Product Forums

I want to be able to route an internal app through NPA, but also be able to apply DLP policies to it. An example would be to present an authorized employee with a user consent notification popup at login. Or a DLP policy to prevent PHI from being posted, etc. Could this be done by creating both a Private App and a Cloud App using the same domain name?

Can anyone help me in understanding the below error logs and what could be the issue here.Thank you in advance! User's Netskope client is in disabled state. 2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error NSCom2.cpp:863 NSCOM2 bind failed on sever socket 100132023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:2147 nsAgentSvc Token not found in the client name2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:1225 nsAgentSvc Failed to get session details on NSCom error

Hi team, is there a way I can query a specific publisher’s publisher ID using Rest API? I am looking to automate the creation of private apps with designated publishers. It looks like publisher ID is required when creating private apps with assigned publishers. Thanks in advance! 

Team,I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Shouldn’t the NPA website URL use the local gateway address for egress traffic? It appears the NPA traffic is using the SWG tunnel.  Thanks. 

Hello Skope community!I hope everyone is doing well.I would like to tell you that I have related IDP configuration with AzureAD for the install via IDP, using reverse proxy for NPA access over Web-browser, among other experiences with Netskope in labs, POC, production environments, among others.Now I have to configure Reverse Proxy for the following environment.-Control access to office 365 suite (Sharepoint, Onedrive, Outlook, etc.)- IDP Azure-AD / Entra ID.Environment with users with Netskope agent, with steering profiles forwarding all office 365 (SSL Exception Pining Apps O365) to Netskope.Environment with users with Netskope agent, with steering profiles with bypass of office 365.What is sought with the use of Reverse Proxy, control access, upload, download, authentication, etc. to Office 365, of unmanaged computers.I have already been in the process of analyzing and reviewing Links to document and be able to read, analyze and acquire information for the configuration.https://docs

At the moment, our client they are using their in-house IdP for SAML auth.For connecting other solution through SAML, they require same information as forward proxy described: ACS URL Entity ID (service metadata)But we failed to find SAML Proxy IdP URL and SAML Proxy ACS URL.Does anyone know if IdP URL here is equal to entity ID? All the best,Allen

when I modify a policy or configuration change it takes a long time to apply the changes and I have to force the client to apply them (deactivating and activating) does anyone know another way to apply them automatically?   attached client screenshot after adding an exception in Security Cloud Platform > Traffic Steering

I currently have DLP policies that monitor and control users interacting with the Google Gemini app/website. They now want to enable the Gemini feature in Google Workspace, which would then use the embedded feature in Google Meets, Google Docs, etc. Is there a way to monitor this additional traffic with Netskope? FYI, I already have the CASB API connector for Google Workspace, but its limited to Gdrive and Gmail..

Is it possible to create a dashboard representing what actions an analyst has taken on a DLP “file” incident?The analyst can “Change File Permissions” with a dropdown of actions and/or “Contact Users”.Our analysts don’t assign the incidents or resolve them they just take actions since we use a separate case management system.  I’d like to report on actions taken and the incidents/files that were associated to the action.

Greetings,We’ve been excited about enabling the prelogon tunnel feature for NPA for some time now, but have been hesitant to do so without properly securing access by machines via the certificate method outlined in the following article: https://docs.netskope.com/en/windows-autopilot-with-private-access-prelogon/Per this article’s “Generate and Distribute Machine Certificates” section, “This section covers an optional but highly recommended set of steps required for machine certificates generation, signing, distribution and enforcement, which improves security and reduces risks associated with unauthorized access over a prelogon tunnel.”It strikes me that the best practice for prelogon enablement would be coupled with Netskope verifying machine certificates as part of its device classification; I went through the steps of setting up the certificate template in our environment, in addition to configuring the Intune Certificate Connector. However, not long after a third-party assessment/

HI Netskope TeamI was setting up autopilot and NPA, and came across this kb Windows Autopilot with Private Access Prelogon - Netskope Knowledge PortalIn the KB “User Accounts Enrollment and Provisioning with Netskope”, there was linked to https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/netskope-administrator-console-provisioning-tutorial where it reference DIrectory Tool→ SCIM Integration.  However, this info was already EOL. What is the correct steps for “User Accounts Enrollment and Provisioning with Netskope”? thankmunster    

HiI have a RTP with Source=User.  I input  user email aaa@xxx.com which was from AD via SCIM.When the aaa@xxx.com resigned, will the email be auto remove from the RTP? thank

Hi We have observed a significant increase in Fallback Action alerts, and are currently investigating ways to address this issue. These alerts primarily seem to be related to Microsoft updates. Advanced File Scanning has been disabled, yet we are still seeing Fallback Action alerts.As part of our troubleshooting, we have attempted to create steering bypass and allowed traffic related to Windows updates, but these steps have not resolved the issue.Any suggestions or further insight into addressing this would be greatly appreciated. 

