Product Forums

However, if the Netskope client is active, and the user is on the company's network (without being on the vpn) the site is accessible.It also becomes accessible by disabling the Netskope client, and leaving and rejoining the VPN after disabling. We have already forced traffic through NPA Does anyone have any idea what might be going on?Encountered a file package download error nsUtil Failed to auto detect proxy or download PAC file, error 12180

Github retroactive scan only supports last 10 days of commits in the default branch. What is the reasoning behind this limitation? Are there intentions to expand this capability? Thx

Recently, Okta acknowledged a breach where attackers were able to gain access to customer session tokens, and other sensitive data through HAR captures in their customer support system.  Attackers were then able to use the unexpired session token to access the Administrative API in the customer’s Okta tenant. The Administrative API was accessed via the browser which only requires a session token or cookie unlike the typical approach using a bearer token.  In this case, the attackers were able to gain the initial access to the customer support system via an employee syncing a service account password to their personal Google password manager.    Netskope customers can address and help prevent such exploits through a multi-phased approach. Let’s take a look at the first phase.   Phase 1:  Controlling Personal Google Account Logins Netskope was initially built as a Cloud Access Security Broker (CASB) with an inline proxy capability.   This background pro

Has anyone used the edm automation script that was talked about in conjunction with DLP 2.0? I've seen it referenced but i can't seem to find how to execute it. I have a daily edm file that gets uploaded and i'm looking for the best method to automate the request-ppd upload process.

Hi Friends- can we utilize endpoint dlp in netskope to inspect/allow WIFI printers .

He is what I understand: During the summer, Netskope implemented a change to address a problem when companies merge.   Apparently if two companies merged but two computers had the same hostname (?) they would have duplicate client ids.   I typically run a report of a month's worth of devices when we upgrade versions.  I run it daily to watch the increase, watch to see version change over time, and to find orphan machines that refused to upgrade their version. After the change, I immediately noticed about 2X the number of computers I have.  It turns out that in addition to changing the ID, they also changed the download options, where before it had dialog option to choose whether you wanted everyone that has logged into a machine or just the last person, now there is no option.  So now when downloading the list of machines, one to use Excel to deduplicate hostnames.  But it still isn't a good solution, as you don't necessarily get the right last reported date. So far Netskope's response

Tired of outdated VPNs? Discover how to make the leap to Zero Trust Connectivity from a Netskope customer! Jeff Wehrman, Sr. Staff Cybersecurity Engineer, at Dexcom will share how he successfully retired their VPN with ZTNA Next in this webinar.   November 15th - 8am PST November 16th - 3pm AEDT   What you will learn: Hear about the major ways that remote access has evolved over the past three decades Learn deployment lessons from a Netskope customer who has successfully retired their VPN Witness Netskope ZTNA Next in action with a live demo

Summary With release R99 Netskope introduced a new feature “Periodic Validation on Device Classification” which is very important to enforce Zero Trust principles. Before that release, Device Classification of the client was only accomplished, when client service was started. With the new feature a validation interval can be configured for more frequent device posture checks. Requirements: NS Client version R99 or later is required. Please contact your Customer Success Manager, Netskope Support or your Account Team to get this feature enabled.  Today this feature is disabled by default!   Tenant Configuration Device Classification Profile The “Device Classification Profile” is a policy about a single or multiple checks, whether a device is compliant or not. This part of the configuration has not changed and will not be covered in detail in this post. Here is the link to public documentation. For testing on Windows a simple profile can be created to check if “notepad.exe” is

Dear Friends, Good Morning! Can somebody tell me how to remove the Netskope client from a Mac?We are unable to uninstall it from the application list, therefore please advise whether there is another way to uninstall Netskope agent from a Mac workstation, such as a command or script.

Suppose we have two gateways i.e SWG and NPA gateways and both the tunnels are established between respective gateways and the client. How does Netskope client understand where the traffic should be routed?  

Hi,  We have a real time policy to trigger alerts for any DLP violations for Chat & Other IM Categories. We have however not been successful in getting any alerts with DLP profiles on. I would like to know if DLP works on Telegram and Whatsapp for users that's accessing these apps via browser. I have noticed from the CCI that some of the activities are not supported. Happy to hear your thoughts on the same if you had a similar use case. Thanks!

Recently observed that Android Studio Issues on MAC devices even after exempted Android Studio from Netskope Proxy. Users using Android Studio are not able to connect to devices on wifi in the application. Is there is any issues with Android Studio with Netskope for MAC devices. 

We have an internal AWS hosted app, thats not reachable from the internet, and we need to provide access to an external partner that doesn't have the NS Client. Can I use NPA and configure a new private app with Allow Browser Access enabled to do this? Or, what are other good options? Thx

Hello Team, Users can't use the NPA Application when the DNS server is set to IPv6. It appears that NPA can't work with IPv6 DNS queries to match the SRP installed. I found some community posts for MAC OS where users recommended turning off IPV6. Does NPA work with IPV6 DNS servers, or are there any limitations?

