Product Forums

How to block Upload and download whatsapp activity in Virtual desktop machines.We have already attempted to create a policy based on Cloud app, Custom app, and Category, but we are still unable to block upload/download activities on WhatsApp using the PAC file on the WVD machine.Any suggestion much appreciated.

In order to ensure the correct functioning of the Azure Virtual Desktop or Windows 365 machine when deploying the Netskope Agent on it we have to take care of some Steering Exceptions: MANDATORY: Destination Location Steering Exceptions for Azure Virtual Desktop RDGateways IPs (Remote Desktop Gateways service tags related IPs) OPTIONAL: Destination Location Steering Exceptions for Azure Virtual Desktop Monitoring IPs (Azure Monitor service tags related IPs) OPTIONAL: Application/Process (Certificate Pinned Application) Steering Exceptions for Azure Virtual Desktop agents running on the Virtual Desktop Destination Location Steering Exceptions Microsoft provides a Json file with all the Azure destinations at the address: https://www.microsoft.com/en-us/download/details.aspx?id=56519 Unfortunately though this list contains all the destinations used by the Azure infrastructure, divided by “Service Tags” (services). As we definitely don’t want to exclude all the Azure destination fr

We use Jamf to deploy the NS Client to our Mac fleet. After enabling the new secure enrollment features (Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment) and generating the access tokens, it appears we add them to our existing Jamf deployment policy. If I am reading the directions right the tokens must be renewed, and the Jamf policy updated, every 90 days by default. Is that correct? 

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

We are having an issue where user can`t access a private app via publisher and we have checked all the configuration is correct in Netskope Tenant and the same has been confirmed with Netskope Support engineering as well.However, we can telnet the same application on the same port from publishers itself.Both publishers and private applications are on the same subnet.  When we run a TCPdump on the publishers we can see SYN packet from user`s machine is reaching to the publisher, but publisher is not getting SYN-ACK packet from the private applications. There is no firewall blocking it as publishers and private apps are in the same subnet. Let me know what your thoughts on this. 

We are being asked to create documentation on identifying and addressing scenarios within our environment to recover if there are issues with Netskope.  Then we will walk through a table top recovery exercise. Scenarios we have identified:   Unable to login to console (failure of SSO)   Failure of Netskope Management plane   Failure of Netskope data plane Has anyone done something like this and if so, is there something you can share.

Has anyone been successful in making the DLP work while using preview Copilot in the Windows 11? I don’t see the traffic alerts/page events in the SkopeIT. My assumption is it is using msedgewebview2.exe websocket which means Netskope is not capable of doing MiM inspection? Thanks.

Deploy Netskope Agent with JAMFWhen you deploy with JAMF you do not have to modify the script, JAMF allows you to enter the values ​​of the variables that the script will then take automatically. Deployment PrerequisitesAdministrators must possess fair knowledge of JAMF/JSS/Casper suite. Download the JAMF scripts from the Download page in Netskope Support portal. The file contains the essential command-line executable scripts to install and configure the client. The script file is available from the Netskope support portal.  You have to download the JAMFScripts.zip and you will find the files to install and uninstall the agent.    User Configuration: Execute the downloaded script to get the configuration file. This script locates active (online) AD users and downloads user specific configuration files from the Netskope cloud to the end point. Ensure that the AD devices are accessible before executing the script. Follow the documentation and when you have completed the previous steps a

When working with queues, you can send data in the message body.  A lot of questions come up while working with the map fields in CTO queues. In the below example, I am using the Notifier plugin but this same workflow is valid with all of the CTO plugins like ServiceNow, TEAMS, SLACK and others. I am not going to review how to setup the Notifier plugin but this link goes over it - https://docs.netskope.com/en/notifier-plugin-for-ticket-orchestrator/ Be sure to setup the Business Rules also.  Once you have the Notifier plugin up and running go to Alerts to review what information is coming in. We will use the key value pair to add information to the message we will send. Let’s grabActivity, Category, Policy, Request ID, Severity, and Site.   In the Que you are going to use you can add something like this to the message.  A Netskope Alert has been created with the following information:<br><br>    Activity: $activity<br>    Category: $category<br>    Policy: $poli

I have difficulty downloading and installing apps from the InTune Company Portal app on my iPad mini, which of course has Netskope enabled.  There are error codes but they don’t point to InTune.  Looking through debug logs, I see mask.icloud.com and mask.apple-dns.net as well as cloudapp.azure.com.I have added the above values in an SSL Do Not Decrypt URL list without success.  I have also created a Network Location Profile using the IP address for the host fef.msua04.manage.microsoft.com.  I used that in a destination location steering config, (made sure I updated the local client before testing) but none of this has resolved the issue.Additionally - after adding mask.icloud.com and apps.apple.com (the latter did not stay)...I WAS able to install ONE app while at work.  Went home for more testing to prove the issue resolved - but everything thereafter failed...whether at home or back at work the next day.I’m at a loss and need some help finding a solution.  Thank you for any help.

