Product Forums

RBI or Remote Browser Isolation is a technology that allow users to open websites on a disposable container and only get the pixels from it, like a VDI, preventing any threats from the website to ever touch the user browser. Since this technology makes use of disposable browser containers for rendering sites, it consequently makes the browsing session not only safe but also anonymous.  Normally, RBI is configured to isolate high risk categories like ‘uncategorized’ and ‘Proxy/Anonymizers’ but what if you have a website that you really want to open in isolation, regardless of what category it belongs to? This is what this article is about.  To make this work, we will be setting up a policy that activates RBI when a special header is injected into the request and then setup a browser to inject it. You can toggle this special header on/off whenever you want and expand your use-cases for RBI and consequently its value to your organization.  Follow the steps below to configure your Netskope

Is there a away to only allow alerts and incidents to be generated on medium severity and above? We have too many alerts being generated on low severity matches.   

In the ever-evolving landscape of distributed computing, isolated security tool silos are no longer adequate.The combination of increasingly sophisticated cyberattacks and the shift of assets to a hybrid multi-cloud environment constitutes a significant challenge.Security and Risk Management (SRM) leaders seek to maximize the value of their current investments through the integration of security tools into a cohesive, scalable cybersecurity ecosystem.These leaders aim to enhance operational efficiency, alleviate the workload on their teams, and improve responsiveness to both security threats and business needs and opportunities.Netskope Cloud Exchange (CE) enables a collaborative ecosystem of tools and controls to secure a modern, distributed enterprise. It builds on a strategy of integrating composable, distributed security tools to achieve more effective collaboration between tools.Outcomes include enhanced capabilities like:Granular visibility into security events alerts and transac

Hi team, We have created the Patient Zero threat protection policy in my environment, before enabling rule to wider group like to do testing that rule. could you guide me if anyway to do test in Realtime?

 How can I create an exclusion for DLP Realtime policies for a single user/group to exclude a specific Domain for a Specific DLP policy?  Use case is, A user 1/Group 1 to exclude from a Single DLP policy (PCI DLP Policy) to an abc[.]com.But, if any other users/Groups try to upload PCI data we need detection. And, when the same user 1/Group 1 tries to upload PHI Data then we need detection on abc[.]com. Thanks in advance.   

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

HiI have an internal application accessible by PublisherA and PublisherB which are deployed in different location.If PublisherA failed to access the internal application while PublisherB was able accessible, does my client will still try to connect to PublisherA?thank

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

Hi All,How would Netskope detect if lets say a compromised machines is uploading malware in the payload towards the server or lets say ho their stack is detection Remote File Inclusion, Remote Code Execution ,Cross-Site Scripting ,SQL Injection etc for NPA connection.

Hello Team, Good Day.I'm curious to know the setps or methods for integrating Sentinelone EDR and Netskope DLP solution for the Data analysis part.As a part of my study on Endpoint Security, I feel DLP also play a major role in protection of Data at Endpoints as same as EDR. Seeking guidance here for the integration.Thank you for the help. Regards & Thanks,

Copilot with commercial data protection To help business and educational organizations protect corporate data, Copilot adds commercial data protection when eligible users sign in with their work or school accounts (Entra ID).Commercial data protection means user and organizational data are protected, prompts and responses are not saved, Microsoft has no eyes-on access, and chat data isn't used to train the underlying large language models. Unlike Copilot for Microsoft 365, Copilot has no access to organizational data in the Microsoft 365 Graph.Commercial data protection applies to users with eligible work or school accounts wherever Copilot is available. (https://learn.microsoft.com/en-us/copilot/overview#-with-commercial-data-protection) ___________________________________________________________________________________________________One way to prevent the use of Copilot without commercial data protection is to update the DNS configuration by setting the DNS entry for www.bing.com to

Hi Community Team, The feature flag "encryptClientConfig" is a part of client hardening and is disabled by default. When this feature flag is enabled, it will encrypt Netskope folder files in client systems (both windows and macbook).Example: Netskope adds nscacert.pem cert in "/Library/Application Support/Netksope/STAgent/data/" at the time of NS-client installation. When above feature flag is enabled, the file will be encrypted and will show as "nscacert.pem.enc". (Other files will be .enc too).This encrypt feature breaks the CLI-Tools with Netskope SSL Interception. So, following KB instructions will not work. https://docs.netskope.com/en/netskope-help/data-security/netskope-secure-web-gateway/configuring-cli-based-tools-and-development-frameworks-to-work-with-netskope-ssl-interception/ I am reaching out to community to find a workaround for above instructions when "encryptClientConfig" is enbabled. Thanks & Regards,Indu

