Product Forums

Hello,I would like to use multiple tags for private apps.What would be the syntax here?tags { tag_name = "TEST, TEST1, TEST3" } ?I would be grateful for your help.Marco

Hi, i am having an issue on mac devices. When i am away from my device for a period of time (normally an hour) i will have to re authenticate via OKTA to outlook and teams, i have worked out this is because my netskope client is somehow dropping connection and as a result im coming from my home IP address which isnt allowed on the Microsoft end. Has anyone else noticed this behaviour, i have seen a battery setting on the Mac that i think will fix it but i just wondered if this was common.

Windows onlyWe noticed that starting last week we’ve been getting reports of a lot of windows agents where NPA is disabled and the Agent Config doesn’t update. A reboot solves this. We’ve never had a single issue with Windows endpoints in years, now this. We’ve opened a ticket but curious if anyone else is seeing this.2024/03/04 10:37:09.253 stAgentUI pbb4 tbc0 error osUtils.cpp:358 nsUtil Failed to initialize COM library. Error code = 0x80010106One observation we have is that when this started (last week) there was a push from our IT team to get Windows updates applied. 

Is the option to perform local system scans (Windows, MacOS) on the roadmap? I really need the ability to identify files matching my DLP polices that reside on our users managed computers. Thx

HiIs there a difference between wireshark vs netskope packet capture when collecting trace?thank

Hi Friends, Is it possible to create a rule for internal users to detect any CPF sent through chat? Best regards

For Private Access environments in which users also have mobile (iOS & Android) access to certain Private Apps, what’s the best way to avoid flooding users with daily Periodic Reauthentication on their computers as well as their phones? Maybe a better question would be “what is the expected user experience in terms of Periodic Reauthentication” for users leveraging Private Access on both their work computers and their phones?should users be prompted to reauth on both devices?  is it just whichever device prompts first?  is the expected behavior different for iOS & Andriod? Also, if the reauth period lapses or the prompt is missed or accidentally closed on the phone and private access disables, what is the best way to instruct end-users on restoring Private Access on their phones ? On computers, reauthentication is easily done via the client menu, but I’ve been unable to find any such option on the Netskope client/app on iOS   @sshiflett 

Some of you may know that Netskope has a SCIM API which can be integrated with IDP's such as Okta, Azure AD, etc., to provision User's and Group's into a Netskope tenant.  This is a critical part of deploying Netskope since the User provisioning is a pre-requisite to deploying the Netskope client.   There are certain times that you may not want to integrate with the IDP or maybe you are transitioning from an on-prem Identity Store to a cloud based one and aren't quite ready, but you still want to test Netskope functionality.   The SCIM API can also be used to manually create users and groups and add the users into groups so that they can both be leveraged in Netskope real-time protection policies.  The guide provides a walk through on how to accomplish this task.   If you have some ideas on how to improve the guide or on any additions, please reach out to me to discuss.

I created an API Data Protection DLP policy to look for a certain file type and it is limited to a certain Team. If I create a Retroactive scan using this policy will it only scan that Team, or the entire instance?

We are reevaluating the NPA Periodic Re-authentication. Previous user experiences were lacking. However, now that we have had support enable the “reauth at log-in/reboot”, things have improved dramatically. The primary downside that is keeping us from expanding this for testing is the pop-behind nature of the reauth prompt. Many users think they “are not being prompted” when in fact they are. Is there anything that can be done to force the prompt to either remain at the forefront until addressed or give the prompt a taskbar presence like applications/browsers/alerts do. Users that lock their device at the end of the day (in their given workspace) rather than logging out/shutting down, have no idea the reauth is open behind the of their apps/browsers at the start of the day due to the pop-behind nature of this prompt. If there is no current solution, is this on the roadmap to fix? If so, when?@sshiflett @rsurya 

I am unable to access the application without a client. I have Integrated Okta for reverse proxy. Whenever I try to access the application, I am getting an error: 500 : Netskope was unable to process authentication request for tenant:<18507>. couldn't create AUTH URL: runtime error: invalid memory address or nil pointer dereference. 

It seems as if creating DLP rules/profiles will not trigger on the name but only content. Does anyone know a way to address this? For example, I would love to have a couple dictionary entities that look for certain word NEAR certain words in a file name.ExampleDictionary 1: cat, dogDictionary 2: mouse, birdD0 NEAR D1 Filename: My cat and turtle.pptx (wont alert)Filename: My dog and bird.pptx (will alert)The content of both files has none of those words. 

HiI have deployed CE 5.0.1.  When ssh to CE, I can’t seem to “sudo su root”.  Likewise, can’t sudo reboot or shutdown.Anyway to perform reboot or shutdown beside asking esxi team to do it?thank

Hi I have questions about Captive  usageNotification - Can it be customized with our own words?   Timeout 10min -  If failed to pass captive after 10min, the traffic is blocked.   How can I re-enable again captive login?  Do I close and open the browser to have the captive login?  Do I have to reboot?  etc….  Thank

Despite the shift to Zero Trust, VPNs are still essential… but at the same time work from home resulted in a permanent jump in VPN user experience issues: help desk tickets increased 4.9x since 2019. To learn more about the “why”, we’re taking a deep dive into the impact of VPNs to bring these insights to our community members.We’re running a global survey to quantify VPN usage, cost, and user impact, where participants will receive complete results within two weeks:No personal information is required to participate It takes less than three minutes to complete the surveyA global peer benchmarkParticipating will let you understand where your company stands vs. your peers re.:VPN use, performance and cost analysis Top apps consuming VPN bandwidth VoIP and remote assistance VPN dependencies VPN’s direct & indirect impact on the help desk Take the Survey  and help us illuminate this subject together. Thanks for your help! If you have any questions, please let me know.Scott

