Product Forums

Hey Community,I need to create a new client configuration for a Netskope client that disable the auto update for the on-prem device and the Netskope client in Citrix environment needs to be on for the same device. How could i do or fix this problem?

how to enable two-way communication through ztna

Hey everyone!   Check out our new demo video to learn why SaaS Security Posture Management (SSPM) is a key component of CASB that is providing much needed visibility and risk assessment of all the resources hidden in your SaaS environments.     This demo features: New SaaS apps. Microsoft SharePoint, MS Exchange, MS Defender, Azure AD, Google Workspace, Confluence, and Jira. We now support 14 total SaaS apps. Industry-leading security configuration monitoring. 500+ predefined rules and 12 best practice and industry compliance policies. 3rd party OAuth app security. Continuous real-time visibility and dynamic, customer-specific risk assessment of marketplace and custom 3rd party apps.   Please reach out if you have any questions or would like more information about how SSPM + CASB work together to provide you comprehensive data protection for your SaaS apps. Happy to chat anytime!   Thanks! Eliot   -- Sr. Director, Cloud Security Product Manage

HiIn some countries, gov website can only access from local country IPs.  Any IP assign outside of the country will deny access.As we are using 163.116.x.x, user resides in that country was unable to access too.  How can we remediate this use case?thank

hello community!   We are seeing a problem with Google Chrome on macOS where Chrome is not passing traffic to a private app via the Netskope Client. We are able to reach the Private app using other browsers installed on the same system without issue. We can even hit the private app using curl at the terminal and it's working fine with NPA. We have tried clearing browser cache and using incognito on Chrome with no success. Anyone have experience with this issue?

with an inline solution that is steering all traffic to the swg. Is there any controls that can be put in place of FTP(TCP 21)traffic? DLP? Malware? etc..

HiHow can I tell if URL was manually access by user or refer by link?Eg,  in a webpage, there were images downloaded from S3 storage vs user goto the S3 storage. Thank

Our experience indicates that “manage.microsoft.com” must be added to the Default Intune Certificate Pinned Application bypass entry

HiI have configured a new NPA browser access for an end customer and we cannot make it work and I don’t know what’s failing, hope any of you can help me.I have configured the reverse proxy account on Netskope tenant, as well as the Azure AD Enterprise application. On the netskope tenant I have also configured a new private application with the browser access enabled, and a real-time policy that allows the users that are also added on Azure’s Netskope application to access the private application. When we have tested the solution, by accessing the application via browser typing the “public hostname” of the private application as the URL, it is redirected to Azure to authenticate the user, and the authentication works fine.After authenticate the user, the browser is then redirected and we can see that it is finally redirected to the customer private host FQDN (which is not published on the Internet), so users can only access to the application via browser access when they are on-premise

Currently for API DLP Policies you can only exclude by Domain. What is the reason behind not being able to exclude by User address? I have had many instances whereby a contractor is hired and only has a Gmail account, which I am not willing to exclude by Domain. This is generating massive amounts of false-positives. Thoughts? 

RBI or Remote Browser Isolation is a technology that allow users to open websites on a disposable container and only get the pixels from it, like a VDI, preventing any threats from the website to ever touch the user browser. Since this technology makes use of disposable browser containers for rendering sites, it consequently makes the browsing session not only safe but also anonymous.  Normally, RBI is configured to isolate high risk categories like ‘uncategorized’ and ‘Proxy/Anonymizers’ but what if you have a website that you really want to open in isolation, regardless of what category it belongs to? This is what this article is about.  To make this work, we will be setting up a policy that activates RBI when a special header is injected into the request and then setup a browser to inject it. You can toggle this special header on/off whenever you want and expand your use-cases for RBI and consequently its value to your organization.  Follow the steps below to configure your Netskope

Is there a away to only allow alerts and incidents to be generated on medium severity and above? We have too many alerts being generated on low severity matches.   

In the ever-evolving landscape of distributed computing, isolated security tool silos are no longer adequate.The combination of increasingly sophisticated cyberattacks and the shift of assets to a hybrid multi-cloud environment constitutes a significant challenge.Security and Risk Management (SRM) leaders seek to maximize the value of their current investments through the integration of security tools into a cohesive, scalable cybersecurity ecosystem.These leaders aim to enhance operational efficiency, alleviate the workload on their teams, and improve responsiveness to both security threats and business needs and opportunities.Netskope Cloud Exchange (CE) enables a collaborative ecosystem of tools and controls to secure a modern, distributed enterprise. It builds on a strategy of integrating composable, distributed security tools to achieve more effective collaboration between tools.Outcomes include enhanced capabilities like:Granular visibility into security events alerts and transac

Hi team, We have created the Patient Zero threat protection policy in my environment, before enabling rule to wider group like to do testing that rule. could you guide me if anyway to do test in Realtime?

