Product Forums

I recall stumbling upon a Community article a while back for a regex chrome / edge pattern match used in app definition for a steering bypass.  For the life of me i cant find it, was looking to create a steering bypass for all processes except for Chrome, Edge , Safari and Firefox.anyone done this? (useful to have in some heavy dev environments for a limited group of folk)

Hi there We use MacOS in our estate. I want to build an automation with a tool like Tines or Workato whereby, when a user clicks the Disable Client/Internet Security option, the automation will run a workflow that gets the OTP via an API request.How can I go about doing this please?

Hello,I would like to know if it is possible to allow copy and paste when using ZTNA in browser access mode.If yes, could you please provide guidance on how to configure it?Thank you 

What's the best way to create a DLP Rule that looks for Email Addresses (using the Built In Netskope Email pattern) but not generate hits on our company domain ie @company.com.I was trying to make a custom Entity and then use a not clause in the DLP Rule but not sure if that will give us the behavior I was looking for.

Can anyone confirm whether Netskope enforces restrictions that prevent a Mac laptop from connecting to public Wi-Fi networks, while allowing successful connections to private Wi-Fi networks? If such a restriction exists, could you please advise which specific Netskope logs should be reviewed to verify whether the Mac laptop's access is being blocked or restricted on public Wi-Fi?

Some of my users are reporting errors when trying to connect to a SQL Server over NPA. The connection is successful but is erroring out due to a cert trust issue: The SQL server has forced encryption turned on; I have verified that the remote host is able to connect over the required ports.Is there another configuration that is needed to allow NPA to work with SQL Server Forced Encryption, do I need to deploy the Netskope Cert to the SQL servers? 

Is anyone experiencing problems with Next Gen when it comes to policies for Google Workspace. Not sure if it is just me but it seems that I have had multiple things that don’t seem to work or just is not available. An example I created a policy to take action on specific resource IDs (not sure why Netskope is not using the Google Document ID) but the policy did not find the document at all. Did this with support on the line and they did not know when it was not working. I cannot create a policy to apply to specific owners I only have the all owners in the Collaboration section. I feel like this has not been through any QA testing for Google Workspace at all. 

I have been tasked with allowing our user population to have access to the Generative AI category while also protecting the company and our patients by preventing uploads of any files with PHI in them to anything other than our internal instance of Copilot.I have created Realtime policies that I believe achieve this goal, but I have encountered an issue where certain AI sites do not upload the file in a format which Netskope can see into.  Specifically, Grok uploads files as a blob while Quillbot and Heidi Health AI upload the file in blob, json or webm formats.Is there a way for Netskope to be able to view these file uploads and apply our PHI profiles to the upload?  I have not seen any documentation which addresses this, and I am curious if anyone else in the community is running into a similar problem.

Hello Netskope Community,Managing endpoint client software across an entire organization is a critical task. A key part of this is having a clear strategy for updates and, when necessary, rollbacks. This guide outlines Netskope's recommended best practices for managing client versions to ensure stability, minimize risk, and maintain business continuity. Understanding the Netskope Client's Upgrade Behavior A common question we see is, "How do I roll back the Netskope Client?"It's important to know that the Netskope Client does not have a native, in-place "downgrade" feature. The installer is designed to prevent an older version from being installed over a newer one to maintain system and configuration integrity.The Official Rollback Procedure:If you need to revert to a previous client version, the required process is a full uninstall and reinstall, orchestrated by your endpoint management tool (e.g., Intune, Jamf, SCCM). Obtain the Installer: Download the specific client version you wis

Yes, I am  going to create a case, but on the chance I can shortcut the process I thought I would ask here. Has anyone developed a solution for the AI chatbot at help.salesforce.com?We know we are going to have to SSL bypass, we just having figured out what URLs yet.  

ObjectiveHighlight the outcome that improvements to international predefined entities are part of Netskope’s long-term roadmapNetskope existing detection mostly relies on a third-party entity. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can test pre-defined identifiers in their own languages, particularly in non-English regions, to verify whether they function correctly. They may only trigger the sample data demonstrated in the UI, so using a variety of real-life samples is highly recommended for more accurate verification. Do You Know?Non-numerical identifiers such as addresses, names, or terms are likely to bypass Netskope’s DLP detection mechanism without triggering alerts or appearing in DLP incidents. This means the administrator will be unable to track or investigate the data leakage incident. NotesWe’ve discovered that others have alre

Hello everyone,We've seen a few questions lately about the best way to handle Netskope Client upgrades when you have a mixed environment of non-persistent VDIs and traditional laptops. A common challenge is that the same user might use both, but the upgrade strategy needs to be different for each.Let's break down the problem and the best-practice solution. The Challenge: Different Needs for Different Devices  Non-Persistent VDIs: You can't use the standard auto-upgrade feature from your Client Configuration. Any update applied during a session gets wiped when the VDI reverts to its golden image. Upgrades need to be manual and controlled. Laptops: You want them to auto-upgrade. It’s the easiest way to keep your users on the latest client version and maintain your security posture with minimal effort. So, how do you disable auto-upgrades for VDIs while keeping them enabled for laptops, especially when the same user logs into both? The Solution: The autoupdate=off Installer Flag is Key!

