Product Forums

Hello all,I wanted to ask if there is any way to configure Netskope to block all DNS revolving of public DNS namens by default?We want to manually specify a list of FQDNs or Domain-Wildcards to be allowed to resolve (ie. *.teams.microsoft.com or dns.msftncsi.com). We saw the option to Blackliste a FQDN or Domain-Wildcard in the DNS profile but there seems no option to block ALL except of ... Best regardsStefan

I can't seem to figure out what happened but Youtube stopped being pulled into our unsanctioned cloud apps on 11/15. I tried watching a video and usually it appears in the alert right away but the only alerts showing up are from 11/15. Nothing changed on our end that we know of.

Hi Team we are try to install the NS client on Macos 12.3 Macbookpro via email. (POC)We install package successfully but we  tenant and G/w is not display in Configuration of NS client.Lookup the gateway and URL resolution is successful. in Nsdebuglog I can see :   

Does anyone currently send CPSM (CIS findings) over to ServiceNow? If so, I would be interested in hearing the experience, any lessons learned, and finally where in ServiceNow the data lands.

Good morningI need to install on my enterprise mobile devices the Netskope client.On these devices the Microsoft Defender client is installed with VPN already active.I noticed from the logs that the netskope client fails to hook the Vpn because it sees the Defender VPN tunnel already activeCan any exceptions be set so that the two tunnels are active?Thanks

Hi People, I have configured and pushed my client in idp mode via jumpcloud idp and mdm solutions in windows, mac and linux OS. The Enrollment dialog box is popping up even after user closes it which is the expected behavior and it's working fine in windows. But for linux and MacOS if the user closes it, it doesn't automatically opens up again breaking the enrollment flow. Is there any way to fix this behavior for linux and MacOS?

Godaddy email synchronize mail - users / groups accounts  Hello good afternoon community, thank you for your collaboration and your time.I have a couple of questions: 1.- I have out there some possible client prospect that has his email accounts in Godaddy, is it feasible to synchronize the Godaddy users/groups directory to have those users/groups in netskope for use in the policies. 2.- For the Godaddy mail as such both example the Web/Cloud access to the webmail, as well as the Godaddy mail configuration in example outlook client desktop. Netskope covers this point, this protection ? what is the scope ? I have not found more information regarding Goddady for any of the 2 points. Please support me with your comments, your collaboration and your advice. Thank you Best regards

I am facing issues while attempting to block WhatsApp. I have created a cloud app policy to block WhatsApp, and it is successfully blocking the WhatsApp web. However, on  WhatsApp application uploading is getting blocked, but I am still able to send text messages.Is there a way to block text messages as well? I haven't found any corresponding events in the Netskope logs for sending messages.

Curious about how to make the leap to Zero Trust Connectivity?    Discover the limitations of traditional VPNs and learn how to migrate from VPN to ZTNA Next from a Netskope customer—Jeff Wehrman (@jwehrman), Sr. Staff Cybersecurity Engineer, at Dexcom in this webinar recap! The recording, slide deck and a summary of the Q&A can be found below:   Watch on-demand   Q: Netskope is not a total replacement for VPN, which means not supporting server to client flow. How can we overcome this? A: You bring up an important point. Most ZTNAs do not support server-initiated but Netskope ZTNA Next supports both client and server-initiated flows. Q: When within your office, is Netskope Private Access (NPA) engaged or does it go offline? A: Short answer is it stays engaged. The Netskope Client, which steers user traffic, is always on whether in office or remote. It can be configured to steer that traffic to the Netskope Cloud or a local ZTNA Broker ad

However, if the Netskope client is active, and the user is on the company's network (without being on the vpn) the site is accessible.It also becomes accessible by disabling the Netskope client, and leaving and rejoining the VPN after disabling. We have already forced traffic through NPA Does anyone have any idea what might be going on?Encountered a file package download error nsUtil Failed to auto detect proxy or download PAC file, error 12180

Github retroactive scan only supports last 10 days of commits in the default branch. What is the reasoning behind this limitation? Are there intentions to expand this capability? Thx

Recently, Okta acknowledged a breach where attackers were able to gain access to customer session tokens, and other sensitive data through HAR captures in their customer support system.  Attackers were then able to use the unexpired session token to access the Administrative API in the customer’s Okta tenant. The Administrative API was accessed via the browser which only requires a session token or cookie unlike the typical approach using a bearer token.  In this case, the attackers were able to gain the initial access to the customer support system via an employee syncing a service account password to their personal Google password manager.    Netskope customers can address and help prevent such exploits through a multi-phased approach. Let’s take a look at the first phase.   Phase 1:  Controlling Personal Google Account Logins Netskope was initially built as a Cloud Access Security Broker (CASB) with an inline proxy capability.   This background pro

Has anyone used the edm automation script that was talked about in conjunction with DLP 2.0? I've seen it referenced but i can't seem to find how to execute it. I have a daily edm file that gets uploaded and i'm looking for the best method to automate the request-ppd upload process.

