Product Forums

Hello, Wondering what is the use case for DNS steering in Steering config and How does it differ from "Use publisher DNS" in PrivateApps.   

Good Afternoon folks We're pretty new to Netskope, so please excuse me if this is the wrong place for this question or if it's a particularly basic question, and we're going through the Eseential 8 security process at the moment. To that end, we're looking to prevent Admin accounts from being able to access the internet when logged into machines with Netskope installed. Is this something that Netskope is capable of? I'm assuming it's a policy that we can roll out to a created group of users? Thanks very much

Hello All,The following articles have come out re: Evasive Phishing that domain front-ends Google to protect potentially malicious or unintended traffic from being picked up by filtering or threat. The following articles address how this works:https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/https://www.malwarebytes.com/blog/news/2023/08/phishing-campaigns-found-to-be-using-amp-urls-to-avoid-detection This means if NGSWG can't categorize the URL is hiding in AMP then it will treat the site as categorized as safe (or likely safe) based on that it is hosted at google, not the real site of xxx.xxx (or whatever malicious site and path is included there). Examples:https://www.google.com/amp/s/xxxxx.xxxx/somesite.html or https://www.google.co.uk/amp/s/xxxx.xxx/badimage.img From a position of making sure this product is competitive in the market, there are some other vendor tools that can granularly expose this hidden URL and site an

We are looking to start using a knowledge sharing platform called notion.so. Does anyone have experience with setting up DLP on this platform?  I'm curious if I can just use the same web policies there.

I have a number- of applications where a corporate IP address allows access without authentication.  For the first 15 or so, we have been 100% successful in using the Forwarder back to corporate and then sending the traffic from here.  However, the most recent set, library resources works some days and don't work on other days.   Has anyone seen this behavior?  

Provisioning Users from AWS accounts (Customer manages AWS Amazon WorkMail, for their mail accounts - business mail service). Hello good afternoon, how are you doing? As always, thanks for your cooperation and support as always. I have a question, a customer X, has a mail service on AWS, no Azure AD, no local AD, no google apps. So he only has for his mail accounts AWS - Mail Account - Enterprise Service. Is Netskope compatible, for the moment I have not seen any document, do you know if it is compatible Netskope, to provision fianles users, users to Tenant, by SCIM, LDAP or IDP, against AWS, in order to provision users and groups ? Does anyone have any information, data or details regarding this scope of Netskope ? Thanks, I remain attentive Best regards

the way to see the Cloud exchange console is which? Should I open from any browser with the IP where the connector is located or do I have to do it on the client's server where the connector was installed?

I know it is not recommended to steer VoIP traffic to Netskope because it adds additional hops to reach the destination causing possible performance/audio drops.I tried bypassing MS Teams in the past in our environment and experienced slower speeds and conditional access issues. What would be the best way to bypass VoIP traffic on ports 3478-3481 to the authentication URL teams.microsoft.com with conditional access in mind?

Hi AllCould someone please shed some light on below queries, we are having issues with Prelogon Tunnel in our environment. Do we need to specify prelogonuser= argument during msi install with 105.0x?Since Client Configs does not allow  the use of same prelogin account in different Configs , what is expected behavior when different users associated to different client configs login to the perusermode configured machine? Would the prelogon account change to the one defined in client config pulled down by last logged in user?Especially when logged on users changing their AD passwords, they get the error  “Information could not be read from the domain controller”.Please adviseThanksParul

Has anyone been able to look for a specific google drive label (metadata) with an API policy using a DLP profile and then restrict/change access to the file? I feel like this worked a long time ago but we can't seem to get it going now.Essentially, when a user applies a specific label on a Google document (corporate google drive configured with API Introspection) we want to detect that label when the document is shared externally. The action will be to remove the external share.

I have a single publisher that I've configured and deployed as an initial investigation of the configuration.   Is there a recommended way of capturing all the customization that was necessary to get it working in our environment?   I can certainly go back through our support cases and gather them, but that would likely require applying the config modifications on each new host individually.   As we look to roll out a fleet of publishers, manually entering these configurations on each device could be significantly slow our rate of depoyment.

Hello folks, I hope you're all doing well with your schedules!I have one concern/issue with the o365 native iPad app.What is occurring here is that we have installed the Netskope client on the user's BYOD and the user is unable to login into their 0365 native apps on their iPad. When I checked Skope, it shows User Login FailedAnyone who has dealt with similar challenges or has suggestions about how to address them? Thank you in advance.

Hi Community Team, A DLP policy with PCI-DSS profile is placed as top-rule to identify sensitive information in upload & download activities. It is working as expected only with DOCX files. This policy is not working with CSV, TXT, JPG & PNG files. When uploading CSV/TXT files, the policy is not even being hit. I would like enquire with Netskope community if anyone has noticed such issue and how they fixed it. Thanks.

Hi Community Team,Working Scenario: When we upload or download sensitive data (Credit card, CVV & email) with TXT, CSV & DOCX files to Facebook & LinkedIn, then Netskope DLP is alerting fine with PCI-DSS, DLP-PCI & DLP-PII profiles.Working Scenario: when we type & send sensitive data (Credit card, CVV & email) in LinkedIn Messages, then that message is being alerted (fine). LinkedIn Message DLP alert is showing Activity as POST and Object type as Message.Failed: However, When we type & send sensitive data (Credit card, CVV & email) in Facebook Messages, then it is not being blocked or alerted. We are expecting the action to be POST and activity should be Message or anything. However, Facebook Message sensitive data share action is not visible in Application Events, Alerts and Page Events.Below screenshot is the policy. Has anyone noticed this issue? If yes, please suggest the fix.Thanks. 

