Product Forums

Where is the recommanded location (DMZ or Server zone) to implement the publisher in the firewall protected environment? All the port need to be opened to the back-end servers on the firewall?is the traffice flow is correct?End-users → tunnel  →  publisher -->(open all required ports on the FW ) → App servers

We have been leveraging the inline DLP policies for over a year, and have struggled to “tune” the policies for false positives for PCI, PII, GLBA rules. Curious for feedback from the community no how you tune your rules/classifier etc to weed out false positives.. Our current route/solution we are looking at is excluding “sites” that generate the majority of the false positive hits. Example: Walmart is notorious for flagging carts with Names of brands next to the item number for SSN & US Names..Any and all feedback is welcome - thank you so much in advance!!

Re: Support Case00347414 I am having issues with Facetime when Netskope is enabled. I am steering "All Traffic" I have created a certificate pinned app for the facetime process and bypassed * all domains from steering config.  Whether this cert pinned app is enabled, or not - the issue persists. I have ALLOW-ALL rules set for cloud apps, all web traffic, and cloud firewall. I also have numerous Apple domains set to Do Not Decrypt in SSL Decryption policy.  Looking for assistance from others who may have encountered this in there deployment.  @sshiflett any ideas? NS Debug Logs with Cert Pinned App disabled: 2023/11/20 11:36:43.519144 stAgentNE p2668 t18363 info tunnel.cpp:873 nsTunnel DTLS [sessId 120352348] Tunneling flow from addr: 1.0.0.1:51979, process: facetime to host: gateway.icloud.com, addr: 17.248.193.19:443 to nsProxy 2023/11/20 11:36:43.652241 stAgentNE p2668 t9523 error nsClientFlow.mm:200 nsClientFLow Find UDP flow id

Hi there,We have created apps definition with FQDN and PQDN, but we are able to access the application with FQDN and not with PQDN. We have DNS Search Domain update from DHCP which is correct domain and also edited the 51-cloud-init.yaml  file with the correct domains in publisher. But still access with PQDN doesn`t work.Does anyone has any idea what next can be done? I have already raised Netskope Support, but would like to quick resolution if anyone has faced this issue.

I am looking for thoughts on if people have enabled the setting in the Client Configuration for Perform SNI (Server Name Indication) check ?    We are migrating VPN technologies and have noticed some traffic occurring outside of the Netskope tunnel when we do not expect it.  We believe this setting to be the reason as it indicates that the initial three-way handshake for traffic occurs outside the tunnel to retrieve the hostname.   Additionally we have several third-party applications that we use Source IP allowlisting with and believe that this may be causing issues with some of those as well.   This was enabled (I believe) during our initial configuration and now want to gather pros and cons of having it enabled/disabled?

Hi guys! Just a quick question since a requirement from senior management just arrived:Is it possible to filter (allow / deny) web traffic to google workspace services based on domain or tenant id?The idea is to allow only some tenants or domains to access google workspace resources (and denying all personal services) via SWG configuration. Best regards to all!

Netskope is not compatible with Google or Cloudflare public DNS servers (8.8.8.8, 8.8.4.4, 1.1.1.1). This is well known and prevents resolution by NPA for all our configured private apps. Based upon our testing (and trial and error) the following public DNS servers are working with NPA for our users and we must update our fleet of Macs as needed.Comcast (Xfinity):  75.75.75.75, 75.75.76.76AT&T:   68.94.156.1, 68.94.157.1Frontier:  185.228.168.168, 185.228.169.168Quad9 Public DNS Servers: 9.9.9.9, 149.112.112.112Fortinet Public DNS servers : 208.91.112.52 , 208.91.112.53 I would like to suggest Netskope maintain a list of known good public DNS servers that work with NPA. This would include updating the list when necessary, due to services not working anymore, etc. In a Work From Home (WFH), traveling, or foreign work force environment, we consistently run into problems with access to private apps due to this issue.   As a final resol

What is Azure Private Endpoint? Cloud Security Architects often make use of “Azure Private Endpoints” to enable access to Azure PaaS services. There are many Azure PaaS Services that supports Private Endpoints e.g., Azure Storage, Azure App Services, Azure CosmoDB, Azure SQL Database, etc. This eliminates the need for the service to be publicly accessible. Access to these private endpoints use Microsoft backbone network without ever going over the public Internet. Private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.   When you bring your Azure PaaS services into your private virtual network all traffic to the service is now routed through the private endpoint and traffic remains on the Microsoft global network. In this architecture and design,

Hi What is your best practice?  Do you block ALL and allow as require? Or Allow ALL and block as require?How do I log all web access activity whether is blocked or allowed?  Eg, do a google search, go to new site, upload file to storage etc.  Do I need to write policy to do it? ThankMunster

In order to view actual policy violating identifiers such as SSN, Credit Card numbers, First / Last Names you must create a Forensic Profile on a supported repository such as Azure Blob, Sharepoint https://docs.netskope.com/en/netskope-help/data-security/forensics/

