Product Forums

Could we manage browser extensions (including installation and execution) using NGSWG for MS edge and firefox?  

An issue I have encountered with WhatsApp QR code scanning on my device when the Netskope client is enabled. The problem seems to be consistent and reproducible under the following circumstances:When attempting to scan the WhatsApp Web QR code using the mobile app, the camera opens but fails to recognize or scan the QR code. I am able to log into one WhatsApp account by scanning the QR code, but when attempting to log into another WhatsApp account on the same device using a different QR code, the scan fails, and I am unable to complete the login process. This issue occurs only when the Netskope client is active. Disabling the Netskope client allows both the QR code to be scanned without any problems.Given the critical role that both Netskope and WhatsApp play in our daily operations, this issue is impacting productivity.I would appreciate any assistance or guidance you can provide to resolve this matter. If you need any additional information or would like me to perform further diagnos

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

I am reviewing and I notice that when I use the WhatsApp app and attach an image it is not sent, I do not have associated blocking policies and additionally create a real-time policy where permission is granted to upload and download files.If I enter through a browser, if it allows me to attach all the images, I wanted to check whether netskope restricts the sending of attachments through the App?

To set up a GRE tunnel between Netskope and a FortiGate firewall and create a second static route with the same distance but lower priority, follow these steps:1. Create the GRE Tunnel in Netskope:  - Navigate to Settings > Security Cloud Platform > GRE.  - Click New GRE Configuration.  - Enter the required details and save the configuration.  - Copy the GRE Gateway IP addresses of the two closest Netskope POPs.2. Configure the GRE Tunnel in FortiGate:  - Use the following CLI commands:   shell     config system gre tunnel         edit "GRE NETSKOPE"             set interface "port1"             set remote gw <Netskope POP IP>             set local gw <Local IP>         next     end     3. Configure the GRE Interface:  - CLI commands:   shell     config system interface         edit "GRE NETSKOPE"             set ip 192.168.254.1 255.255.255.255             set allowaccess ping             set interface "port1"         next     end     4. Create the Static Routes:  -

A user has shared a Google Drive with me and an external partner. In Google Admin it shows as Active and I am a manager. The external partner has access, but I do not see it in API-Enabled Protection → Google Drive → Teams, or when I try to create a new DLP policy and choose subset of Team Drives. It is configured identically to the other shared drives in the list. What could be preventing it from being visible? It meets all the criteria outlined in the config guide…https://docs.netskope.com/en/netskope-help/data-security/api-data-protection/api-data-protection-for-google-drive/configure-google-drive-for-api-data-protection/#google-team-shared-drive-support 

Hi Team, Can we have mapped categorization from Zscaler Palo alto Forcepoint Cloudflare Sky high to Netskope its very ease for the deployment prepective.

I am using CASB Inline/API only right now (not SWG) and we use Azure OpenAI. I wanted to know is there a reason that Azure OpenAI is not a fully supported Cloud App (in the Generative AI category) that I can steer and control by DLP policy? I would also like to see it show up with our instance as well. Thx

Hi team, I am Doing a Pov for one of my customer can you please provide me the list of harmful url where their i can test the Netskope is able to protect you from Threats Like Cross site scripting, Crypto mining, virus spyware Botnets. Please suggest me the website so i can show test to them also please dont suggest eicar and netskope security check. 

HiI have been able to configure the NPA periodic reauth and the flexible dynamic steering in my netskope settings, but I’d like to “combine” both of them and I’m not sure if that’s possible.I mean, I have configured the dynamic steering so the users Netskope Client will steer traffic to private apps only whten they are off-premise, and the client will disable for private apps when they are on-premise.I have also configured the Periodic Reauth for NPA in my client configuration settings, so it asks for reauthentication after a period of time, but I see that this Periodic Reauth asks for the reauthentication no matter if the user is on-premise or off-premise. As I want the client only to steer traffic to private apps when off-premise, I’d like also that the Periodic Reauth triggers only when the user is off-premise, and not on-premise no matter how many time has passed since last authentication.could this be done? It seems that the Periodic Reauth is a “global” setting and don’t take int

Hi Guys, Looking if someone can help me with below issue we have.We do have roughly 5-7% of  Windows devices which failed to upgrade Netskope client at some point.These are versions 105.1.0.1406, 106.1.0.1464, 107.0.0.1455, 107.1.0.1529Once trying to uninstall manually it says MSI is missing. Newer msi versions won’t work as well, any way to uninstall/upgrade it without exact MSI version of installer? Al

Greetings, I want to manage a computer without installing the Netskope client, I understand that I can install a Netskope CA certificate but I don't know if this allows me to create a policy in real time and apply it to this machine?download from the tenant Certificates option the one that says NETSKOPE ROOT CERTIFICATE and install on the machine then create a policy in real time but it does not apply, I do not see the equipment as managed within the tenant, but perhaps that is not the procedure.Could someone help me with the step by step to manage and apply real time policies through the certificate.

How we can track AI traffic if it is part of featureset of some application? Nowdays every Application is releasing AI of there own like salesforce,stripe right How we can track those usage through netskope?

