Product Forums

Hi There,  What is the recommended deployment method for Citrix XenApp / vApps where multiple users log onto the same server concurrently. (Multiple users sharing same IP)

Hi, I have the customer's Azure AD configured to allow admin access to the Netskope console via group membership, but all users who login have the tenant admin role by default. I know I can go in and change their individual roles manually but is there a way to create a new enterprise application that assigns the Security Admin role (or any other) by default instead? If so, can you please advise on the required config? Thanks.

Hi Netskope Community, I'm interested in obtaining further details about the processes required to differentiate between managed and unmanaged devices based on Netskope processes. My specific use case is that a device is considered "managed" when the Netskope processes specific to MacOS devices are detected. However, to proceed with the implementation, we must know the following details: 1. List of specific processes to be included. 2. The exact format in which process names for MacOS devices should appear (example: processname.format). 

Hi everybody, I'm interested in obtaining further details about the processes required to differentiate between managed and unmanaged devices based on PEM certificate for iOS Device and pair value-key for Android Device.  My specific use cases involve a device being considered "managed" when the certificate or this key-value pair is found by the netskope client. However, to proceed with the implementation, we must know the following details:Configuring iOS Devices with PEM Certificate - We are trying to configure managed iOS devices with a PEM certificate. I would like to know if I need to generate this certificate ad-hoc or if it is available on our MDM (Workspace ONE) or Netskope tenant. Also, I would like detailed instructions on how to configure iOS devices using Workspace ONE and on the Netskope console bas

Is it possible to use the option "re-authenticate for private apps" from CLI in linux?I know you can use the stAgentCli to check its status with show-pa command but I would like to make a command in my personal computer to auto-login into the vpn

Hi all, please to meet you! I'm configuring my Google Workspace to distribute the NS app to Android clients with a Managed Configuration to avoid that the users have to make manual configs.It works fine when, in the field "User Email Address" I insert a specific email but, if I leave blank or not configured the field, the app does'nt complete the config. Given that I need to distribute the same config to many devices, I would use a variable in this field, but I can't find the correct one. Is there anyone who has been in my situation and has resolved? Thank you

HiI have installed win10 agent in office thru our legacy proxy.    I can see that the network was steered to nsk when in office, however NPA was having error I have reinstalled, enable traffic bypass  in legacy proxy and firewall but the error persisted.  If I installed via public wifi, NPA was successful.What is the log I should start tracing this error?Thank

Is there a way to allow employees to access a blocked website if they enter a password ??For context:I have staff who work with vendors and when they go to specific websites they get blocked based on our policy.  Is there a way to allow blocked websites to be accessed provided employee enters a bypass password ? Is there a way to change that password daily.

Hello,Does anyone have an example in a Dictionary csv file to add to Netskope with keywords that you want to analyze?Thank you so much.

You're a big Sonos fan (like me), and you want to use the Sonos S1 Controller app, or the Sonos S2 app on your Windows or Mac machine with the Netskope Client. Well, you'll find it doesn't work without adding some Netskope Client steering exceptions... When you launch the Sonos app it uses broadcast addresses to seek out Sonos devices on the local network, it can use both 255.255.255.255 (network broadcast address) and also 239.255.255.250 (simple service discovery protocol - SSDP). So these addresses need to be added to a Network Location Profile: Netskope UI -> Policies -> Profiles: Network Location -> New Network Location -> Single Object (see attached screenshot) And you'll need to reference that 'Network Location' as an exception in your steering configuration(s): Netskope UI -> Settings -> Security Cloud Platform -> Traffic Steering: Steering Configuration -> [Your steering configuration] -> Exc

The requirement is :- User should able to access a corporate instance of Git-hub but not any other instance of git-hub. I have created app instance for a corporate instance of Git-hub and configured the policy to allow all activities.  2nd policy after that is to block all activities for the application Git-hub ( to match all other git-hub instances) with this, I am not getting an expected resultWhen user is accessing corporate instance, Netskope is showing Browsing activity and getting blocked in 2nd policy.I have checked the list of activities for app Git-hub but there is no Browsing activity mentioned Any expert comments and guidance here pls...  

I have a DLP policy looking for specific data objects in Github using a regex, but it is triggering on known test data. Any ideas on how I can configure the DLP policy to ignore my spreadsheet of known test objects? For instance create an incident for ABC123, but ignore ABC111. Thx

Would it possible to have a user click-thru policy in regards to PROPFIND (webdav) event traffic?

