Product Forums

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

Does anyone have a Policy or Run book that utilizes Netskope to cut down Internet usage during a security incident such as ransomware?    I am thinking that if there was an event, I would want to start individual assests- particularly remote could and could not do.   In my mind:Prevent computers from accessing any sites that are not on a shortened approved list. Have an emergency steering config that has now Cert-Pinned Apps. Once an assets is determined to be infection free - or reimaged and having a certain identifier, use device classification to allow more sites.

If Netskope client is enabled, I cannot sync the company portal app (Microsoft Intune). it just fails.  Disable NS client and it works just fine.  All the default pinned apps for Microsoft Intune is enabled and assigned to the steering config my client is assigned.  Packet Capture shows that it is still trying to use the NS cert which I thought would be by-passed by the certificate exception.

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

Netskope IDP - APP enterprise Azure AD - Users/Groups Hello community I hope everything is going great. I would like to tell you the following, let's see if someone out there also happened to you.As always first details of the environment:Tenant with IDP Azure AD configured via enterprise APP for SAML.At the level of Assignments / Assign users and groups a group was assigned. Azure AD license level is available.My question is the following:It is correctly integrated at Forward Proxy IDP Azure AD level, it operates correctly but at the time of testing.The user XXXXXTes01@test.com.mx when validating his credentials throws the microsoft error that he does not have access.The manual assignment was made to the user in particular and it worked but this is not the expected sharing, since the user is part of the group:NestkopeTest group: XXXXXTes01@test.com.mx and assigned at the Enterprise APP level should not have asked me for that user. Same group and is synchronized by SCIM via the other E

In Netskope we can integrate CrowdStrike in two ways: one way is Integration using Cloud exchange. and another way is integrating CS under Settings> Threat Protection> CS (EDR).So, what is difference between these two ways and which one is more effective? 

Hi, How to determine the maturity of policies in our tenant. For example, we have Netskope tenant with all policies implemented, then how to check whether these policies are enough or any enhancement is required further?

What is NPA best practice when it comes to restricting access to home network ranges? Naturally we first thought of creating an RFC 1918 sinkhole app using port 10, however this would restrict access to internal apps as well. If we just carve out and allow our own internal ranges, while sink holing those ranges we don't use, we still allow users access to any home network ranges that are identified as internal. How are other people handling this?

Google Workspace - IDP Client - Google AuthenticatorHello good afternoon community, I hope you are very well.I have a question, regarding the use of MFA or a two-factor authentication for users with the following case:Users with IDP mode installed - Provisioning users to Tenant with Azure-AD . SAML Proxy for IDP - Google Worskpace.Now if a customer wants or needs that apart from the enrollment via IDP, in this case Google Workspace, reauth must be applied at Private Access level so that every so often it performs the reauth.Now thinking if the customer wants that when this reauth occurs, in addition to validate the Google Workspace credentials, use Google Authenticator, this configuration is not specific to Netskope, but in this case the Google Workspace itself? Is this correct?Thank you very much community for your time, advice and collaboration.Best regards

I have request from customer to limit file size for upload in WeChat Windows desktop up. Limit size is 25 MB. I created File profile for File Size and include all Types, but doesn’t work well, I have notification action is blocked, but file is uploaded. If someone have idea how to solve that problem, please help me.

I have a very weird requirement for a client: Can we sync users in single Netskope tenant from multiple tenant Idp. In this case, clients have on premises AD integration with Azure AD/Entra ID? Each on-prem AD here represents separate organizations If above is possible: How can we do Netskope Tenant SSO login for different Admins from different organization? How can we do CASB API as each organizations has separate O365 presence? Is it even possible to do Reverse Proxy for different applications? What are other limitations we are looking here if we go with this set up?  

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

Hi all,Is there a way to create/modify/delete Network Location with API?I already do it with csv but i did not find it with API.Thanks for your help

Seeking some assistance with API Data Protection Policies.Looking to leverage ‘User Profiles' so that API policies will only trigger on a subset of users. From what I can see, user profiles only allows importing the full user identity. Is there a way to set up domain wildcards so that it trigger for all users of a domain e.g. *@domain.com? Note: Currently using Classic API data protection policies for M365.Is this something that will be addressed with the Nextgen API? 

As per title. Wondering why Adobe products have been included in the AI usage report. Adobe CC is categorised as “Web Design” and Adobe document cloud is “Business Process Management”.

Hi NetskoperI will like to allow Reddit for “BROWSE and DOWNLOAD” and not worry about URL updated when change.In SWG, I can use Application=Reddit, but there was no “BROWSE” If I will to use custom Category, I can see “BROWSE and DOWNLOAD” but I have to keep monitoring if the URL has change. I like to know what is the difference between Category vs Application? When should I use them effectively?thank

we are planning to migrate existing proxy solution of an organization from  McAfee to Netskopeif any one have any prerequisite please suggest  

Hi all,I would like to see the stats of our policies. I have a widget of Real-time Protection Policy Hits showing the top policies but as i will deploy shortly CFW, i want to check if a policy is used or not.How can i get the stats for each policies i have (report in NAA, other) ?ps: when i click on “View all active policies” it redirects me to a blank page https://mytenantforexample.goskope.com/ns#/inspectionThank

IntroductionNetskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Netskope Publisher on the ri

hello,in reagrds to this CSPM findings “Establish an access control system(s) : IAM Policies with Effect as Allow and Action with sts:AssumeRole for CrossAccountArn”which is being flag for AWSControlTowerExecution, based on some research i have dont the issue is bc this roles have an excessive permissions, however this are default roles created by controltower, hence how can we work this finding out to remediate ? or is this a false positive as im being advice bc control tower has a principal in it limits who can use the role.however I wanted to bring it to the community to see if some has a better understanding of this and can help me understand if it is in fact  a FP or how can this be remediated effectible? 

Is there any local distributor/partner in china mainland? Can customers in china place the local order to these distributor/partners (if available) for Netskope services? 

Please share any solution to block copilot by going to bing.com and clicking copilot. Adding copilot.microsoft.com/ to custom block list does not work, Blocking AI category does not work. No application event or page event indicating any other specific URL that can be added to custom category.

HiHow do you group to view the sequence of event for web access?Eg, Access to website, aaa.com which redirect to okta.com and redirect to bbb.com, etc ……If you can image it will be like “Wireshark Follow TCP Stream”.  I can view go thru each event but is inefficient and can missed out detail.  thx