Hi, my organization is having some certificate issues with VMs in VMWare and VirtualBox. I attempted to make a custom cert pinned application using the process seen in the NS client NSdebuglog files, which did not work as expected. I have been working with support for a solution but I am hoping the community has an idea on how to solve this. 

Hi I am seeing in our client logs a lot of DTLS disconnects, we’ve lowered the MTU to 1300 too!! 2024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1093 nsssl DTLS SSL_write failed, err: 336642382, syserr: 02024/05/24 15:03:05.326 stAgentSvc p38ec t3f88 error nsssl.cpp:1096 nsssl DTLS SSL_write failed, errStr: error:1410C14E:SSL routines:dtls1_write_app_data_bytes:dtls message too big2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 error tunnel.cpp:898 nsTunnel DTLS nsssl_write failed, err: -12024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:681 nsssl nsssl_disconnect enter2024/05/24 15:03:05.327 stAgentSvc p38ec t3f88 info nsssl.cpp:1140 nsssl DTLS SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1164 nsssl DTLS Exit SSL shutdown2024/05/24 15:03:05.328 stAgentSvc p38ec t3f88 info nsssl.cpp:1606 nsssl DTLS Closing sock 14202024/05/24 15:03:05.328 stAgentSvc p38ec td2c info nsssl.cpp:1905 nsssl on socket close for socket 14202024/05/24 15:0

Hi,New here and I would like to ask if possible and if not where there is a wish a feature option.I had some naughty users who were  disabling the Netskope client (WISHLIST can it be disabled only by inputting a password )Under client Configuration > Tamperproof, I have selected to Hide Client Icon os system tray.Now, my question is, I would like to make sure that all my users are client-enabled on their windows computers.Is there a simple way to do it? Powershell preferably.Thanks E

Hello, i was informed that to utilize the Netskope Endpoint DLP protection, it is required to have SWG Professional license as well to use with Endpoint DLP. I’ve been looking for a statement for the requirement but unable to find out. I just would like to understand why it is required such combination? One reason that i can think of (correct me if im wrong) is due to communication to the tenant would require SWG license.

I'm new to using Netskope Private Access and need some guidance. I want to monitor and review authentication and authorization logs/events info for the applications accessed through this service.Could someone provide detailed steps or direct me to the relevant sections in the Netskope admin console where I can find these logs?Any help would be greatly appreciated!Thank you!

Hello Netskope Community,  You’ve probably seen some other Netskope publications around GenAI adoption but this one specifically addresses organizations that haven’t started their journey yet and want to leverage a Zero Trust approach when it comes to GenAI apps like ChatGPT and others which have been fueling a lot of development and discussion at organization of all sizes due to its innovation possibilities but also by their perceived risks.  With the recent announcement of the extended license of RBI, admins can utilize our Remote Browser Isolation technology to provide access to apps based on application tags and their observed risk translated through the CCL (Cloud Confidence Level) values. Let's explore two scenarios which are possible by using this approach: Company has currently been blocking all GenAI apps but wants to allow access to at least ChatGPT via Remote Browser Isolation so users cannot paste corporate data into it or copy from it but still interact with the Assistant.

Problem Statement:ZTNA requires that all application objects are uniquely and explicitly defined. In large organisations, IT Security teams often do not have insight into all the applications used by business users and neither do they understand which users should have access to these applications.Use Case:Leverage robotic process automation to enable business led application onboarding. Provide a form to business users enabling those users to request a new application. After an approval flow, API’s are then leveraged to provision the application objects in Netskope with the relevant access granted. Proof of concept:The idea is that any business process automation tool like, Microsoft Power Automate, BMC Helix, tine etc. can be used to assist companies to achieve this use case. I leveraged the community version of n8n to build a simple proof of concept and provide insight into how this type of process can be used to simplify the implementation of a zero trust network access strategy.De

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

As organisations take control of the SaaS applications they use and sanction, one key area is to tag applications as Sanctioned or Unsanctioned (or other tag names if you prefer). Tagging an application in the CCI is simple (see below), but laborious if you have many to do.https://docs.netskope.com/en/netskope-help/admin-console/cloud-confidence-index/tag-apps/ How to use an API for Application taggingGo to Settings/Tools/Rest API v2  Select API DocumentationSearch or scroll down to /api/v2/services/cci/tags/Click to try out the API Select the tag you want (using Sanctioned here) Select “Request body for patch app tagging” ( this gives some sample options on how to select the app by name or id) Edit the text to select the apps you want tagged (example here is for Box, Evernote & Dropbox) Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your

Wondering if anyone has taken advantage of a synthetic data generation tool like K2View or Gretel and integrated with Netskope for use in identifying and whitelisting synthetic data elements versus production data? This comes into play with companies developing code and processing sensitive data types. Thx

We want to trigger different action f for medium and HIgh Severity  for a UK NINO ProfileFor Medium   we want user justification need to be triggered and for high we want to block need to be triggered 

Hi everyone,   Is there a way (prefer. registry key) to determine is a Netskope Client install was single user (default) or multi user mode? This would help in "cleanup" of messed-up installs.   Best regards,   Etienne