Product Forums

Seeking some assistance with API Data Protection Policies.Looking to leverage ‘User Profiles' so that API policies will only trigger on a subset of users. From what I can see, user profiles only allows importing the full user identity. Is there a way to set up domain wildcards so that it trigger for all users of a domain e.g. *@domain.com? Note: Currently using Classic API data protection policies for M365.Is this something that will be addressed with the Nextgen API? 

As per title. Wondering why Adobe products have been included in the AI usage report. Adobe CC is categorised as “Web Design” and Adobe document cloud is “Business Process Management”.

Hi NetskoperI will like to allow Reddit for “BROWSE and DOWNLOAD” and not worry about URL updated when change.In SWG, I can use Application=Reddit, but there was no “BROWSE” If I will to use custom Category, I can see “BROWSE and DOWNLOAD” but I have to keep monitoring if the URL has change. I like to know what is the difference between Category vs Application? When should I use them effectively?thank

we are planning to migrate existing proxy solution of an organization from  McAfee to Netskopeif any one have any prerequisite please suggest  

Hi all,I would like to see the stats of our policies. I have a widget of Real-time Protection Policy Hits showing the top policies but as i will deploy shortly CFW, i want to check if a policy is used or not.How can i get the stats for each policies i have (report in NAA, other) ?ps: when i click on “View all active policies” it redirects me to a blank page https://mytenantforexample.goskope.com/ns#/inspectionThank

IntroductionNetskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Netskope Publisher on the ri

hello,in reagrds to this CSPM findings “Establish an access control system(s) : IAM Policies with Effect as Allow and Action with sts:AssumeRole for CrossAccountArn”which is being flag for AWSControlTowerExecution, based on some research i have dont the issue is bc this roles have an excessive permissions, however this are default roles created by controltower, hence how can we work this finding out to remediate ? or is this a false positive as im being advice bc control tower has a principal in it limits who can use the role.however I wanted to bring it to the community to see if some has a better understanding of this and can help me understand if it is in fact  a FP or how can this be remediated effectible? 

Is there any local distributor/partner in china mainland? Can customers in china place the local order to these distributor/partners (if available) for Netskope services? 

Please share any solution to block copilot by going to bing.com and clicking copilot. Adding copilot.microsoft.com/ to custom block list does not work, Blocking AI category does not work. No application event or page event indicating any other specific URL that can be added to custom category.

HiHow do you group to view the sequence of event for web access?Eg, Access to website, aaa.com which redirect to okta.com and redirect to bbb.com, etc ……If you can image it will be like “Wireshark Follow TCP Stream”.  I can view go thru each event but is inefficient and can missed out detail.  thx

We’ve yet to implement any HTTP Header elements and policies but have a use case where I believe this is the best solution. However, I wanted to get some guidance.Use Case: Dept wants a specific account (ex. - staff1@email.com) to only be able to access 3 sites (I’ll use examples):  newssite1.com newssite2.com one.teamspace.com All other sites are to be blocked completelyWe tested this by:building out URL List + Custom Category for the above list of URL’s creating a RTP policy to allow the sites via Custom Category for staff1@email.com creating a RTP policy to block remaining categories for staff1@email.com placing this well below the allow policy With the nature of news sites, though, everything feeding the content for the site (content servers, ads, other domains, etc) were blocked and unusable. Since “browse” for the rest of the web needs to be blocked, RBI wasn’t an applicable solution. I’ve since set the “block” policy to “alert” to glean more information on the web categories

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.co created a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit allow. I h

Hello,An integration was carried out between Netskope and Postman version 11.1.25, groups and users are already synchronized, but it does not allow the names to be modified once they are created. You are trying the following json: POST /groups/{groupId}/rename { "name": "New group name" } When the change is made it does not throw any error, on the contrary it sends 200 OK. Thank you

First of all, sorry if that sounds like a stupid question, but i did try to find a straight forward way online, and, all points to certain configurations via Cloud Exchange Plugins.Here is my szenario, it actually is fairly simple.I need to integrate a customers Netskope Environment (and no, I have no other details at this point as this is still exploratory) to a SIEM, the SIEM is not one of the big names. In most other cases, we have done Integrations either via an API that is available, via Storage Buckets, or, usually the most straight forward, via simple Syslog.Given this, aside from this link:  - are there other ways for Syslog integration? I found this one somewhere but i do not think this is still or ever was applicable? 2.1.1    Log in to the Netskope Admin Console:•    Open your web browser and navigate to the Netskope Admin Console.•    Enter your credentials to log in.2.1.2    Navigate to Settings:•    Once logged in, go to the Settings menu, usually found on the left sideba

Can we set policy like before sending the sensitive data across the other domain get a approval notification to manager , and if manager approves it then user can share the data?? 

