Product Forums

Hello Netskope Community,  You’ve probably seen some other Netskope publications around GenAI adoption but this one specifically addresses organizations that haven’t started their journey yet and want to leverage a Zero Trust approach when it comes to GenAI apps like ChatGPT and others which have been fueling a lot of development and discussion at organization of all sizes due to its innovation possibilities but also by their perceived risks.  With the recent announcement of the extended license of RBI, admins can utilize our Remote Browser Isolation technology to provide access to apps based on application tags and their observed risk translated through the CCL (Cloud Confidence Level) values. Let's explore two scenarios which are possible by using this approach: Company has currently been blocking al

Problem Statement:ZTNA requires that all application objects are uniquely and explicitly defined. In large organisations, IT Security teams often do not have insight into all the applications used by business users and neither do they understand which users should have access to these applications.Use Case:Leverage robotic process automation to enable business led application onboarding. Provide a form to business users enabling those users to request a new application. After an approval flow, API’s are then leveraged to provision the application objects in Netskope with the relevant access granted. Proof of concept:The idea is that any business process automation tool like, Microsoft Power Automate, BMC Helix, tine etc. can be used to assist companies to achieve this use case. I leveraged the community version of n8n to build a simple proof of concept and provide insight into how this

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

As organisations take control of the SaaS applications they use and sanction, one key area is to tag applications as Sanctioned or Unsanctioned (or other tag names if you prefer). Tagging an application in the CCI is simple (see below), but laborious if you have many to do.https://docs.netskope.com/en/netskope-help/admin-console/cloud-confidence-index/tag-apps/ How to use an API for Application taggingGo to Settings/Tools/Rest API v2  Select API DocumentationSearch or scroll down to /api/v2/services/cci/tags/

Wondering if anyone has taken advantage of a synthetic data generation tool like K2View or Gretel and integrated with Netskope for use in identifying and whitelisting synthetic data elements versus production data? This comes into play with companies developing code and processing sensitive data types. Thx

We want to trigger different action f for medium and HIgh Severity  for a UK NINO ProfileFor Medium   we want user justification need to be triggered and for high we want to block need to be triggered 

Hi everyone,   Is there a way (prefer. registry key) to determine is a Netskope Client install was single user (default) or multi user mode? This would help in "cleanup" of messed-up installs.   Best regards,   Etienne

Hello,I was asked if Netskope could provide a user alert when visiting a site, for example, chatgpt that they acknowledge the risk and then either click proceed or stop. We do not have the SWG and I think it might be needed to accomplish this? If we dont have SWG is there a way to get this accomplished? 

Hi All, I am new to Netskope.  We are running Netskope as a VPN solution. Can you run another VPN solution on top of this without affecting Netskope.Like Cisco Anyconnect.

Hello everyone, is it possible to control that a user closes the process or service associated with the Netskope client?As far as I know, I can control a user to disable the client but this leaves the user the ability to kill the client process and thus navigate outside Netskope.

We are expanding our NPA footprint soon. Several of the users that are about to gain NPA access use the Ivanti Management Console (remote management console) on a daily basis. Attempting to log into the console results in the following error:  Console Initialization Error:  Unable to connect to the database.A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No such host is known.).We have Private apps created for this host and IP alrea

Hello, Would like to check the dedicated egress ip address is tied to the ZTNA solution. meaning if you want to use the ZTNA feature on Netskope, then dedicated egress ip address is required for the feature?

Hello Everyone,Hope you are doing well.I have one question regarding license.We are implementing Netskope SMTP Proxy at customer end, and we are integrating Netskope with Microsoft O365 for inspecting outgoing emails.What type of license do we require from O365 end to do configuration (eg - blocking rule) 

Hello,I would like to use multiple tags for private apps.What would be the syntax here?tags { tag_name = "TEST, TEST1, TEST3" } ?I would be grateful for your help.Marco

Hi, i am having an issue on mac devices. When i am away from my device for a period of time (normally an hour) i will have to re authenticate via OKTA to outlook and teams, i have worked out this is because my netskope client is somehow dropping connection and as a result im coming from my home IP address which isnt allowed on the Microsoft end. Has anyone else noticed this behaviour, i have seen a battery setting on the Mac that i think will fix it but i just wondered if this was common.