Migrated Content

HiUser has 2 laptops.  I will want to allow 1 and block the other.How can I config it?thank

HEllo, I need help understanding the SAML configuration. Does it work with a top-to-bottom approach? I've set up a forward proxy SAML for two IDP domains (for example, abc.com and xyz.com) for Netskope client enrollment. However, when I try to enroll the Netskope client with the xyz domain, the authentication page redirects to abc.com. Upon checking bypass settings, I found that it's a global setting for all SAML configurations. I need a quick response to achieve and segregate authentication for both domains.

In our environment, Google drive is blocked as cloud app.We have allowed Google Gemini app. When user use Gemini AI and try to export to doc, it gets blocked. When I unblock Google drive, Gemini also works fine.Is there anyway we can keep blocking Google drive and allow Google Gemini with export option?From the har troubleshooting, I can see “http://client6.google.com” url is getting blocked but if I allow it, Drive also works. Please guide how can I resolve this. Thanks. 

I have had success in the past creating an App Definition for LinkedIn Messenger to allow access to LinkedIn while blocking the messenger functionality through Domain:www.linkedin.com and Path: /messaging/,/voyager/api/messaging/. Has anyone had success replicating the same control to allow access to Facebook while blocking the messenger functionality? I have also tried blocking the Post activity for the Facebook application but that only seems to work for posts on the Facebook wall and does not apply any control to Facebook Messenger. 

Hello all,This is the start of a thread about AM2 Certificate Authority Rotation as we are getting closer to August deadline.The goal of this thread is not to provide a guide of the migration. You can find plenty of great explanation in the official docs:https://docs.netskope.com/en/netskope-root-certificate-rotation-guide-1/and also in our recent webinar here: However, if you have any question, please feel free to ask questions here.Or if you don’t know who is your CSM or Sales Representative, we can help you as well in this transition.As feedback are provided, we will also put more comment here.

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

Does anyone have a Policy or Run book that utilizes Netskope to cut down Internet usage during a security incident such as ransomware?    I am thinking that if there was an event, I would want to start individual assests- particularly remote could and could not do.   In my mind:Prevent computers from accessing any sites that are not on a shortened approved list. Have an emergency steering config that has now Cert-Pinned Apps. Once an assets is determined to be infection free - or reimaged and having a certain identifier, use device classification to allow more sites.

If Netskope client is enabled, I cannot sync the company portal app (Microsoft Intune). it just fails.  Disable NS client and it works just fine.  All the default pinned apps for Microsoft Intune is enabled and assigned to the steering config my client is assigned.  Packet Capture shows that it is still trying to use the NS cert which I thought would be by-passed by the certificate exception.

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

I am very excited to introduce a community-based beta plugin for Cloud Exchange. This Network Access Control (NAC) plugin is designed to enhance Cloud Exchange by integrating Netskope telemetry with enterprise networks. It effectively enforces security measures and bridges the gap between customer network locations utilizing NAC solutions and the Netskope SSE Platform. Purpose and Context:The NAC plugin enables sharing Netscope telemetry with enterprise networks, allowing appropriate enforcement actions based on detected threats or compromises. It allows to send information about managed users whether they are on the on-premise network (SDWAN or Client-Tunnel) or remote.Functionality:The plugin leverages the SSE solution to detect high threats or indicators of compromise and shares this information with the enterprise network. It facilitates actions such as VLAN changes, quarantine roles, or group tag assignments based on detected incidents.User and Device Management:The plugin targets

Netskope IDP - APP enterprise Azure AD - Users/Groups Hello community I hope everything is going great. I would like to tell you the following, let's see if someone out there also happened to you.As always first details of the environment:Tenant with IDP Azure AD configured via enterprise APP for SAML.At the level of Assignments / Assign users and groups a group was assigned. Azure AD license level is available.My question is the following:It is correctly integrated at Forward Proxy IDP Azure AD level, it operates correctly but at the time of testing.The user XXXXXTes01@test.com.mx when validating his credentials throws the microsoft error that he does not have access.The manual assignment was made to the user in particular and it worked but this is not the expected sharing, since the user is part of the group:NestkopeTest group: XXXXXTes01@test.com.mx and assigned at the Enterprise APP level should not have asked me for that user. Same group and is synchronized by SCIM via the other E

In Netskope we can integrate CrowdStrike in two ways: one way is Integration using Cloud exchange. and another way is integrating CS under Settings> Threat Protection> CS (EDR).So, what is difference between these two ways and which one is more effective? 

Hi, How to determine the maturity of policies in our tenant. For example, we have Netskope tenant with all policies implemented, then how to check whether these policies are enough or any enhancement is required further?

What is NPA best practice when it comes to restricting access to home network ranges? Naturally we first thought of creating an RFC 1918 sinkhole app using port 10, however this would restrict access to internal apps as well. If we just carve out and allow our own internal ranges, while sink holing those ranges we don't use, we still allow users access to any home network ranges that are identified as internal. How are other people handling this?