Product Forums

How can we check which category and URL list a specific URL belongs to?Rest API provides a useful method to extract this information. How to use Rest API:-Go to Settings/Tools/Rest API v2  Select API DocumentationEnsure there is a token which has:- /api/v2/nsiq/urllookupSearch or scroll down to /api/v2/nsiq/urllookupClick to try out the API Edit the text to select the URLs  you want to check for category and URL list Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your API token, and any brackets, or commas in the requested body above. The response will show the categories (pre-defined & Custom) and URL lists To verify the categories are correct, check the tenant UI If you need to modify the URL lists, check out:-https://community.netskope.com/real-time-protection-key-policies-72/how-to-automate-url-list-updates-via-api-7167 

Hi Guys,I was trying to figuring out on Windows Updates or Windows Store failing to check for updates or downloading apps. While i was moving around to check on SkopeIT logs for some clue to it and i could not see anything that shows any failure or etc may i know does SkopeIT do shows any signs of failing SSL inspection or any sort? Because the last resort that i did was to do a bypass on Windows Update’s URL then everything started to work and update can continue, i do see logs only reflecting that it is passing through properly but anything that failed before i applied the bypass is not reflected. Thanks in advance~

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

Sumo Logic has a Netskope app that can be installed and configured to use API v2 to ingest logs. I created a new token in Netskope as described in the doc. I then installed the Netskope app and created the collector in Sumo Logic. It shows healthy, but there is an error saying “ 403 - error connecting to endpoint, received 403: {“message”: You cannot consume this service”}. Any ideas whats wrong? 

Hello, New to Netskope.  I was able to find the v1 API documentation https://docs.netskope.com/en/netskope-platform-rest-apis.html as well as the v2 API documentation https://<tenant>.goskope.com/apidocs/?include_beta_routes=0 We're looking to utilize the versatility of the v2 permission based token.  I didn't see the v1 API endpoints available in the v2 API documentationexample: https://docs.netskope.com/en/manage-quarantine-files.html for v1 wasn't in the v2Is there additional documentation that I'm missing?  or is there a roadmap/timeline to when the v1 endpoints will be available in v2? Thank you for your time and insight into this. -Han Park

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

Hi,I'm working on implementing Netskope, and I need assistance with configuring an exception for Tailscale VPN. Since Tailscale operates differently from traditional VPNs, I’m facing challenges in setting it up as an exception. Has anyone successfully added Tailscale VPN as an exception in Netskope tenant?

Hi guys I need your help, I’ve created an REST API V2 token and added the relevant endpoints as described in this doc: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/after trying every combination to create a new publisher app with the Swagger UI, I get this response:{ "message": "User Portal App cannot be created.", "status": "error"}what am I doing wrong? 😤

Team,Good morning and Happy Friday.I wanted to create a separate topic from my previous question. :)I'm creating a large NPA subnet for my networking and server teams, which will need access to the same resources.Instead of having 50 different subnets that include all servers, routers, switches, etc. I created the configuration below. I will also enable the use “Use Publisher DNS” option.  Question: Should I include the wildcard hostnames of our internal domains? Below is an example.Thanks again for your input.   

Hello all,I’m looking for recommendations/examples of global default DLP policies.Currently, my organization has a default block policy at the bottom of the tenant for categories that we’ve deemed to have no business use case (weapons, security risk, etc) or to be risky for usage (cloud storage, social media, etc.).In a similar fashion, I’d like to have DLP rules at the bottom of the tenant to act on web traffic before Netskope allows it through. I’ve done some testing with just outright blocking any activities that could be used to exfil data (upload, post, send, edit, etc.) and very quickly ran into issues, and example being background traffic for the Microsoft Edge browser being classified as upload and resulting in a large number of user notifications. I’m currently working through using app tagging to exclude any standard user applications from this policy.Given that not all websites have support for DLP, I’d ultimately like the behavior to be “If the website supports DLP, check t

Hi all,When I try to create more than one application this option is not enabled.The browser access portal does not support more than one application? I need to publish 5-6 different apps/services through the portal. How do I accomplish that? 

Hi,I’m trying to use /api/v2/adem/deviceoslist on the REST API v2.Before adding the specific permission for the endpoint - I’m getting "You cannot consume this service".After adding it, I’m getting "Unauthorized".Both times the error code is 403.How can I use this Endpoint?Thanks

Policy:Block Upload DLP Source Code Description:In this example we will prevent sending emails (Gmail) with files that contain "source code" in their content. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Policy:User Alert Poor ReputationDescription:Example of how to create a rule to alert the end user about the use of a cloud application with poor reputationVideo:Leandro Timotio de LimaCustomer Success ManagerLinkedin

HiI’ve seen on documentation how to create a User Portal, where logged-in users can obtain a list of Browser Access (only) applications they are authorized to access and launch from the portal, but I cannot see anywhere how to select the applications that are available on this User PortalI mean, how do I choose what Private Applications can see the logged-in users on the portal? Are these applications the same for all users or the users only see the ones they are allowed to access?Thanks!