Windows onlyWe noticed that starting last week we’ve been getting reports of a lot of windows agents where NPA is disabled and the Agent Config doesn’t update. A reboot solves this. We’ve never had a single issue with Windows endpoints in years, now this. We’ve opened a ticket but curious if anyone else is seeing this.2024/03/04 10:37:09.253 stAgentUI pbb4 tbc0 error osUtils.cpp:358 nsUtil Failed to initialize COM library. Error code = 0x80010106One observation we have is that when this started (last week) there was a push from our IT team to get Windows updates applied. 

Is the option to perform local system scans (Windows, MacOS) on the roadmap? I really need the ability to identify files matching my DLP polices that reside on our users managed computers. Thx

HiIs there a difference between wireshark vs netskope packet capture when collecting trace?thank

Hi Friends, Is it possible to create a rule for internal users to detect any CPF sent through chat? Best regards

For Private Access environments in which users also have mobile (iOS & Android) access to certain Private Apps, what’s the best way to avoid flooding users with daily Periodic Reauthentication on their computers as well as their phones? Maybe a better question would be “what is the expected user experience in terms of Periodic Reauthentication” for users leveraging Private Access on both their work computers and their phones?should users be prompted to reauth on both devices?  is it just whichever device prompts first?  is the expected behavior different for iOS & Andriod? Also, if the reauth period lapses or the prompt is missed or accidentally closed on the phone and private access disables, what is the best way to instruct end-users on restoring Private Access on their phones ? On computers, reauthentication is easily done via the client menu, but I’ve been unable to find any such option on the Netskope client/app on

Some of you may know that Netskope has a SCIM API which can be integrated with IDP's such as Okta, Azure AD, etc., to provision User's and Group's into a Netskope tenant.  This is a critical part of deploying Netskope since the User provisioning is a pre-requisite to deploying the Netskope client.   There are certain times that you may not want to integrate with the IDP or maybe you are transitioning from an on-prem Identity Store to a cloud based one and aren't quite ready, but you still want to test Netskope functionality.   The SCIM API can also be used to manually create users and groups and add the users into groups so that they can both be leveraged in Netskope real-time protection policies.  The guide provides a walk through on how to accomplish this task.   If you have some ideas on how to improve the guide or on any additions, please reach out to me to discuss.

I created an API Data Protection DLP policy to look for a certain file type and it is limited to a certain Team. If I create a Retroactive scan using this policy will it only scan that Team, or the entire instance?

We are reevaluating the NPA Periodic Re-authentication. Previous user experiences were lacking. However, now that we have had support enable the “reauth at log-in/reboot”, things have improved dramatically. The primary downside that is keeping us from expanding this for testing is the pop-behind nature of the reauth prompt. Many users think they “are not being prompted” when in fact they are. Is there anything that can be done to force the prompt to either remain at the forefront until addressed or give the prompt a taskbar presence like applications/browsers/alerts do. Users that lock their device at the end of the day (in their given workspace) rather than logging out/shutting down, have no idea the reauth is open behind the of their apps/browsers at the start of the day due to the pop-behind nature of this prompt. If there is no current solution, is this on the roadmap to fix? If so, when?@sshiflett 

I am unable to access the application without a client. I have Integrated Okta for reverse proxy. Whenever I try to access the application, I am getting an error: 500 : Netskope was unable to process authentication request for tenant:<18507>. couldn't create AUTH URL: runtime error: invalid memory address or nil pointer dereference. 

It seems as if creating DLP rules/profiles will not trigger on the name but only content. Does anyone know a way to address this? For example, I would love to have a couple dictionary entities that look for certain word NEAR certain words in a file name.ExampleDictionary 1: cat, dogDictionary 2: mouse, birdD0 NEAR D1 Filename: My cat and turtle.pptx (wont alert)Filename: My dog and bird.pptx (will alert)The content of both files has none of those words.