Product Forums

How can I change the Status for more then 100 incidents at a time, which is the dashboard limit? I have thousands of incidents created from a retro-active scan and would like to add my own custom status to them all at once.

In working with the Netskope CASB, we’ve had analysts come up with the question “would this URL be blocked?”  I know we can go into Skope IT and do a URL Lookup to see what categories a URL is linked to and what policies “cover” it.  However, this doesn’t see to answer the fundamental question, “would it be blocked?”  There is the simple solution of, “just try it”, which will provide the answer, but this has some obvious downsides.  And it seems that the Netskope system must know if a URL is blocked or not, it will block browsing to a URL afterall.  Is there something I am missing in the interface which does this?  Or, is there a safe way to validate a URL from an analyst’s system, which doesn’t involve “ya, just try visiting a potentially malicious URL”?

Starting a few months ago our company users have reported consistent and numerous blocks by Google to access our own Workspace tenant apps (Google Admin, Gemini, Gdrive, etc). The message received by the users say, “Our systems have detected unusual traffic from your computer network. Please try your request again later.” It then presents your network IP and says it does not equal the Netskope POP IP (e.g. 10.10.10.10 ≠ 163.116.140.55). This implies that Google no longer trusts the Netskope POP subnets and see’s the proxied traffic as a risk. Is Netskope aware of this issue and are you working with Google to remediate it? Thanks 

OK, I am sure it will be obvious when someone tells me, but I walked trough what I think is every Settings spot and cannot find the Enrollment Token Section.  The Docs start out saying “Click Create TokenSet to create a new token set on the webUI. “ but not where it is!     It feels like it should be in the “Client Configuration”…….

Hello Netskope Community,One of our customers has a requirement where a specific role should have the ability to create policies and apply global/general settings, but not be able to delete any policies or settings due to compliance reasons.Currently, this level of granularity is not supported. The available permission levels—None, View, Manage, and Manage and Apply—provide either read-only or full read-write access to a specific feature or function. However, there is no built-in option to restrict only the delete action for a role.We would like to know if there are any known workarounds or if this capability is being considered for a future release.

I have the Netskope REST API Events v2 integration configured within Postman and queries are successful. I am wondering is there a method to limit the query by user, as well as number of days?My use case is as employees is leaving the company, I would like to just add there user name into the query, and have it pull the last 30 days of Alert, Application, and Incident logs for them, so I can export in CSV format. Thanks 

Alternatives - Deployment/Enrollment with UPN - Based on Postman-SCIM - Users - GroupsHello community, how's it going? Good afternoon, I hope you're all well. I have a specific case to discuss:In a scenario where we have a complete refusal to touch anything in Azure AD or AD-onprem (nothing at all, no way - no agent, no directory import, no enterprise app, no ID entry, etc., nothing at all, it's not possible because there's absolutely no option), here we already know, we use our beloved Postman to use SCIM and start generating users/groups, so to speak, "manually." Then we have the AD users with UPNs, everyone happy without touching AD but with the AD-onprem UPN users, already in the Tenant using the Postman SCIM API.We can deploy with tools like System Center, DesktopCentral, or anything else for .msi files with UPN values. Everything's OK here too. We install, the Windows users of the AD domain start, and the UPN registration and enrollment are OK, as expected. Now, here's my big que

Are there any recommended guidelines to indentify and filter out known org AWS S3 traffic, and then enforce Netskope policy on only external S3 traffic? 

When creating a coaching policy, when the user enters a justification reason, where is this captured in the admin portal?

ObjectiveThe combination of English characters and other special characters is treated as a single word. Netskope Regex does not support detection when English characters are combined with uncommon symbols, even underscore, and the specification of Netskope Regex rules remains unclear. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can validate this issue by adding an underscore (“_”) or random characters after the English keyword they want to detect, as demonstrated below. Do You Know?Users can easily bypass Netskope’s DLP detection mechanism without even decomposing the keywords. This means administrators will be unable to track or investigate potential data leakage incidents.We have requested clearer instructions on how Netskope defines Regex rules, but so far nothing has been provided. NotesWe’ve discovered that others have already raised si

From this article, it mentions the feature flag Netskope Entity Modifier. Could you clarify the difference in behavior before and after it is enabled?Note:Can we suggest allowing a longer period for comments on articles? Otherwise, we have to create a new article just to ask follow-up questions.

I used the locally installed Postman application to send API POST requests with test data to evaluate whether Netskope could detect them. While SkopeIT is logging the events, the policy doesn't seem to be triggering, and I’m unable to view the actual data being transmitted in the API request. Has anyone encountered this issue or have insights on what might be going wrong?  