Hi, I am facing some issues  with Git-hub download activity controlChecking here if anyone have an experience who can put some light and help to find solution Our requirement for Git-hub realtime protection is :-User allow to view any files (any file type)User allow to click on “Raw” and view the details of that fileWhen user click on ‘Download”, this activity should get blocked. Issue :-When user click on ‘Raw”, it is showing activity Download in the Netskope logs and getting blocked. I have checked the logs for both the activities ( when click on Raw Data or  Click on Download ) showing as Download. Any way we can only block the actual download action ( not when users are clicking on Raw data). Thank you in advance.Regards,Kunal Gandhi

Anyone using the new SMTP DLP functionality? If you are, how are you doing your alerting to users about blocking/intercepting emails? 

I really like the ability to now easily see all identified app instance in SkopeIT -> Applications -> Instances. However, not having the ability to export the list as a CSV is frustrating. Is this option coming soon? Thx.

How can I deploy clients on Mac devices using Sure MDM? I looked for documentation but didn’t find any.

Netskope SaaS Security Posture Management (SSPM) is a powerful, highly customizable platform which brings the security configuration and asset management of your entire SaaS portfolio under one umbrella. In our series of articles within the Netskope Community Site, we showcase some powerful capabilities and use cases to take your posture management to the next level.   In this article, we show you how you can use NGL to traverse the graph structure we use for modeling supported SaaS platforms to address advanced use cases for security, compliance and monitoring within your environments. The article is intended for a Google Workspace security administrator who has already onboarded their tenant to the platform and has an elementary understanding of how the Netskope SSPM platform works. For more information on how to get started with using SSPM with Google Workspace, you can view our earlier article on Securing Google Workspace.   Consider a User within Google Workspace, who is

I'm trying to build a module (currently just playing with locals directly in main.tf) which will build an instance of a private app. for each DC and tie it to the local publishers in that DC. That part is working, but I am failing to also tie the protocols fields correctly in and iterate over those as well, as the attached code will fail if either of the protocol ports fields are empty (in the case where an app only has tcp or udp ports defined). @sshiflett ?

 If you are deploying Netskope SMTP Proxy few notes of interest. (Various screenshots of interest attached). 1. If your upstream has SPF check ensure to add following record to your DNS server  so that the SPF check does not fail _spf.goskope.com 2. To allow Netskope IP's refer to the following list 2.a If you are using Proofpoint as the upstream MTA there is a tweak to allow these IP's.Proofpoint does not accept CIDR ranges. Also adding in CIDR notation e.g. /24 did not help in my case.Use the following format (first 3 octets only) (screenshot attached) 163.116.1288.36.116 NOTE: for complete list of IP's subscribe to this article. There is a table for SMTP Proxy "Netskope Email DLP (SMTP) List for AllowlistingThe following list of IP ranges represents where SMTP traffic may egress from Netskope's NewEdge Security Cloud, and should be used for permitting traffic with upstream email providers. Netskope's recommendation is that customers' add all IP ranges when configuring allowlisting w

Hi,I'm trying to use the REST API V2. All the documentation I find refers to two REST API options in the Settings -> Tools menu: REST API V1 and REST API V2.However, the Admin console shows (in Setting -> Tools) only one option: "REST API".Is this the REST API V2? If so, where is the Swagger API Documentation (https://docs.netskope.com/en/netskope-help/admin-console/rest-api/rest-api-v2-overview-312207/#swagger-api-documentation)?If not, then how can I create a Token for using REST API V2?Thanks!  

Hi Folks,We have a few users that have real difficulty with reestablishing connectivity via netskope when their macs come out of sleep/hibernate. The common thread between them is that they are also using dongles with ethernet connections to the internet. One fix that appears to help some users is turning off IPV6 ( changing to link-local) on any ethernet dongle that is attached. Curious if others are seeing this issue. Thanks!

Has anyone have a setup where you roll out Netskope client to all your endpoints and configure Azure AD conditional access to allow connections to Microsoft services if they come via Netskope IP? we are doing this as part of our own ZTNA setup to only allow trusted devices/location.  The setup works well with one minor problem. Netskope will have occasionally tunnel down/up (e.g. switching from LAN/docked to Wifi, etc) and that causes netskope to disabled momentarily before re-enabling again. (which means momentarily it shows attempting connection from non netskope IP) This then lead to services e.g. teams, outlook etc require authentication immidiately which is not the best end user experience.  Has anyone encounter this and able to suggest solution/workaround? I dont want to change trusted location to country based as that defeat the purpose of the ZTNA we are doing.

Can anyone else confirm? It seems starting yesterday anytime you interact with ChatGPT with Netskope enabled (steering and decrypting) you get the following attached error. Using a Do Not Decrypt rule fixes the issue.