We tested the user alert feature and noticed that when a DLP profile is applied to the user activity 'Post' for all web access, the user alert option cannot be selected.However, once we changed the policy to apply only to specific categories, such as cloud storage, the user alert option became available.We also observed that user alerts work if no DLP profile is applied but the 'Post' user activity is regulated across all web access. App Category - Profile - Activity - Action(1) Specific Category - DLP - Post - User Alert ✅(2) All Web - DLP✅ - Post - Alert/Block(3) All Web - No Profile ❌ - Post - User Alert ✅Does anyone know the mechanism behind this behavior?

How can I change the Status for more then 100 incidents at a time, which is the dashboard limit? I have thousands of incidents created from a retro-active scan and would like to add my own custom status to them all at once.

In working with the Netskope CASB, we’ve had analysts come up with the question “would this URL be blocked?”  I know we can go into Skope IT and do a URL Lookup to see what categories a URL is linked to and what policies “cover” it.  However, this doesn’t see to answer the fundamental question, “would it be blocked?”  There is the simple solution of, “just try it”, which will provide the answer, but this has some obvious downsides.  And it seems that the Netskope system must know if a URL is blocked or not, it will block browsing to a URL afterall.  Is there something I am missing in the interface which does this?  Or, is there a safe way to validate a URL from an analyst’s system, which doesn’t involve “ya, just try visiting a potentially malicious URL”?

OK, I am sure it will be obvious when someone tells me, but I walked trough what I think is every Settings spot and cannot find the Enrollment Token Section.  The Docs start out saying “Click Create TokenSet to create a new token set on the webUI. “ but not where it is!     It feels like it should be in the “Client Configuration”…….

Hello Netskope Community,One of our customers has a requirement where a specific role should have the ability to create policies and apply global/general settings, but not be able to delete any policies or settings due to compliance reasons.Currently, this level of granularity is not supported. The available permission levels—None, View, Manage, and Manage and Apply—provide either read-only or full read-write access to a specific feature or function. However, there is no built-in option to restrict only the delete action for a role.We would like to know if there are any known workarounds or if this capability is being considered for a future release.

I have the Netskope REST API Events v2 integration configured within Postman and queries are successful. I am wondering is there a method to limit the query by user, as well as number of days?My use case is as employees is leaving the company, I would like to just add there user name into the query, and have it pull the last 30 days of Alert, Application, and Incident logs for them, so I can export in CSV format. Thanks 

Alternatives - Deployment/Enrollment with UPN - Based on Postman-SCIM - Users - GroupsHello community, how's it going? Good afternoon, I hope you're all well. I have a specific case to discuss:In a scenario where we have a complete refusal to touch anything in Azure AD or AD-onprem (nothing at all, no way - no agent, no directory import, no enterprise app, no ID entry, etc., nothing at all, it's not possible because there's absolutely no option), here we already know, we use our beloved Postman to use SCIM and start generating users/groups, so to speak, "manually." Then we have the AD users with UPNs, everyone happy without touching AD but with the AD-onprem UPN users, already in the Tenant using the Postman SCIM API.We can deploy with tools like System Center, DesktopCentral, or anything else for .msi files with UPN values. Everything's OK here too. We install, the Windows users of the AD domain start, and the UPN registration and enrollment are OK, as expected. Now, here's my big que

Are there any recommended guidelines to indentify and filter out known org AWS S3 traffic, and then enforce Netskope policy on only external S3 traffic? 

When creating a coaching policy, when the user enters a justification reason, where is this captured in the admin portal?

ObjectiveThe combination of English characters and other special characters is treated as a single word. Netskope Regex does not support detection when English characters are combined with uncommon symbols, even underscore, and the specification of Netskope Regex rules remains unclear. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can validate this issue by adding an underscore (“_”) or random characters after the English keyword they want to detect, as demonstrated below. Do You Know?Users can easily bypass Netskope’s DLP detection mechanism without even decomposing the keywords. This means administrators will be unable to track or investigate potential data leakage incidents.We have requested clearer instructions on how Netskope defines Regex rules, but so far nothing has been provided. NotesWe’ve discovered that others have already raised si

From this article, it mentions the feature flag Netskope Entity Modifier. Could you clarify the difference in behavior before and after it is enabled?Note:Can we suggest allowing a longer period for comments on articles? Otherwise, we have to create a new article just to ask follow-up questions.

I used the locally installed Postman application to send API POST requests with test data to evaluate whether Netskope could detect them. While SkopeIT is logging the events, the policy doesn't seem to be triggering, and I’m unable to view the actual data being transmitted in the API request. Has anyone encountered this issue or have insights on what might be going wrong?  

Hi,I have integrated a Syslog SIEM with the Cloud Exchange Log Shipper module, and everything is working fine. However, in the mapping file pushed to the SIEM, I’d like to include the User Group information from the alerts/events, and I can’t figure out how to do that.When I check the Mapping File Wizard to edit an existing mapping—or even when creating a new one—I can't find any “Netskope Field” that corresponds to the User Group attribute of the generated alerts/events. I need to send that attribute to the SIEM.Does anyone know how I can map it?Thanks in advance.Regards