Product Forums

Google Workspace - IDP Client - Google AuthenticatorHello good afternoon community, I hope you are very well.I have a question, regarding the use of MFA or a two-factor authentication for users with the following case:Users with IDP mode installed - Provisioning users to Tenant with Azure-AD . SAML Proxy for IDP - Google Worskpace.Now if a customer wants or needs that apart from the enrollment via IDP, in this case Google Workspace, reauth must be applied at Private Access level so that every so often it performs the reauth.Now thinking if the customer wants that when this reauth occurs, in addition to validate the Google Workspace credentials, use Google Authenticator, this configuration is not specific to Netskope, but in this case the Google Workspace itself? Is this correct?Thank you very much community for your time, advice and collaboration.Best regards

I have request from customer to limit file size for upload in WeChat Windows desktop up. Limit size is 25 MB. I created File profile for File Size and include all Types, but doesn’t work well, I have notification action is blocked, but file is uploaded. If someone have idea how to solve that problem, please help me.

I have a very weird requirement for a client: Can we sync users in single Netskope tenant from multiple tenant Idp. In this case, clients have on premises AD integration with Azure AD/Entra ID? Each on-prem AD here represents separate organizations If above is possible: How can we do Netskope Tenant SSO login for different Admins from different organization? How can we do CASB API as each organizations has separate O365 presence? Is it even possible to do Reverse Proxy for different applications? What are other limitations we are looking here if we go with this set up?  

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

Hi all,Is there a way to create/modify/delete Network Location with API?I already do it with csv but i did not find it with API.Thanks for your help

Seeking some assistance with API Data Protection Policies.Looking to leverage ‘User Profiles' so that API policies will only trigger on a subset of users. From what I can see, user profiles only allows importing the full user identity. Is there a way to set up domain wildcards so that it trigger for all users of a domain e.g. *@domain.com? Note: Currently using Classic API data protection policies for M365.Is this something that will be addressed with the Nextgen API? 

As per title. Wondering why Adobe products have been included in the AI usage report. Adobe CC is categorised as “Web Design” and Adobe document cloud is “Business Process Management”.

Hi NetskoperI will like to allow Reddit for “BROWSE and DOWNLOAD” and not worry about URL updated when change.In SWG, I can use Application=Reddit, but there was no “BROWSE” If I will to use custom Category, I can see “BROWSE and DOWNLOAD” but I have to keep monitoring if the URL has change. I like to know what is the difference between Category vs Application? When should I use them effectively?thank

we are planning to migrate existing proxy solution of an organization from  McAfee to Netskopeif any one have any prerequisite please suggest  

Hi all,I would like to see the stats of our policies. I have a widget of Real-time Protection Policy Hits showing the top policies but as i will deploy shortly CFW, i want to check if a policy is used or not.How can i get the stats for each policies i have (report in NAA, other) ?ps: when i click on “View all active policies” it redirects me to a blank page https://mytenantforexample.goskope.com/ns#/inspectionThank

IntroductionNetskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Netskope Publisher on the ri

hello,in reagrds to this CSPM findings “Establish an access control system(s) : IAM Policies with Effect as Allow and Action with sts:AssumeRole for CrossAccountArn”which is being flag for AWSControlTowerExecution, based on some research i have dont the issue is bc this roles have an excessive permissions, however this are default roles created by controltower, hence how can we work this finding out to remediate ? or is this a false positive as im being advice bc control tower has a principal in it limits who can use the role.however I wanted to bring it to the community to see if some has a better understanding of this and can help me understand if it is in fact  a FP or how can this be remediated effectible? 

Is there any local distributor/partner in china mainland? Can customers in china place the local order to these distributor/partners (if available) for Netskope services? 

Please share any solution to block copilot by going to bing.com and clicking copilot. Adding copilot.microsoft.com/ to custom block list does not work, Blocking AI category does not work. No application event or page event indicating any other specific URL that can be added to custom category.