I was reading the support articles for migrating to NextGen connectors for Google Drive and OneDrive and notice some features we currently use will no longer be supported (e.g. Disable Print & Download, Sharing Content to More than X External Collaborator, REST API Support, etc). Can you tell me why, or is coming at a later date? Thx

Hello people!I am having problems with netskope when synchronizing One Drive, and it takes a long time.And it only syncs if you manually stop the sync and re-activate it.Do you have any idea what could be happening?Best regards

We are really excited to introduce the next phase of the Wiz and Netskope app instance integration.  OverviewThe risk of unauthorized data movement is very real and something we see security administrators often having to deal with - this includes the need to identify what’s going on, understand where data is moving to, and ultimately implement policies to limit this data movement and this is where instance controls can be very effective, giving administrators immense control over what to allow and what to ‘inspect’(for data loss prevention policies) and what to outright block.  Netskope’s industry leading Secure Access Services Edge (SASE)  offering provides not only control of access to your SaaS and IaaS apps and environments, but this control extends to “instances” of these apps and environments. What does this mean? Netskope not only has the ability to identify and control(block uploads, downloads etc.) the usage of AWS S3(say), you can also implement these controls to be specific

Hello,We have installed Netskope client and encountering intermittent connections/service not starting properly once a machine booted up. This is happening for multiple users few weeks after deploying Netskope.Did anyone encounter the same issue? I am searching any related documentation/forums but I think I overlooked it. Thank you.

Could we manage browser extensions (including installation and execution) using NGSWG for MS edge and firefox?  

An issue I have encountered with WhatsApp QR code scanning on my device when the Netskope client is enabled. The problem seems to be consistent and reproducible under the following circumstances:When attempting to scan the WhatsApp Web QR code using the mobile app, the camera opens but fails to recognize or scan the QR code. I am able to log into one WhatsApp account by scanning the QR code, but when attempting to log into another WhatsApp account on the same device using a different QR code, the scan fails, and I am unable to complete the login process. This issue occurs only when the Netskope client is active. Disabling the Netskope client allows both the QR code to be scanned without any problems.Given the critical role that both Netskope and WhatsApp play in our daily operations, this issue is impacting productivity.I would appreciate any assistance or guidance you can provide to resolve this matter. If you need any additional information or would like me to perform further diagnos

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

I am reviewing and I notice that when I use the WhatsApp app and attach an image it is not sent, I do not have associated blocking policies and additionally create a real-time policy where permission is granted to upload and download files.If I enter through a browser, if it allows me to attach all the images, I wanted to check whether netskope restricts the sending of attachments through the App?

To set up a GRE tunnel between Netskope and a FortiGate firewall and create a second static route with the same distance but lower priority, follow these steps:1. Create the GRE Tunnel in Netskope:  - Navigate to Settings > Security Cloud Platform > GRE.  - Click New GRE Configuration.  - Enter the required details and save the configuration.  - Copy the GRE Gateway IP addresses of the two closest Netskope POPs.2. Configure the GRE Tunnel in FortiGate:  - Use the following CLI commands:   shell     config system gre tunnel         edit "GRE NETSKOPE"             set interface "port1"             set remote gw <Netskope POP IP>             set local gw <Local IP>         next     end     3. Configure the GRE Interface:  - CLI commands:   shell     config system interface         edit "GRE NETSKOPE"             set ip 192.168.254.1 255.255.255.255             set allowaccess ping             set interface "port1"         next     end     4. Create the Static Routes:  -

A user has shared a Google Drive with me and an external partner. In Google Admin it shows as Active and I am a manager. The external partner has access, but I do not see it in API-Enabled Protection → Google Drive → Teams, or when I try to create a new DLP policy and choose subset of Team Drives. It is configured identically to the other shared drives in the list. What could be preventing it from being visible? It meets all the criteria outlined in the config guide…https://docs.netskope.com/en/netskope-help/data-security/api-data-protection/api-data-protection-for-google-drive/configure-google-drive-for-api-data-protection/#google-team-shared-drive-support