In cloud security, staying ahead of potential threats is crucial. As organizations continue to embrace cloud technologies, ensuring robust security measures becomes increasingly complex. To address this challenge, Netskope is proud to announce an exciting new integration, empowering users to proactively safeguard their resources across hyperscaler environments like never before.Introducing the Integration of Wiz Webhooks with Netskope APINetskope, a leader in cloud security, has partnered with Wiz, a renowned cloud security platform, to introduce seamless integration of Wiz webhooks with the Netskope API. This collaboration enables customers to leverage real-time insights from Wiz's comprehensive cloud security platform directly within Netskope.Proactive Policy Enforcement for Hyperscaler ResourcesOne of the key highlights of this integration is the ability to create dynamic policy changes in Netskope based on vulnerabilities detected by Wiz for your AWS, Azure, and GCP resources. By h

Hello,How to restrict any type of file transfer between corporate Laptop and Personal Laptopfor example, i have corporate laptop installed Netskope and i have personal laptop both are connected in home Wi-Fi , how to restrict any file type transfer between the devices. Kindly suggest a solution on this.

We are using Exception through Entities  in our rule but it keeps on detecting ssid and ssan keyword while other keywords not. Why ssid is detecting if it is part of url ? how we can exclude url from detection below is the sample url https://www.sharonheightscc.com/default.aspx?p=DynamicModule&PageId=395579&ssid=318084&vnf=1

Hi. I recently came had a problem related to configuration. it had to do with making a change in the user notifcation. This was a global change. I changed a setting from browser to client which had a strange effect on our org. Normally when you make a change you generally have to “save” then click “apply” in this case you only click “save” for it to take effect. My question is why do changes not requiring “Apply” don’t show up in the audit logs?My second question is what change logs don’t show in the Audit log?   

42% of SaaS users report consistently poor performance. 39% of these aren’t detected by traditional monitoring tools.Netskope ran a global survey this community and it was clear that troubleshooting SaaS issues and optimizing performance is incredibly difficult for several reasons:SaaS leverages highly distributed cloud hosting, where what looks like a single web page really relies on dozens of micro-services and integration with third party apps and services. The shift to hybrid working introduces BYOD, home WiFi and internet issues accessing SaaS apps, while users are also highly distributed as they fluidly move from home to office. SSE / SASE and Zero Trust approaches that address this new distributed user and security perimeter are themselves SaaS / cloud apps. Their impact on user experience and latency can’t be accurately measured by traditional monitoring tools that see these inline services as a ‘grey cloud’—much like a VPN or SD-WAN tunnel—making it nearly impossible to unders

Dear Netskope community, at the level of Malware/Malsites, there is something similar to the incident part, where the analyst can deal with the case opened by Q-Radar, like to sign the incident and classify it,  what do you do with these events or better what should I do? Another question, is it interesting to insert the hashes of Block events in IOCs lists, I ask it because the rule action is already a Block, I understand that inserting the hash already blocked in an IOC list is something redundant, right or wrong? I fully understand the possibilities of integration of Netskope Exchange with Service-Now, Siem Q-radar etc, but my question is more focused on operational procedure, the problem we find here is as to what action to take in the face of dozens of alerts forwarded to Service-now via Q-radar, and at each Malware event the Soc people keep registering hash in IoC list and it's like wiping ice,  there are dozens of events, we have this implemented for a Tenant with more than 9k u

Hello, I’ve created a data dictionary containing false positive terms (D0). The given expressions does not seem to be working - P0 AND (NOT D0)P0 AND (NOT(P0 AND D0)) Predefined Identifiers(P0) - Full Names (International)Dictionary Identifiers(D0) - DLP-Exclude-Full NamesI’d like to detect all the terms which are IN P0 and NOT IN D0.  Could anyone suggest an alternative, please ? Thanks ! 

Dear community,I am working with SWG and DLP to avoid users uploading sensitive content on corporate Onedrive.All the client has netskope client enabled and everybody run win10.I successfully managed to avoid users to upload on Onedrive via web a sensitive files, due to match with DLP policy, but the same user, while using Onedrive app just receives a warning.Basically, when the user upload the PII file is warned by the netskope client and it is also blocked,  when the same file is copy/pasted in the shared onedrive folder, it is only warned, but the action has success.Is that a limitation or are there some configuration part which I am missing?the client configuration is steering everything and the exception part is by default. Thanks.Walter

Hi For the threat protection scanning,1) What is the scan policy setting?2) How do I show what are the file being scanned? thank

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

agent installationI want to install the agent on several machines that I cannot reach either by invitation or through GPO.Is there a way to give an installer to the support staff and they go machine by machine to install the netskope agent and then the end users enter and authenticate with their user? If, for example, I download from this route https://download-<;your-tenant-name>.goskope.com/dlr/win/get and the support staff installs it correctly?