 How can I create an exclusion for DLP Realtime policies for a single user/group to exclude a specific Domain for a Specific DLP policy?  Use case is, A user 1/Group 1 to exclude from a Single DLP policy (PCI DLP Policy) to an abc[.]com.But, if any other users/Groups try to upload PCI data we need detection. And, when the same user 1/Group 1 tries to upload PHI Data then we need detection on abc[.]com. Thanks in advance.   

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

HiI have an internal application accessible by PublisherA and PublisherB which are deployed in different location.If PublisherA failed to access the internal application while PublisherB was able accessible, does my client will still try to connect to PublisherA?thank

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

Hi All,How would Netskope detect if lets say a compromised machines is uploading malware in the payload towards the server or lets say ho their stack is detection Remote File Inclusion, Remote Code Execution ,Cross-Site Scripting ,SQL Injection etc for NPA connection.

Hello Team, Good Day.I'm curious to know the setps or methods for integrating Sentinelone EDR and Netskope DLP solution for the Data analysis part.As a part of my study on Endpoint Security, I feel DLP also play a major role in protection of Data at Endpoints as same as EDR. Seeking guidance here for the integration.Thank you for the help. Regards & Thanks,

Copilot with commercial data protection To help business and educational organizations protect corporate data, Copilot adds commercial data protection when eligible users sign in with their work or school accounts (Entra ID).Commercial data protection means user and organizational data are protected, prompts and responses are not saved, Microsoft has no eyes-on access, and chat data isn't used to train the underlying large language models. Unlike Copilot for Microsoft 365, Copilot has no access to organizational data in the Microsoft 365 Graph.Commercial data protection applies to users with eligible work or school accounts wherever Copilot is available. (https://learn.microsoft.com/en-us/copilot/overview#-with-commercial-data-protection) ___________________________________________________________________________________________________One way to prevent the use of Copilot without commercial data protection is to update the DNS configuration by setting the DNS entry for www.bing.com to

Hi Community Team, The feature flag "encryptClientConfig" is a part of client hardening and is disabled by default. When this feature flag is enabled, it will encrypt Netskope folder files in client systems (both windows and macbook).Example: Netskope adds nscacert.pem cert in "/Library/Application Support/Netksope/STAgent/data/" at the time of NS-client installation. When above feature flag is enabled, the file will be encrypted and will show as "nscacert.pem.enc". (Other files will be .enc too).This encrypt feature breaks the CLI-Tools with Netskope SSL Interception. So, following KB instructions will not work. https://docs.netskope.com/en/netskope-help/data-security/netskope-secure-web-gateway/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception/ I am reaching out to community to find a workaround for above instructions when "encryptClientConfig" is enbabled. Thanks & Regards,Indu

In cloud security, staying ahead of potential threats is crucial. As organizations continue to embrace cloud technologies, ensuring robust security measures becomes increasingly complex. To address this challenge, Netskope is proud to announce an exciting new integration, empowering users to proactively safeguard their resources across hyperscaler environments like never before.Introducing the Integration of Wiz Webhooks with Netskope APINetskope, a leader in cloud security, has partnered with Wiz, a renowned cloud security platform, to introduce seamless integration of Wiz webhooks with the Netskope API. This collaboration enables customers to leverage real-time insights from Wiz's comprehensive cloud security platform directly within Netskope.Proactive Policy Enforcement for Hyperscaler ResourcesOne of the key highlights of this integration is the ability to create dynamic policy changes in Netskope based on vulnerabilities detected by Wiz for your AWS, Azure, and GCP resources. By h

Hello,How to restrict any type of file transfer between corporate Laptop and Personal Laptopfor example, i have corporate laptop installed Netskope and i have personal laptop both are connected in home Wi-Fi , how to restrict any file type transfer between the devices. Kindly suggest a solution on this.

We are using Exception through Entities  in our rule but it keeps on detecting ssid and ssan keyword while other keywords not. Why ssid is detecting if it is part of url ? how we can exclude url from detection below is the sample url https://www.sharonheightscc.com/default.aspx?p=DynamicModule&PageId=395579&ssid=318084&vnf=1