Team,Good afternoon.How can I add a clickable URL into the “User Notification” section in Netskope? I want to direct my users to go to a specific website. I would like the website URL to show in the block pop-up policy message. I did not see an option for this in the “INSERT VARIABLE” options. I think the syntax is something like <href=https://microsoft.com>See screenshotThanks. 

I can’t see a newly created Google team drive in API-Enabled Protection. It has the same configuration as the other drives that are visible in our tenant. I am also a Manager of the drive. I verified it is active in Google Admin as well. Any idea’s what could be wrong?

Hello Community,some of our clients stuck on version 114 or 117 - most updated without a problem. Has anyone encountered something similar and maybe solve it? Best regards

Hi Everyone,  Thought I would share some information about Authentication to AD and using Microsoft NPS for radius auth providing MFA when connecting to the Publishers with SSH.  This is useful instead of using the default shared account. The information I obtained to get this working was obtained from the following sources, it was quite straight forwarded and implemented without much difficulty… and I am no Linux admin. Introduction to network user authentication with SSSD | UbuntuHow to set up SSSD with Active Directory | UbuntuTroubleshooting SSSD | UbuntuAzure MFA for SSH using NPS/MFA Extension Good luck with it, hope someone else finds this helpful. 

Can CIDR blocks be scraped and pushed to a Netskope URL list using the web scraper plugin for threat exchange? I have one setup to pull from the Proofpoint Emerging Threats IP block list (https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) but it seems to only push individual IPv4 addresses and ignores anything with a CIDR. 

Team, Good morning, and Happy Friday! I had a meeting with my server admins and network engineers. I was told they must access hundreds of servers through RDP and network gear, such as routers, switches, and administration consoles. In addition, smaller subnets /24s may be created. My plan is to make administration of NPA easier, I was going to add a /16 or /8 subnet range in my NPA configuration that includes all the above devices. I wanted to know if anyone had any issues or limitations with NPA using large subnets. The extensive subnet ranges will only be used for two groups. All other teams will have one-to-one NPA configuration. Thanks again for your time and input.

If you have PAC files or WPAD deployed to user base here are recommended settings:   1. Following traffic needs to go via PAC addon-<TENANT-NAME>.goskope.com     2. Following traffic needs to go DIRECT gateway-<TENANT-NAME>.goskope.com gateway-backup-<TENANT-NAME>.goskope.com dns.google     3. Do not use Netskope consolidated IP ranges in the PAC file. If you add global range the "addon" traffic will also fall under that range.     Sample PAC file:   Here is a typical PAC file syntax. Check what's the ultimate "return" statement. The address "163.116.128.80:8080"  in this PAC file is the Netskope Explicit Proxy over Tunnel IP address.    { <snip> .. .. /* Don't proxy to access to Netskope URLs for clients     */       if (shExpMatch(host, 'gateway-<TENANT_NAME>.goskope.com'))          { return 'DIRECT'; } (repeat for

When I have installed the netskope client, my trent micro security agent gives the error Check you internet Connection and I am not able to scan. What should I configure in my netskope tenant to allow the internet connection?

We have configured a User Notification / pop-up when users receive a Block action in NPA, to advice them, that they have tried to access an application which is blocked.We also coach them to raise a ticket for this on our ServiceNow system, and ideally we would like to provide a link in the pop-up, that leads users directly to our ServiceNow instance.It says in the description:“The "User Notification" template can be customized by directly editing the HTML below. Use the insert button to insert Netskope template variables. Only simple text and links are supported.”I have already learned, that apparently variables are not an option for the NPA pop-up.How about inserting URLs into the notification?I have tried various options, but it doesn’t seem to make its way into the pop-up. --Erik 

Hello,I want to clarify if the Netskope client is required for NPA access for users who are at the office.We have deployed NPA so that we can force an external public Application traffic through a publisher to get a fixed public IP address due to public IP address whitelisting requirements.  As we have IPSec tunnels connecting the site to Netskope cloud,  do we still need to have the client installed on the users device? Do we need to have browser based access configured for this to work?For Zscaler this is not a requirement. We use Zscaler ZPA for another customer to route Guest Wifi clients to the self-registration portal. The Guest traffic goes over IPsec tunnels to the Zsclaer cloud and Zsclaer send to to a ZPA connecter. This allows the routing of Guest traffic without having to send it over the customers internal network.This set up does not seem to work in Netskope.  If application trafic is sent over the IPsec traffic Netskope, it is not sent to the Publisher. It works when the