Hi everyone We are deploying single session Azure Virtual desktop and are in design phase where we will put the Ztna agent into the session host so user can have access to private network (on prem). The network infrastructure (in azure and firewall) already in place and our job is to installing agent and start testingWe would like to know any best practice of how ztna agent is working inside Azure virtual desktop, anything we need to consider? Also another challange we got with Ztna agent is that the Ztna team will also install the agent in our SoE laptop. That should be fine but we would need to whitelist all AVD gateway address .so that the AVD client can connect to Azure virtual desktop gateway in the cloud. So far based on microsoft article they recommend to whitelist all *.wvd.microsoft.com but the Ztna team is only happy to whitelist based on IP addresses which pose the risk as the IP address of AVD gateway will keep changing and we may run into the risk of Soe Laptop cannot conn

Hi I have issue uploading file to a storage site that has "Host Name Mismatch" error. Further troubleshooting, it was related to "Security Cloud Platform-> Traffic Steering-> Steering Configuration-> MANAGE ERROR SETTINGS-> SSL Host Mismatch" which was set to "BLOCK".  Hence, a) Where can I find the 'SSL Host Mismatch" error in Skope-IT?b) How can I exclude this storage site from the above 'SSL Host Mismatch" Block setting?  Thank

Hello, Today I discovery a user executing a script to kill process Netskope.He´s Admin local of computer (Macbook). Exist some way of block this script through of panel?if [ "$EUID" -ne 0 ] then echo "Please run as root" exitfiNETSKOPE_PIDS="`ps aux | grep -i /opt/netskope | awk '{print $2}' | sed '$d'`"for line in $NETSKOPE_PIDSdo kill -9 $linedone 

Hi,Not sure if there's already a similar question posted somewhere, In the Administration > Audit Log section:When clicking on the gear, the options to select are "User, Severity, Activity" .  There is no option to show comments/notes entered for a specific activity logged. Is there a way to add another column in the Audit Log that can show the comments that were entered when adding/modifying a policy/persona/rule?  It seems odd that while add/changing/modify/removing a rule/policy, you're prompted to add (which is optional) a comment/note before saving/applying a change to an activity performed but never can locate or view the comments in the Audit log.Are the comments details located in another section of Netskope? Are they retrievable?  if yes, will the notes/comments still be linked to the very activity event that was performed at the time when the comments were entered? orIf not, could this be a consideration as an additional enhancement in the next release/upgrade/patch to the

Hi I saw this KB Alert/block upon detection of password protected files - Netskope Knowledge PortalHow can we set "user alert" action for coaching? thankMunster

Hi User can only access corporate M365 tenant. To prevent data leakage,  we will like to block M365 non-tenant access such onedrive, sharepoint, email, etc?  How can I do config it? thankMunster

Hi There are predefined list such as abortion, etc.  How can I block domain that has NOT been category yet? thankMunster

I'm having trouble accessing Nginx locally, which is running with Docker and Netskope client enabled.I need to use the Nginx Docker image for development on some machines; however, when the Netskope client is enabled, I can't access the web server via http://127.0.0.1:8080. When I disable the client, access works fine. Has anyone experienced a similar issue?

We block the download of certain files, such as msi, and exe.  Microsoft delivery optimization uses random IPs within the URL to download these updates, and some IPs might not even be owned by Microsoft.  Below is an example of a download: 151.139.71.28/filestreamingservice/files/814b848b-a4e4-48f7-9dc0-b18b57f6c9f3?P1=1707275479&P2=404&P3=2&P4=XS3dTPEuizRfF1O1rjyxG4xt4%2f7vGGgU0h4OKnajgEDC0tollwGtN5fmEf1kuPFohFTDKuVPTCg9zrAoEck6sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.comWe would like to include a regex or some sort of wild card to allow these.  The URL always seems to include: delivery.mp.microsoft.com When we allow URLs, we add the URLs to a URL list, which is tied to category.  I see we can use regex, but I am not certain if the URL needs the hostname???  I am also not sure how the regex would look.  I opened a case with support, but they referenced me to regex101 website, but that was really it, so hoping the Netskope community might be able t

Can we allow only specific URL and block every other web application in browser using NG SWG solution??If yes, how do we set a policy??

I understand the underlying premise for Netskope's recommendation for blocking DNS over HTTPS, to mitigate exfiltration risk, etc. However, with the industry push to move to DOH, won't we need to allow DOH traffic at some point? Most of our users browsers are configured to try DOH first, and some of them seem to be running into issues if DOH is not available and falling back to traditional udp 53 fails. I also don't understand why Netskope says they don't support DOH traffic steering. (See https://docs.netskope.com/en/netskope-help/data-security/real-time-protection/best-practices-for-real-time-protection-policies/best-practices-for-utility-policies/#recommended-utility-policy-2-1) It would seem Netskope DOES support it since we ARE steering DOH traffic to Netskope, Netskope identifies the DOH traffic, and then blocks it with the Block DOH real time protection policy. So what does Netskope mean when they say "DNS over HTTPS is not a supported protocol for Netskope steering (C

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You

Hi Team,We configured DLP for all categories with PCI and PII DLP. However, on netskopesecuritycheck.com, DLP PCI and PII block tests are failed. Has anyone had success with these tests? Can you please share the DLP policy configuration that has passed?  Thanks & Regards,Indu

This content can be found on the Netskope Support portal https://support.netskope.com/s/article/Blocking-Microsoft-Co-Pilot

Hello group, I am new here, I did a search but did not find what I was looking for. Question: Any documentation on how to properly implement in the CASB section for Office 365? We want to eliminate or reduce the number of blocks we are seeing from attempts to update Office. It hits different sites out of the United States. (Policies, Real-time protection, CASB section) Thanks,