Hi Friends- can we utilize endpoint dlp in netskope to inspect/allow WIFI printers .

He is what I understand: During the summer, Netskope implemented a change to address a problem when companies merge.   Apparently if two companies merged but two computers had the same hostname (?) they would have duplicate client ids.   I typically run a report of a month's worth of devices when we upgrade versions.  I run it daily to watch the increase, watch to see version change over time, and to find orphan machines that refused to upgrade their version. After the change, I immediately noticed about 2X the number of computers I have.  It turns out that in addition to changing the ID, they also changed the download options, where before it had dialog option to choose whether you wanted everyone that has logged into a machine or just the last person, now there is no option.  So now when downloading the list of machines, one to use Excel to deduplicate hostnames.  But it still isn't a good solution, as you don't necessarily get the right last reported date. So far Netskope's response

Tired of outdated VPNs? Discover how to make the leap to Zero Trust Connectivity from a Netskope customer! Jeff Wehrman, Sr. Staff Cybersecurity Engineer, at Dexcom will share how he successfully retired their VPN with ZTNA Next in this webinar.   November 15th - 8am PST November 16th - 3pm AEDT   What you will learn: Hear about the major ways that remote access has evolved over the past three decades Learn deployment lessons from a Netskope customer who has successfully retired their VPN Witness Netskope ZTNA Next in action with a live demo

Summary With release R99 Netskope introduced a new feature “Periodic Validation on Device Classification” which is very important to enforce Zero Trust principles. Before that release, Device Classification of the client was only accomplished, when client service was started. With the new feature a validation interval can be configured for more frequent device posture checks. Requirements: NS Client version R99 or later is required. Please contact your Customer Success Manager, Netskope Support or your Account Team to get this feature enabled.  Today this feature is disabled by default!   Tenant Configuration Device Classification Profile The “Device Classification Profile” is a policy about a single or multiple checks, whether a device is compliant or not. This part of the configuration has not changed and will not be covered in detail in this post. Here is the link to public documentation. For testing on Windows a simple profile can be created to check if “notepad.exe” is

Dear Friends, Good Morning! Can somebody tell me how to remove the Netskope client from a Mac?We are unable to uninstall it from the application list, therefore please advise whether there is another way to uninstall Netskope agent from a Mac workstation, such as a command or script.

Suppose we have two gateways i.e SWG and NPA gateways and both the tunnels are established between respective gateways and the client. How does Netskope client understand where the traffic should be routed?  

Hi,  We have a real time policy to trigger alerts for any DLP violations for Chat & Other IM Categories. We have however not been successful in getting any alerts with DLP profiles on. I would like to know if DLP works on Telegram and Whatsapp for users that's accessing these apps via browser. I have noticed from the CCI that some of the activities are not supported. Happy to hear your thoughts on the same if you had a similar use case. Thanks!

Recently observed that Android Studio Issues on MAC devices even after exempted Android Studio from Netskope Proxy. Users using Android Studio are not able to connect to devices on wifi in the application. Is there is any issues with Android Studio with Netskope for MAC devices. 

We have an internal AWS hosted app, thats not reachable from the internet, and we need to provide access to an external partner that doesn't have the NS Client. Can I use NPA and configure a new private app with Allow Browser Access enabled to do this? Or, what are other good options? Thx

Hello Team, Users can't use the NPA Application when the DNS server is set to IPv6. It appears that NPA can't work with IPv6 DNS queries to match the SRP installed. I found some community posts for MAC OS where users recommended turning off IPV6. Does NPA work with IPV6 DNS servers, or are there any limitations?

Hi, I am facing some issues  with Git-hub download activity controlChecking here if anyone have an experience who can put some light and help to find solution Our requirement for Git-hub realtime protection is :-User allow to view any files (any file type)User allow to click on “Raw” and view the details of that fileWhen user click on ‘Download”, this activity should get blocked. Issue :-When user click on ‘Raw”, it is showing activity Download in the Netskope logs and getting blocked. I have checked the logs for both the activities ( when click on Raw Data or  Click on Download ) showing as Download. Any way we can only block the actual download action ( not when users are clicking on Raw data). Thank you in advance.Regards,Kunal Gandhi

Anyone using the new SMTP DLP functionality? If you are, how are you doing your alerting to users about blocking/intercepting emails?