Product Forums

Hi. I recently came had a problem related to configuration. it had to do with making a change in the user notifcation. This was a global change. I changed a setting from browser to client which had a strange effect on our org. Normally when you make a change you generally have to “save” then click “apply” in this case you only click “save” for it to take effect. My question is why do changes not requiring “Apply” don’t show up in the audit logs?My second question is what change logs don’t show in the Audit log?   

42% of SaaS users report consistently poor performance. 39% of these aren’t detected by traditional monitoring tools.Netskope ran a global survey this community and it was clear that troubleshooting SaaS issues and optimizing performance is incredibly difficult for several reasons:SaaS leverages highly distributed cloud hosting, where what looks like a single web page really relies on dozens of micro-services and integration with third party apps and services. The shift to hybrid working introduces BYOD, home WiFi and internet issues accessing SaaS apps, while users are also highly distributed as they fluidly move from home to office. SSE / SASE and Zero Trust approaches that address this new distributed user and security perimeter are themselves SaaS / cloud apps. Their impact on user experience and latency can’t be accurately measured by traditional monitoring tools that see these inline services as a ‘grey cloud’—much like a VPN or SD-WAN tunnel—making it nearly impossible to unders

Dear Netskope community, at the level of Malware/Malsites, there is something similar to the incident part, where the analyst can deal with the case opened by Q-Radar, like to sign the incident and classify it,  what do you do with these events or better what should I do? Another question, is it interesting to insert the hashes of Block events in IOCs lists, I ask it because the rule action is already a Block, I understand that inserting the hash already blocked in an IOC list is something redundant, right or wrong? I fully understand the possibilities of integration of Netskope Exchange with Service-Now, Siem Q-radar etc, but my question is more focused on operational procedure, the problem we find here is as to what action to take in the face of dozens of alerts forwarded to Service-now via Q-radar, and at each Malware event the Soc people keep registering hash in IoC list and it's like wiping ice,  there are dozens of events, we have this implemented for a Tenant with more than 9k u

Hello, I’ve created a data dictionary containing false positive terms (D0). The given expressions does not seem to be working - P0 AND (NOT D0)P0 AND (NOT(P0 AND D0)) Predefined Identifiers(P0) - Full Names (International)Dictionary Identifiers(D0) - DLP-Exclude-Full NamesI’d like to detect all the terms which are IN P0 and NOT IN D0.  Could anyone suggest an alternative, please ? Thanks ! 

Dear community,I am working with SWG and DLP to avoid users uploading sensitive content on corporate Onedrive.All the client has netskope client enabled and everybody run win10.I successfully managed to avoid users to upload on Onedrive via web a sensitive files, due to match with DLP policy, but the same user, while using Onedrive app just receives a warning.Basically, when the user upload the PII file is warned by the netskope client and it is also blocked,  when the same file is copy/pasted in the shared onedrive folder, it is only warned, but the action has success.Is that a limitation or are there some configuration part which I am missing?the client configuration is steering everything and the exception part is by default. Thanks.Walter

Hi For the threat protection scanning,1) What is the scan policy setting?2) How do I show what are the file being scanned? thank

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

Dear Experts I recently installed NetskopeClient on my iPhone and when I launched the CapCut application, I could not connect to the server.In Advanced Analytics, the Web Transaction SSL ErrorsI checked the log of Web Transaction SSL Errors in Advanced Analytics and found that the following URL was an SSL error, so I registered the URL in Do Not Decrypt and the HsFailure is no longer displayed in the log, but I am still having trouble connecting to the server.I can connect to the server by deactivating NetskopeClient.If anyone has had the same experience, please advise.■EnvironmentDevice: iPhoneSE3（ios17.4)NetskopeClientVersion：112.0.01939■Bypassed listv19-vod.capcutvod.compassport-api.capcutapi.comlf16-web-buz.capcut.comcapcutstatic.comcapcut.compassport-api-sg.capcut.comfeed-api-sg.capcut.comeditor-api-sg.capcut.comp16-capcut-sign-sg.ibyteimg.comv16-vod.capcutvod.comfeed-api-sg.capcutapi.compassport-api-sg.capcutapi.comeditor-api-sg.capcutapi.comcapcutapi.comThank you for your cooper

agent installationI want to install the agent on several machines that I cannot reach either by invitation or through GPO.Is there a way to give an installer to the support staff and they go machine by machine to install the netskope agent and then the end users enter and authenticate with their user? If, for example, I download from this route https://download-<;your-tenant-name>.goskope.com/dlr/win/get and the support staff installs it correctly?

