Product Forums

We’ve yet to implement any HTTP Header elements and policies but have a use case where I believe this is the best solution. However, I wanted to get some guidance.Use Case: Dept wants a specific account (ex. - staff1@email.com) to only be able to access 3 sites (I’ll use examples):  newssite1.com newssite2.com one.teamspace.com All other sites are to be blocked completelyWe tested this by:building out URL List + Custom Category for the above list of URL’s creating a RTP policy to allow the sites via Custom Category for staff1@email.com creating a RTP policy to block remaining categories for staff1@email.com placing this well below the allow policy With the nature of news sites, though, everything feeding the content for the site (content servers, ads, other domains, etc) were blocked and unusable. Since “browse” for the rest of the web needs to be blocked, RBI wasn’t an applicable solution. I’ve since set the “block” policy to “alert” to glean more information on the web categories

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.co created a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit allow. I h

Hello,An integration was carried out between Netskope and Postman version 11.1.25, groups and users are already synchronized, but it does not allow the names to be modified once they are created. You are trying the following json: POST /groups/{groupId}/rename { "name": "New group name" } When the change is made it does not throw any error, on the contrary it sends 200 OK. Thank you

First of all, sorry if that sounds like a stupid question, but i did try to find a straight forward way online, and, all points to certain configurations via Cloud Exchange Plugins.Here is my szenario, it actually is fairly simple.I need to integrate a customers Netskope Environment (and no, I have no other details at this point as this is still exploratory) to a SIEM, the SIEM is not one of the big names. In most other cases, we have done Integrations either via an API that is available, via Storage Buckets, or, usually the most straight forward, via simple Syslog.Given this, aside from this link:  - are there other ways for Syslog integration? I found this one somewhere but i do not think this is still or ever was applicable? 2.1.1    Log in to the Netskope Admin Console:•    Open your web browser and navigate to the Netskope Admin Console.•    Enter your credentials to log in.2.1.2    Navigate to Settings:•    Once logged in, go to the Settings menu, usually found on the left sideba

Can we set policy like before sending the sensitive data across the other domain get a approval notification to manager , and if manager approves it then user can share the data?? 

I was reading the support articles for migrating to NextGen connectors for Google Drive and OneDrive and notice some features we currently use will no longer be supported (e.g. Disable Print & Download, Sharing Content to More than X External Collaborator, REST API Support, etc). Can you tell me why, or is coming at a later date? Thx

Hello people!I am having problems with netskope when synchronizing One Drive, and it takes a long time.And it only syncs if you manually stop the sync and re-activate it.Do you have any idea what could be happening?Best regards

We are really excited to introduce the next phase of the Wiz and Netskope app instance integration.  OverviewThe risk of unauthorized data movement is very real and something we see security administrators often having to deal with - this includes the need to identify what’s going on, understand where data is moving to, and ultimately implement policies to limit this data movement and this is where instance controls can be very effective, giving administrators immense control over what to allow and what to ‘inspect’(for data loss prevention policies) and what to outright block.  Netskope’s industry leading Secure Access Services Edge (SASE)  offering provides not only control of access to your SaaS and IaaS apps and environments, but this control extends to “instances” of these apps and environments. What does this mean? Netskope not only has the ability to identify and control(block uploads, downloads etc.) the usage of AWS S3(say), you can also implement these controls to be specific

Hello,We have installed Netskope client and encountering intermittent connections/service not starting properly once a machine booted up. This is happening for multiple users few weeks after deploying Netskope.Did anyone encounter the same issue? I am searching any related documentation/forums but I think I overlooked it. Thank you.

Could we manage browser extensions (including installation and execution) using NGSWG for MS edge and firefox?  

An issue I have encountered with WhatsApp QR code scanning on my device when the Netskope client is enabled. The problem seems to be consistent and reproducible under the following circumstances:When attempting to scan the WhatsApp Web QR code using the mobile app, the camera opens but fails to recognize or scan the QR code. I am able to log into one WhatsApp account by scanning the QR code, but when attempting to log into another WhatsApp account on the same device using a different QR code, the scan fails, and I am unable to complete the login process. This issue occurs only when the Netskope client is active. Disabling the Netskope client allows both the QR code to be scanned without any problems.Given the critical role that both Netskope and WhatsApp play in our daily operations, this issue is impacting productivity.I would appreciate any assistance or guidance you can provide to resolve this matter. If you need any additional information or would like me to perform further diagnos

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

I am reviewing and I notice that when I use the WhatsApp app and attach an image it is not sent, I do not have associated blocking policies and additionally create a real-time policy where permission is granted to upload and download files.If I enter through a browser, if it allows me to attach all the images, I wanted to check whether netskope restricts the sending of attachments through the App?