HiHow do you group to view the sequence of event for web access?Eg, Access to website, aaa.com which redirect to okta.com and redirect to bbb.com, etc ……If you can image it will be like “Wireshark Follow TCP Stream”.  I can view go thru each event but is inefficient and can missed out detail.  thx

We’ve yet to implement any HTTP Header elements and policies but have a use case where I believe this is the best solution. However, I wanted to get some guidance.Use Case: Dept wants a specific account (ex. - staff1@email.com) to only be able to access 3 sites (I’ll use examples):  newssite1.com newssite2.com one.teamspace.com All other sites are to be blocked completelyWe tested this by:building out URL List + Custom Category for the above list of URL’s creating a RTP policy to allow the sites via Custom Category for staff1@email.com creating a RTP policy to block remaining categories for staff1@email.com placing this well below the allow policy With the nature of news sites, though, everything feeding the content for the site (content servers, ads, other domains, etc) were blocked and unusable. Since “browse” for the rest of the web needs to be blocked, RBI wasn’t an applicable solution. I’ve since set the “block” policy to “alert” to glean more information on the web categories

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.co created a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit allow. I h

Hello,An integration was carried out between Netskope and Postman version 11.1.25, groups and users are already synchronized, but it does not allow the names to be modified once they are created. You are trying the following json: POST /groups/{groupId}/rename { "name": "New group name" } When the change is made it does not throw any error, on the contrary it sends 200 OK. Thank you

First of all, sorry if that sounds like a stupid question, but i did try to find a straight forward way online, and, all points to certain configurations via Cloud Exchange Plugins.Here is my szenario, it actually is fairly simple.I need to integrate a customers Netskope Environment (and no, I have no other details at this point as this is still exploratory) to a SIEM, the SIEM is not one of the big names. In most other cases, we have done Integrations either via an API that is available, via Storage Buckets, or, usually the most straight forward, via simple Syslog.Given this, aside from this link:  - are there other ways for Syslog integration? I found this one somewhere but i do not think this is still or ever was applicable? 2.1.1    Log in to the Netskope Admin Console:•    Open your web browser and navigate to the Netskope Admin Console.•    Enter your credentials to log in.2.1.2    Navigate to Settings:•    Once logged in, go to the Settings menu, usually found on the left sideba

Can we set policy like before sending the sensitive data across the other domain get a approval notification to manager , and if manager approves it then user can share the data?? 

I was reading the support articles for migrating to NextGen connectors for Google Drive and OneDrive and notice some features we currently use will no longer be supported (e.g. Disable Print & Download, Sharing Content to More than X External Collaborator, REST API Support, etc). Can you tell me why, or is coming at a later date? Thx

Hello people!I am having problems with netskope when synchronizing One Drive, and it takes a long time.And it only syncs if you manually stop the sync and re-activate it.Do you have any idea what could be happening?Best regards

We are really excited to introduce the next phase of the Wiz and Netskope app instance integration.  OverviewThe risk of unauthorized data movement is very real and something we see security administrators often having to deal with - this includes the need to identify what’s going on, understand where data is moving to, and ultimately implement policies to limit this data movement and this is where instance controls can be very effective, giving administrators immense control over what to allow and what to ‘inspect’(for data loss prevention policies) and what to outright block.  Netskope’s industry leading Secure Access Services Edge (SASE)  offering provides not only control of access to your SaaS and IaaS apps and environments, but this control extends to “instances” of these apps and environments. What does this mean? Netskope not only has the ability to identify and control(block uploads, downloads etc.) the usage of AWS S3(say), you can also implement these controls to be specific

Hello,We have installed Netskope client and encountering intermittent connections/service not starting properly once a machine booted up. This is happening for multiple users few weeks after deploying Netskope.Did anyone encounter the same issue? I am searching any related documentation/forums but I think I overlooked it. Thank you.