When using Netskope on a Macintosh, an error occurs saving reports with the “Classic UI” that does not occur when using the most recent UI (Screenshot attached).  Disabling Netskope gets rid of the problem. There is anecdotal reports of someone having this same problem on a Windows/Edge combination. I haven’t gathered enough data to create a Case with Netksope, so I wanted to see if anyone else has seen this phenomena. A Google search reveals two mentions of this error, but both talk about browser security.  Both talk about Cross Site Forgery tokens. Sometimes When Updating Records Browser Shows: Security Warning: Your submission token does not match session token - Support and Troubleshooting (servicenow.com) "Your submission token does not match your session... - ServiceNow Community  

Are there any Best Practices for using Netskope DLP: to gain visibility into Generative AI site Posts  & Upload activity?

My organization has two main regions (USA and India).  I currently have ADDS/DNS servers in both regions.  I have two private apps configured for ADDS.  One of them is directing traffic to the India ADDS servers using the local NPAs, the other is doing the same for USA.I have a prelogin user that has access to both private apps.I also have a DNS private app defined (*._http.domain.local, *._kkdcp.domain.local, etc) but it only uses the USA publishers.With this configuration, our USA users are working fine with very little lag on computer startup and login.  Our India users, however, are experiencing very long startup and login times.My question is, what is the proper way of configuring AD and DNS access for clients when the organization is multi-regional and you want the client to always access the closest ADDS/DNS servers?Some solutions I am considering are:Divide each region’s users into separate groups and give them only access to their local ADDS server.  This however does not solv

When a user tries to download any files from his/her BYOD using organization's email platform, the download should be blocked.?? How can we achieve  this in Netskope please provide me the steps..

Dear All   I tried to setup Netskope Email DLP with Mimecast, however it seems like the message has not successfully deliver to mimecast MTA. 1. Configured SMTP settings (Domain, Tenant ID, Next Hop FQDN which is mimecast smart host, port)2. Configured exchange flow connector to route message to Netskope smart host3. Configured real time policy with action add X header: block when sensitive data is detect4. Setup content examination definitions and policy from Mimecast when receive X header: block 5. Test sending outbound email with sensitive info on the content. Tested sending another email without any sensitive info. (Both email had failed to deliver to recipient)6. Checked on SKope IT > Alerts > noticed that Email DLP policy has triggered with email consisted of sensitive info.7. Checked on Mimecast message tracking, however did't receive any message (for both sensitive and without sensitive message) Is there any steps that I miss out? Thank

I need to modify the default DLP profile for profanity as we have a user with a last name that matches the profanity profile. I raised a helpdesk ticket to follow the steps mentioned in https://docs.netskope.com/en/netskope-help/data-security/data-loss-prevention/dlp-entity/ to copy the Entity. However, I noticed that in the later releases of Netskope, the Entity tab was renamed to "Dictionary" and is different from the old Entity. Can anyone guide me on how to copy and modify the default profanity profile?

Hello Community,My developers use the IntelliJ IDE to develop, as our environment is 100% cloud, we use NPA to access the development environments. We use spring as a framework for our applications.My error is the following for some endpoints I simply cannot connect using IntelliJ and spring. If I do a curl or telnet I can access the endpoint normally, only IntelliJ and spring can't. I have openVPN as redundancy and I don't get this error.Has anyone had a similar problem?Below is a simpler application that I can replicate the errorpackage ConnectivityTest;import org.springframework.http.ResponseEntity;import org.springframework.http.client.reactive.ClientHttpConnector;import org.springframework.http.client.reactive.ReactorClientHttpConnector;import org.springframework.web.reactive.function.client.ExchangeStrategies;import org.springframework.web.reactive.function.client.WebClient;import reactor.netty.http.client.HttpClient;public class ConnectivityTest { public static <Objerespon

Hi Everyone, Have an issue where remote NS clients have the following environment and in this order:1. IPv4 and IPv6 addresses assigned (eg. from home wifi or mobile hotspot)- The IPv6 address assigned (global internet address starts with 2001:xxx)2. NPA Tunnel is established3. Connect to corporate VPN service4. Clients are then unable to access applications via the VPN NPA applications continue to operate successfully but the NS client service appears to interfere with the VPN tunnel. Stop the NS client service and there is no issue with the VPN. Disable IPv6 and the VPN and NPA work successfully, this is not recommended by Microsoft so not really a desirable option. Have tried to configure clients to 'Prefer IPv4 over IPv6' this was looking promising but not producing reliable results. Issue still appears to randomly occur, still testing this. Anyone else experience this issue?

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as we mention in SSL BYPASS. Same sites with SSL bypass- websites (with SSL bypass) are loading every time without intermittent issues- w

P-DEM Professional is easy to activate in your Netskope tenant. Here are the top 4 use cases it can help you drive productivity for hybrid working employees, IT operations and help desk teams: Optimizing SaaS PerformanceChallenges in managing the performance of SaaS and web applications stem from their dynamic, decentralized nature. With various factors affecting user experience, from devices to internet connectivity, IT teams struggle to detect, diagnose and fix issues, impacting user productivity and IT efficiency as problems take hours to resolve. Learn how P-DEM brings proactive visibility to accelerate troubleshooting and enhance user satisfaction.Video OverviewHybrid Work ProductivityHybrid work models bring unique performance hurdles, demanding a seamless user experience across varied environments. Pinpointing and managing these issues, which span from home Wi-Fi to SaaS performance, is critical to productivity. Diagnosing the exact failure point in the device-to-app journey is