator/ Be sure to setup the Business Rules also.  Once you have the Notifier plugin up and running go to Alerts to review what information is coming in. We will use the key value pair to add information to the message we will send. Let’s grabActivity, Category, Policy, Request ID, Severity, and Site.   In the Que you are going to use you can add something like this to the message.  A Netskope Alert has been created with the following information:<br><br>    Activity: $activity<br>    Category: $category<br>    Policy: $poli

I have difficulty downloading and installing apps from the InTune Company Portal app on my iPad mini, which of course has Netskope enabled.  There are error codes but they don’t point to InTune.  Looking through debug logs, I see mask.icloud.com and mask.apple-dns.net as well as cloudapp.azure.com.I have added the above values in an SSL Do Not Decrypt URL list without success.  I have also created a Network Location Profile using the IP address for the host fef.msua04.manage.microsoft.com.  I used that in a destination location steering config, (made sure I updated the local client before testing) but none of this has resolved the issue.Additionally - after adding mask.icloud.com and apps.apple.com (the latter did not stay)...I WAS able to install ONE app while at work.  Went home for more testing to prove the issue resolved - but everything thereafter failed...whether at home or back at work the next day.I’m at a loss and need some help finding a solution.  Thank you for any help.

Migrated Content

HiUser has 2 laptops.  I will want to allow 1 and block the other.How can I config it?thank

HEllo, I need help understanding the SAML configuration. Does it work with a top-to-bottom approach? I've set up a forward proxy SAML for two IDP domains (for example, abc.com and xyz.com) for Netskope client enrollment. However, when I try to enroll the Netskope client with the xyz domain, the authentication page redirects to abc.com. Upon checking bypass settings, I found that it's a global setting for all SAML configurations. I need a quick response to achieve and segregate authentication for both domains.

In our environment, Google drive is blocked as cloud app.We have allowed Google Gemini app. When user use Gemini AI and try to export to doc, it gets blocked. When I unblock Google drive, Gemini also works fine.Is there anyway we can keep blocking Google drive and allow Google Gemini with export option?From the har troubleshooting, I can see “http://client6.google.com” url is getting blocked but if I allow it, Drive also works. Please guide how can I resolve this. Thanks. 

I have had success in the past creating an App Definition for LinkedIn Messenger to allow access to LinkedIn while blocking the messenger functionality through Domain:www.linkedin.com and Path: /messaging/,/voyager/api/messaging/. Has anyone had success replicating the same control to allow access to Facebook while blocking the messenger functionality? I have also tried blocking the Post activity for the Facebook application but that only seems to work for posts on the Facebook wall and does not apply any control to Facebook Messenger. 

Hello all,This is the start of a thread about AM2 Certificate Authority Rotation as we are getting closer to August deadline.The goal of this thread is not to provide a guide of the migration. You can find plenty of great explanation in the official docs:https://docs.netskope.com/en/netskope-root-certificate-rotation-guide-1/and also in our recent webinar here: However, if you have any question, please feel free to ask questions here.Or if you don’t know who is your CSM or Sales Representative, we can help you as well in this transition.As feedback are provided, we will also put more comment here.