Hi,I have integrated a Syslog SIEM with the Cloud Exchange Log Shipper module, and everything is working fine. However, in the mapping file pushed to the SIEM, I’d like to include the User Group information from the alerts/events, and I can’t figure out how to do that.When I check the Mapping File Wizard to edit an existing mapping—or even when creating a new one—I can't find any “Netskope Field” that corresponds to the User Group attribute of the generated alerts/events. I need to send that attribute to the SIEM.Does anyone know how I can map it?Thanks in advance.Regards

Greetings All,I’ve had a persistent issue for several months with Netskope on macOS that I wanted to throw out here to see if anyone else had come across something similar. Intermittently devices with the Netskope client installed will lose all connectivity to the internet. In the logs I see usually around 50,000 of these messages in a span of just a few seconds`critical nsDNSProcessor.cpp:149 dnsProcessor Failed to get DNS resolver values`Usually as this happens all active connections are killed, like ongoing zoom calls, even though those aren’t being steered to Netskope.Before this I see the DTLS tunnel close down with this flownpadebuglog.log```[info] npaClientHandler.cpp:748:npaClientHandlerStop():0x0 Will shutdown NPA handler and dispatch thread, tunnelId = 7f8b47.[info] tcpclient.cpp:530:shutdown():0x1086a1160 Shutdown socket fd 45[info] npaClientHandler.cpp:755:operator()():0x0 The client handler is stopping and shutting down, userId = 502.[info] tcpclient.cpp:199:handleClose():

Is there any plans to add Google Agentspace (vertexaisearch.cloud.google.com) as a managed app connector we can steer? 

Refer to case 00555037. The main reasons we have this requirement is because our IdP domain myid.ladwp.com is within the App Discovery list *.ladwp.com (which allows users access to all internal hosts within this domain). However, the problem is that NPA is steering this myid.ladwp.com domain as a Private App, which causes Okta admins to always see the gateway IP as on-premise. Okta administrators need to see the XFF/Gateway IP. So if a user is working at home or from a remote network, Okta Admins should see that remote network XFF IP address, not our DWP public IP address. When Okta evaluates the IP chain, it uses this XFF IP address to determine whether or not to MFA challenge. At the moment, a remote user always appears to be on-premise from Okta's perspective. This is a problem that we'd like to solve. Hoping you can provide a way to perform NPA bypass similar to how there is steering bypass for SWG/CASB/CFW. Another strong use case is when on-premise detection feature is used, in

Hi All, We are trying to determine if Netskope has visibility into traffic sent from java/python scripts.  For example, if I have a java script that sends an HTTP POST to a API and the POST contains sensitive data, can Netskope detect that? From my testing it doesn’t seem so, but we wanted to check with the community. Thanks!

I searched and had a hard time finding much on this, but basically, I am deploying NPA across my organization and some server admins (notably using Macs) have run into hostkey mismatches when SSHing into servers behind NPA. Does anyone have experience, specifically, with managing SSH host keys to servers when migrating to use NPA?

Searching the forums and I couldn’t find an answer. We have the need to print, to on-prem printers (via a print server), for remote users.I’ve created the Private App for the Print Server with the following portsTCP 135,137,139,445,631,9100UDP 135,137,139,445,631,9100But it doesn’t seem to be working. Although management (via mmc) of the print server is fine.Any idea?I don’t think I need to create a Private App for the printer(s) themselves, since the Print Server should be the connection manager / proxy for that traffic.

i have this Use Case For example, if a file is larger than 200 MB, I want it to be automatically redirected and uploaded to a SharePoint or S3 bucket.How can I achieve this using Netskope?

Hellow, I'm experiencing the following issue: provisioning third-party users who use mcbook. Their accounts don't have email addresses and aren't part of the domain.I've tried everything but to no avail. Could someone tell me if this is possible?

Hi Team,I’ve observed an issue where Outlook on the browser does not receive new emails when the Netskope client is enabled. However, at the same time, the Outlook desktop application continues to receive emails without any problem.This leads me to believe that the Netskope client might be interfering with mail synchronization on the browser. Could you please help investigate and provide a solution for this?

Does anyone know what the “Export User Key” is used for in Netskope? This feature is located in Setting>Security Cloud Platform>User section?I could not find any documentation on the use case for this feature. I’ve attached the screenshot below.  Is there a place to store the json file once the user key is downloaded?  Thanks.  

How can i access private applications using enterprise browser? I tried creating a realtime policy with “access method” as one of the criteria but couldn’t find enterprise browser in the option. additionally i tried to create an enterprise browser protection policy for private apps but the option is grayed out.

I think that it would be helpful to have a button (or something) to do a SSH to the publisher directly from the tenant.