I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Should the NPA web URL use the local gateway address for egress traffic?

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

When we first evaluated Netskope, visibility into non-org accounts within the Outlook desktop application was a known gap due to the application being certificate pinned. I recall that other vendors we evaluated were able to enforce DLP controls on other Outlook accounts, but these vendors often excelled in Endpoint DLP and leveraged more “legacy” approaches as opposed to Netskope’s reliance on the forward proxy.We currently block non-org accounts in the Outlook desktop app, but the allowance of client accounts within Outlook is a frequent request from our team users. With Netskope’s newer ventures into the Endpoint DLP space, are there any new or future-anticipated abilities to enforce DLP controls over these Outlook accounts/other certificate-pinned applications? 

In preparation for NPA for Android and iOS, we’re facing challenges. we only want to allow/steer the allowed Private Apps in terms of Android and iOS we want the client for reauthentication purposes users leveraging this will be authenticating with the same AD User Names and AD User Groups as they would on their work computers (MS Surface devices) as the bulk of these are personal devices approved/secured for work access, we cannot and do not want to steer, inspect, log any traffic other than Private Apps​@sshiflett ​@smonk 

Have Netskope configured with Microsoft Entra and SKIM provisioning.  I deploy the client via intune.I want some 3rd party users to use Netskope to access some onprem applications.We create them an account in entra bob@acme.com since they don't need email they don't specify an email address.I can manually install the client but it fails when trying to register.  Any thoughts? I don't want to waste a full office 365 license just to provide an email address.  I can put bob@hiscompany.com as an email address but that doesn't work. Does the email need to match the upn? 

If a customer environment only have an AD on-premises for their users, and want to set a MFA whenever their users try to access a private app, can it be configured somehow, or MFA integration witj Netskope is only supported on cloud IdP environments?

We checked and found Local Broker is not officially supported for use in deployments within China and the Kingdom of Saudi Arabia (KSA) yet.https://docs.netskope.com/en/local-broker-management/As planning to implement local brokers for internal access regulation in China afterwards, it will be nice to clarify on how licensing on NewEdge China will be affected in advanced.For the moment, we only focus on remote users, but will using local brokers in China region include all users at office, even though their traffic doesn’t really go through NewEdge China DC? 

HalloWhen adding a new Web Access rtp policy the presence of User Alert action depends on the Categories added in the destination.It sems that not all predefined Categories permits User Alert and so User Coaching popups.For example MIscellaneous allows User Alert , but Sports doesn’t.Is there a way or a doc to know in advance which Categories allow User Alert and which not ?best regards 

Does anyone know of a script that makes the process below easier? 😀 I’d like to automate the process as much as possible. Thanks.  

Hi All,While my team integrated Netskope with our SIEM, they struggled with understanding the properties and their usage. I’ve found out that Netskope Creating a tabular format view of all Alert and Event properties has been a game-changer for me and the community, especially for SIEM admins and IR analysts who are constantly looking at logs. By organizing the properties in a clear and structured manner, I can quickly identify key information, track changes, and make informed decisions. This approach not only improves efficiency but also ensures that important details are not overlooked.The impact of such a table is profound. It allows me to have a comprehensive overview of alerts and events, making it easier to spot patterns and correlations that might otherwise go unnoticed. This can lead to quicker response times and more effective problem-solving. Additionally, having all properties laid out in a tabular format aids in better communication among team members, as everyone has access

This use case is about Generative AI, but I've run into this issue with other categories as well.  I create a Generative AI block and then I'm adding exceptions as needed by the business. The issue is that I have to create a URL list for those applications that do not show in "CloudApp" options. (ie. Grammarly).  What I don't understand is why is the app not available? I get that Netskope can't distinguish between activities within the app, but when I look at the Alerts and logs it's clearly categoring the URL to the application. I'm now forced to create a rather large URL list to allow Gram

Hi Team,I have a query regarding one of our customers who is currently using an existing DNS SEC setup for both outbound and inbound traffic. Customer already have NGSWG procured. Their current traffic flow is as follows:[Roaming user] USER Endpoint >>> Active Directory DC >>> DNS Forwarder >>> DNS SEC CLOUD.For Internal their is a differ IP configured for them to resolve but need to connect with Citrix VPN.They want to understand how the traffic flow works with Netskope DNS SEC, which differs as it intercepts DNS queries for inspection.Here’s the scenario: When a user queries a domain, the request first goes to the Netskope cloud for Deep Packet Inspection (DPI). If the domain is malicious, it gets blocked; otherwise, it is allowed and forwarded through the Secure Web Gateway (SWG).My question is: If the user’s machine is configured with the DNS IP of the Active Directory (AD), does Netskope return the allowed traffic back to the client machine and then forw