We've had success implementing and increasing adoption of Private Access over the past 3 years.  But, 1-2 users weekly report Private Access going down.  Suddenly their Netskope Client stops routing network traffic including DNS and IP.  To resolve we uninstall and reinstall of the Netskope Client.  We have created several support cases but support suggests to uninstall and reinstall the Netskope Client which we deem a work around, not a fix.  Trying to determine if its something we are doing wrong or a problem with the Client. Anyone experiencing similar issues?

Hey,I would like to know if anyone has had any problems with netskope azure upgrade, improved through marketplase.I try to update and get a docker image error context deadline exceeded (Client.Timeout exceeded while awaiting headers)

Hi,I went to upgrade two azure publisher, and got a return of ne errorPublisher image update failed: status 1 existsHas anyone ever experienced this?

Hi,We are facing some issues while we remove the user from the proxy group due to some exceptions. The policies applied on user is not getting reverted back.All restrictions are still getting applied. As a workaround we have to uninstall the client software and reinstall the same. Is there a better way to do this.

I need to deploy a Publisher for NPA. I would like to know if I can use RedHat to install the VMware ESXi OVA.

VMWare's Workspace ONE platform enables IT teams to manage any app on any device by integrating access control, application management, and unified endpoint management. In this guide you will learn how to perform a completely silent installation of the Netskope Client for supported MacOS versions.   High-Level Process From a high-level, the process is as follows: Configure Device Profile to deploy Pre-requisites Configure Workspace ONE Sensor to push pre-install file Push Netskope Client   Before you start, make sure to have Access to a Netskope tenant. Access to a Workspace ONE tenant with Intelligent Hub licensing. A MacOS device running MacOS 11.x or newer that has completed enrollment with Workspace ONE and has the target user's e-mail populated accurately. Downloaded the attached .zip file and extracted the script attached to this post. Downloaded the desired NSClient.pkg file from the Netskope Support Portal (login required).   Now... onto the deploym

Did you know that you can use Netskope DLP Incident dashboard to manage up to 100 Incidents at a time?   -Incident Dashboard allows you to use SkopeIT query to find Incidents by status or date range or severity or even incident number. (Sample query at the bottom of this page)   -You can change status of all incidents displayed on the page at once (You can expand page size to up to 100 per page from the drop down at the bottom right of the dashboard) Steps to find and resolve multiple incidents:   1. In the incident dashboard menu click the "Filter Search" funnel icon. (this icon switches between normal and query mode)   2. Enter a query using the "in" operator as shown for 2 incidents below. You can also add a custom status for filter e.g. if you want to omit incidents with status 'Resolved - Policy Updated' from the search. Note that incident numbers are included in single quote separated by comma) SkopeIT query: (dlp_incident_id in ['863060765611108610','82034833

Hello, I am implementing a new proposal for Real Time Policies for Netskope, to follow best practices and reduce the number of polices to the minimum possible. Currently, I propose a structure similar to this (+ other specific policies of allow, block, dlp, threat protection etc..):Allow corporate App InstancesAllow "Sanctioned" AppsBlock not allowed CategoriesAllow allowed Categories But there are webpages that belong to a non-permitted category, but to which access must be allowed. The problem is they are webpages and not applications, I can't apply the "Sanctioned" tag. If I create a custom app with the URL of the webpage, it also does not allow adding the "Sanctioned" tag. What is the best practice recommendation to resolve the situation? I can only think of creating a new policy that is allow access to a custom URL List, but it doesn't seem like a maintainable option over time, if the URL list grows too much. Thank you so much!

Netskope Secure Web Gateway provides next generation secure web gateway (NG SWG) capabilities to prevent malware, detect advanced threats, filter websites by category, protect data, enable remote browser isolation, and control apps and cloud services for any user, location, or device. Netskope offers multiple traffic steering options to steer traffic to the Netskope Cloud: Netskope Client IPSec GRE Explicit Proxy Proxy Chaining For customers that want to leverage IPSec tunnels to steer traffic to the Netskope Cloud, Netskope strongly recommends the following:  Configure IPSec tunnels from the supported router/firewall to two different Netskope POPs (primary and backup). If the customer has multiple routers/firewalls then each should be configured with primary and backup Netskope POPs.  Configure tunnel monitoring by referring to the router/firewall configuration manual. Configure failover to backup tunnels to ensure minimal interruption in the event of primary tunnel failu

The Quick UDP Internet Connections (QUIC) protocol is a transport layer protocol created by Google.   If you are interested in learning more about the inner workings of QUIC, you can look at the Chromium Project.   Netskope recommends blocking QUIC to force a fallback to traditional HTTPS.  This allows for SSL inspection and applying Netskope’s activity, instance, and other advanced controls to traffic that would traditionally utilize QUIC.  In most Netskope configurations, no additional configuration is required.  See the sections below based on your Netskope deployment.    Client Using Secure Web Gateway, CASB, or Cloud Firewall Steering No configuration is needed in most cases. The Netskope client will automatically block QUIC traffic from the “google chrome” and “google chrome helper” processes on Mac and Chrome.exe processes on Windows.  The Netskope client also blocks QUIC from other common browsers such as Edge and Firefox.   &nb

Hi Everyone, Am wanting to enable CRL Checking of device certificate for Pre-Login tunnel.  I want to ensure the CRL in the certificate of the connecting NPA client will be available for verification but I'm unsure of the source doing the verification. The docs are not detailed enough. Where will the CRL Checking request originate? Will it be our management plane or the one of the many NPA Gateway's the client may connect to or some other component (eg. Stitcher)? Thank you