We've started noticing an issue with Winzip files downloaded from 3rd party web sites, where extracting the ZIP fails with the attached error message.    "Central and local discovery mismatch for file"  (example in attached screenshot)The zip can be successfully extracted if the Netskope service is disabled on the user's computer. 

We are trying in a couple of channels to get an answer, including our Customer Support Manager and our Technical Account Manager.We are a little stressed over the lack of details in the below announcement.For our purposes, it lists three nights of maintenance, but it was unclear what nights, or all of them we should be worried about NYC and IAD where our IPSec tunnels are connected.Has anyone gone through this before? Have they switched their tunnels in preparation?  We are only concerned with the NYC and IAD pops where our IPSec tunnels are connected, and would like to know if there is more specific detail available regarding those POPs and the times they may be affected, and whether or not an advance failover for us is warranted.Thanks, Service ImpactThe Netskope user interface may be unavailable for brief periods of time during the maintenance window. Customers with IPSEC/

Netskope Private Access now consumes NewEdge Traffic Management 2.0(GSLB) for optimizing the DC selection for Client as well as for Publishers. Customers can take following advantages with this feature,  DC selection is no longer DNS There is no dependency on Google DNS or LDNS for POP selection (the last hop recursive DNS resolver). APIs are hosted within existing allow listed NewEdge IP range, no additional network changes needed.  Improved granularity for geolocation of public IP egresses. DNS-based methods (EDNS/ECS0/Google DNS) can only utilize a /24 of the public IP. The GSLB service can better geolocate as it has the entire IP address /32 instead of a /24 advantage for gateway selection. DC selections according to geographic

  Netskope has various built-in (aka predefined) DLP identifiers to detect passwords, public keys, private keys and base64 encoded data.   While you can write a regex to detect passwords in your environment, I have highlighted some of the challenges here: Regexes can cause DoS and False positives (at a customer site who has a dedicated team to write regex their complain was email in a string being detected as passwords). There is no single password standard that would work for all the environments. The key sizes are varied length.   Best approach for a credential detection policy Use Exact Match capability to identify username of AD account exfiltration Use Netskope's built-in identifiers rather than writing complex regex. Use Custom Entity validator to validate your test data with a corresponding Netskope predefined identifier. Note:

Is there a way to setup a report or alert to capture devices that have not reported traffic in x number of days?It turns out that after an audit, we have quite a few agents where Netskope is installed but not steering any data to the our tenant.  We believe that in these cases the agents subsystems are not fully functioning. The users are not allowed to disable the agents. Thank you. 

Hi People, We have created a instance awareness policy to restrict user to block upload on personal google drive instances which is working fine on the browser but can't even hit the policy with google drive desktop application via file explorer's auto-sync. Below is the policy details: Please let me know what else is needed to be added here!!  

how do we segregate sanctioned applications from normal websites?As of now, we need to identify  unsanctioned applications installed on the User machine rather than they are browsing websites?

Team, I have a allowed users list for a SFTP application. Can we manage the SFTP traffic thru Netskope Proxy ? 

Hi Team ,    Can anyone help me the Detailed Architecture for NPA traffic starting from user device till it access the application including the auth type,Identification, Encryption , tunnel that exist all across the traffic flow.

Hello, We are using REST API v2 to get alerts. However, the incident_id value has an error. The last 3 numbers are set to 0. Example,Our incident_id on the netskope dashboard: 5590961107392419317. The incident_id using API v2: 5590961107392419000 How can we avoid this?

Hello, Has anyone had issues using comma separation in the referrer field of an HTTP request header? I attempted to use more than one URL comma separating them in the same field per NetSkope documentation, but it broke the URL that was already there and didn't work for the new one. I tried different variations with no luck. I had to create a new header profile for one url..  Any one else?

Hello all,I wanted to ask if there is any way to configure Netskope to block all DNS revolving of public DNS namens by default?We want to manually specify a list of FQDNs or Domain-Wildcards to be allowed to resolve (ie. *.teams.microsoft.com or dns.msftncsi.com). We saw the option to Blackliste a FQDN or Domain-Wildcard in the DNS profile but there seems no option to block ALL except of ... Best regardsStefan