To set up a GRE tunnel between Netskope and a FortiGate firewall and create a second static route with the same distance but lower priority, follow these steps:1. Create the GRE Tunnel in Netskope:  - Navigate to Settings > Security Cloud Platform > GRE.  - Click New GRE Configuration.  - Enter the required details and save the configuration.  - Copy the GRE Gateway IP addresses of the two closest Netskope POPs.2. Configure the GRE Tunnel in FortiGate:  - Use the following CLI commands:   shell     config system gre tunnel         edit "GRE NETSKOPE"             set interface "port1"             set remote gw <Netskope POP IP>             set local gw <Local IP>         next     end     3. Configure the GRE Interface:  - CLI commands:   shell     config system interface         edit "GRE NETSKOPE"             set ip 192.168.254.1 255.255.255.255             set allowaccess ping             set interface "port1"         next     end     4. Create the Static Routes:  -

A user has shared a Google Drive with me and an external partner. In Google Admin it shows as Active and I am a manager. The external partner has access, but I do not see it in API-Enabled Protection → Google Drive → Teams, or when I try to create a new DLP policy and choose subset of Team Drives. It is configured identically to the other shared drives in the list. What could be preventing it from being visible? It meets all the criteria outlined in the config guide…https://docs.netskope.com/en/netskope-help/data-security/api-data-protection/api-data-protection-for-google-drive/configure-google-drive-for-api-data-protection/#google-team-shared-drive-support 

Hi Team, Can we have mapped categorization from Zscaler Palo alto Forcepoint Cloudflare Sky high to Netskope its very ease for the deployment prepective.

I am using CASB Inline/API only right now (not SWG) and we use Azure OpenAI. I wanted to know is there a reason that Azure OpenAI is not a fully supported Cloud App (in the Generative AI category) that I can steer and control by DLP policy? I would also like to see it show up with our instance as well. Thx

Hi team, I am Doing a Pov for one of my customer can you please provide me the list of harmful url where their i can test the Netskope is able to protect you from Threats Like Cross site scripting, Crypto mining, virus spyware Botnets. Please suggest me the website so i can show test to them also please dont suggest eicar and netskope security check. 

HiI have been able to configure the NPA periodic reauth and the flexible dynamic steering in my netskope settings, but I’d like to “combine” both of them and I’m not sure if that’s possible.I mean, I have configured the dynamic steering so the users Netskope Client will steer traffic to private apps only whten they are off-premise, and the client will disable for private apps when they are on-premise.I have also configured the Periodic Reauth for NPA in my client configuration settings, so it asks for reauthentication after a period of time, but I see that this Periodic Reauth asks for the reauthentication no matter if the user is on-premise or off-premise. As I want the client only to steer traffic to private apps when off-premise, I’d like also that the Periodic Reauth triggers only when the user is off-premise, and not on-premise no matter how many time has passed since last authentication.could this be done? It seems that the Periodic Reauth is a “global” setting and don’t take int

Hi Guys, Looking if someone can help me with below issue we have.We do have roughly 5-7% of  Windows devices which failed to upgrade Netskope client at some point.These are versions 105.1.0.1406, 106.1.0.1464, 107.0.0.1455, 107.1.0.1529Once trying to uninstall manually it says MSI is missing. Newer msi versions won’t work as well, any way to uninstall/upgrade it without exact MSI version of installer? Al

Greetings, I want to manage a computer without installing the Netskope client, I understand that I can install a Netskope CA certificate but I don't know if this allows me to create a policy in real time and apply it to this machine?download from the tenant Certificates option the one that says NETSKOPE ROOT CERTIFICATE and install on the machine then create a policy in real time but it does not apply, I do not see the equipment as managed within the tenant, but perhaps that is not the procedure.Could someone help me with the step by step to manage and apply real time policies through the certificate.

How we can track AI traffic if it is part of featureset of some application? Nowdays every Application is releasing AI of there own like salesforce,stripe right How we can track those usage through netskope?

Hi, my organization is having some certificate issues with VMs in VMWare and VirtualBox. I attempted to make a custom cert pinned application using the process seen in the NS client NSdebuglog files, which did not work as expected. I have been working with support for a solution but I am hoping the community has an idea on how to solve this. 

Hi I am seeing in our client logs a lot of DTLS disconnects, we’ve lowered the MTU to 1300 too!! 2024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1093 nsssl DTLS SSL_write failed, err: 336642382, syserr: 02024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1096 nsssl DTLS SSL_write failed, errStr: error:1410C14E:SSL routines:dtls1_write_app_data_bytes:dtls message too big2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 error tunnel.cpp:898 nsTunnel DTLS nsssl_write failed, err: -12024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:681 nsssl nsssl_disconnect enter2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:1140 nsssl DTLS SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1164 nsssl DTLS Exit SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1606 nsssl DTLS Closing sock 14202024/05/24 15:03:05.328 stAgentSvc p38ec td2c info nsssl.cpp:1905 nsssl on socket close for socket 14202024/05/24 15:0

Hi,New here and I would like to ask if possible and if not where there is a wish a feature option.I had some naughty users who were  disabling the Netskope client (WISHLIST can it be disabled only by inputting a password )Under client Configuration > Tamperproof, I have selected to Hide Client Icon os system tray.Now, my question is, I would like to make sure that all my users are client-enabled on their windows computers.Is there a simple way to do it? Powershell preferably.Thanks E