HiWhen access www.businesstimes.com.sg, a full page advertisement will popup.  I have to click “X” to close in order to access to the actual content. How can I block this full page advertisement?  I tried “Online Ad”, but did not work.Likewise, how to cleaning remove the top advertisement border in “cnn.com”?Pls advise

Hello Netskope Community,  Have you ever asked yourself (or someone) if “Netskope Threat protection have signature coverage for [insert name of threat here]? “Well, in case yes, now we have an easy tool that can help you find the answer. The threat labs team just released an online database with all the signatures and protections we have in place, broken down by CVE, engine, family and MITRE ATT&CK information.  check it out here: https://threatlibrary.netskopethreatlabs.com/ Now you know! Stay safe out there! Fabio 

HiI have a RTP allow for video streaming with webpage coaching notification to inform user.How do I configure it to show the coaching page everytime it was access to those site? Thank

Can security and performance coexist?The secure service edge should make the connection between users and apps more direct. But when things go wrong, it’s hard to tell where issues originate and who’s impacted. SASE can improve user experience, instead of impacting it. Visibility into cloud security reveals issues you can quickly fix then automate.We developed a next-level IT playbook to summarize practical strategies to deliver a phenomenal digital experience and a productive business advantage in a zero-trust environment.  Executive SummaryThe shift to a more distributed and dynamic digital infrastructure based on hybrid workforces, SaaS applications, and cloud hosting has created a visibility gap, making user experience and performance management more challenging for IT organizations.SASE-integrated DEM is a natural solution to this problem. It provides a unified view across network, application, endpoint–and security–management domains. This visibility simplifies collaboration amon

Hello,I’d like to create a new NPA policy via REST Api.I wonder if this part is needed:"rule_order": {                          "order": "top",                          "rule_name": "api-policy-managed",      "rule_id": 1,                          "position": 5                        }I don’t know the “rule_id” as it’s not created yet. Could I just skip it?What is default order for newly created policy within provided "group_id" and "group_name"?What about other parts like "dlp_actions", “privateAppsWithActivities”, "net_location_obj", "srcCountries"  - should be skipped if not needed? Best regards

HiFor a just booted up laptop and yet to login, can the agent steer web traffic to Netskope?   Or it has to login to steer web traffic?  Thank 

I have found some applications such as X(formally twitter) and facebook has "view" and "view all" activities.maybe it depends on applications but I would like to how I can understand the differnce of them.

Good morning,in order to understand how to administratively place the purchase of Netskope I am being asked to understand if Netskope can in any way function if the Netskope Client is unable to contact the gateway in the cloud or if, as I imagine it is, all traffic goes through the firewall.

Hey there,This might sound silly (because it is), but would it be possible to have a different icon color when private apps are disabled ?ie: having a more orange-y color when private apps are disabled, so users can know they need to re-auth (instead of showing a green dot that implies “all is good” when it is actually not).Cheers

Where is the recommanded location (DMZ or Server zone) to implement the publisher in the firewall protected environment? All the port need to be opened to the back-end servers on the firewall?is the traffice flow is correct?End-users → tunnel  →  publisher -->(open all required ports on the FW ) → App servers

We have been leveraging the inline DLP policies for over a year, and have struggled to “tune” the policies for false positives for PCI, PII, GLBA rules. Curious for feedback from the community no how you tune your rules/classifier etc to weed out false positives.. Our current route/solution we are looking at is excluding “sites” that generate the majority of the false positive hits. Example: Walmart is notorious for flagging carts with Names of brands next to the item number for SSN & US Names..Any and all feedback is welcome - thank you so much in advance!!

Re: Support Case00347414 I am having issues with Facetime when Netskope is enabled. I am steering "All Traffic" I have created a certificate pinned app for the facetime process and bypassed * all domains from steering config.  Whether this cert pinned app is enabled, or not - the issue persists. I have ALLOW-ALL rules set for cloud apps, all web traffic, and cloud firewall. I also have numerous Apple domains set to Do Not Decrypt in SSL Decryption policy.  Looking for assistance from others who may have encountered this in there deployment.  @sshiflett any ideas? NS Debug Logs with Cert Pinned App disabled: 2023/11/20 11:36:43.519144 stAgentNE p2668 t18363 info tunnel.cpp:873 nsTunnel DTLS [sessId 120352348] Tunneling flow from addr: 1.0.0.1:51979, process: facetime to host: gateway.icloud.com, addr: 17.248.193.19:443 to nsProxy 2023/11/20 11:36:43.652241 stAgentNE p2668 t9523 error nsClientFlow.mm:200 nsClientFLow Find UDP flow id

Hi there,We have created apps definition with FQDN and PQDN, but we are able to access the application with FQDN and not with PQDN. We have DNS Search Domain update from DHCP which is correct domain and also edited the 51-cloud-init.yaml  file with the correct domains in publisher. But still access with PQDN doesn`t work.Does anyone has any idea what next can be done? I have already raised Netskope Support, but would like to quick resolution if anyone has faced this issue.

I am looking for thoughts on if people have enabled the setting in the Client Configuration for Perform SNI (Server Name Indication) check ?    We are migrating VPN technologies and have noticed some traffic occurring outside of the Netskope tunnel when we do not expect it.  We believe this setting to be the reason as it indicates that the initial three-way handshake for traffic occurs outside the tunnel to retrieve the hostname.   Additionally we have several third-party applications that we use Source IP allowlisting with and believe that this may be causing issues with some of those as well.   This was enabled (I believe) during our initial configuration and now want to gather pros and cons of having it enabled/disabled?

Hi guys! Just a quick question since a requirement from senior management just arrived:Is it possible to filter (allow / deny) web traffic to google workspace services based on domain or tenant id?The idea is to allow only some tenants or domains to access google workspace resources (and denying all personal services) via SWG configuration. Best regards to all!