Product Forums

How can I deploy clients on Mac devices using Sure MDM? I looked for documentation but didn’t find any.

Netskope SaaS Security Posture Management (SSPM) is a powerful, highly customizable platform which brings the security configuration and asset management of your entire SaaS portfolio under one umbrella. In our series of articles within the Netskope Community Site, we showcase some powerful capabilities and use cases to take your posture management to the next level.   In this article, we show you how you can use NGL to traverse the graph structure we use for modeling supported SaaS platforms to address advanced use cases for security, compliance and monitoring within your environments. The article is intended for a Google Workspace security administrator who has already onboarded their tenant to the platform and has an elementary understanding of how the Netskope

I'm trying to build a module (currently just playing with locals directly in main.tf) which will build an instance of a private app. for each DC and tie it to the local publishers in that DC. That part is working, but I am failing to also tie the protocols fields correctly in and iterate over those as well, as the attached code will fail if either of the protocol ports fields are empty (in the case where an app only has tcp or udp ports defined). @sshiflett ?

 If you are deploying Netskope SMTP Proxy few notes of interest. (Various screenshots of interest attached). 1. If your upstream has SPF check ensure to add following record to your DNS server  so that the SPF check does not fail _spf.goskope.com 2. To allow Netskope IP's refer to the following list 2.a If you are using Proofpoint as the upstream MTA there is a tweak to allow these IP's.Proofpoint does not accept CIDR ranges. Also adding in CIDR notation e.g. /24 did not help in my case.Use the following format (first 3 octets only) (screenshot attached) 163.116.1288.36.116 NOTE: for complete list of IP's subscribe to this article. There is a table for SMTP

Hi,I'm trying to use the REST API V2. All the documentation I find refers to two REST API options in the Settings -> Tools menu: REST API V1 and REST API V2.However, the Admin console shows (in Setting -> Tools) only one option: "REST API".Is this the REST API V2? If so, where is the Swagger API Documentation (https://docs.netskope.com/en/netskope-help/admin-console/rest-api/rest-api-v2-overview-312207/#swagger-api-documentation)?If not, then how can I create a Token for using REST API V2?Thanks!  

Hi Folks,We have a few users that have real difficulty with reestablishing connectivity via netskope when their macs come out of sleep/hibernate. The common thread between them is that they are also using dongles with ethernet connections to the internet. One fix that appears to help some users is turning off IPV6 ( changing to link-local) on any ethernet dongle that is attached. Curious if others are seeing this issue. Thanks!

Has anyone have a setup where you roll out Netskope client to all your endpoints and configure Azure AD conditional access to allow connections to Microsoft services if they come via Netskope IP? we are doing this as part of our own ZTNA setup to only allow trusted devices/location.  The setup works well with one minor problem. Netskope will have occasionally tunnel down/up (e.g. switching from LAN/docked to Wifi, etc) and that causes netskope to disabled momentarily before re-enabling again. (which means momentarily it shows attempting connection from non netskope IP) This then lead to services e.g. teams, outlook etc require authentication immidiately which is not the best end user experience.  Has anyone encounter this and able to suggest solution/workaround? I dont want to change trusted location to country based as that defeat the purpose of the ZTNA we are doing.

Can anyone else confirm? It seems starting yesterday anytime you interact with ChatGPT with Netskope enabled (steering and decrypting) you get the following attached error. Using a Do Not Decrypt rule fixes the issue.

Hi all,we are looking to deploy Netskope IOS app to allow access to NPA internal Apps.I'vedeployed the netskpope root/inter certificatesDeployed netskope appnetskope app configurationVPN config profile (for per app vpn)scoped required internal app to use Netskope VPN. the per-app VPN apps selected do not have connectivity using VPN until i open the netskope app first. This is what happens when the netskope app is opened, after this app is opened everything starts working.  Can we make the IOS netskope deployment zero touch?    

Can anyone provide information/documentation in relation to Netskope as far as "how it handles" or "what it does with" voice and video traffic?We have an ongoing discussion within our org and want to provide more insight/identify potential root causes for delayed call acceptance and/or performance degradation with regard to Netskope.

Hello Everyone,can you please guide me in enabling fail close even when client is not installed and access method is IPsec/Gre. what configuration i need to do on firewall in o

I'm using the Netskope Provider version 0.2.5 for NPA to query for a list of Publishers based on a site code.netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform RegistryAccording to version 0.2.4 of the provider, I can filter on stuff in the query:netskope_publishers | Data Sources | nets

It is recommended to ensure the Netskope Client is running the latest Gold Release.   Steps to Maintain Latest Release: Using Desktop Application tools like SCCM/IBM tools OR Use Netskope's Auto-Upgrade option to Latest Golden Release  

Netskope Private Access (NPA) is a Zero-Trust Network Access solution that provides seamless access for users accessing applications.  One of the Zero-trust capabilities within NPA, Periodic Reauthentication, is based on an integration with your enterprise Identity Provider (IDP) such as Azure AD or Okta.   This capability allows the Netskope client to challenge the user via your Identity Provider for credentials and MFA to maintain or activate access to internal applications.  Administrators configure intervals for groups or OUs based on the security posture required.  For example, the below configuration would require a user to authenticate to my IDP every 12 hours with a 1 hour grace period before access would be revoked: 

Hello,I am new user of the community and I need help. I´m using the Jumpcloud to login the devices in my company in MAC, Linux and Windows and need that the client Netskope already be installed logged in with the operating system user.Currently, I install clients via script on 1200 devices and I need to ask users to log in to the tool to activate it. I know that with AD is possible, but the Jumpcloud (https://jumpcloud.com/) not work as a domain controller.  Is possible?

Netskope Advance Threat Protection does have a sandbox/research feature to investigate files that are downloaded with a sandbox examination, amongst other things.  Having an alert later on that a file is malicious gives a reason for follow-up on that person/computer. They also have a policy suggestion, where novel files are not downloadable until after they pass a sandbox exception.  The devil is in the details "The Netskope advanced threat engines can take up to 10 minutes to analyze the file."  Also, in practice, if you the download just fails for 10 minutes of clicking on it, no pop-up warning you that it is in review. So I am dying to know - has anyone actually done this policy? I

Hi Folks,I have an Arch Linux device which we would like to get behind Netskope. The OS on this device can't be changed and while I am thinking we could take a few different options I thought I would have a crack at convincing the Netskope Client to work.It installs and enrols just fine, however, once running there seems to be an issue between the client and the stAgentSvc. The `nsclient` command will report unable to connect to service. Diving a little deeper with `strace` and I can see a connection reviews to the UNIX socket `~/.netskope/stagent/apps`, which would indicate the stAgentSvc is not in a good state.I have not been able to identify where or what might be the cause of stAgentSvc not working - despite a fair chunk of reviewing debug logs and strace output. Has anyone come across this problem on a Linux device before and resolved it?Thanks in advance for any help.

We are just getting started with the Advanced Analytics and one of the 1st reports we were asked to run is Top Uploads for the past 7 days.  Report ran great and is full of useful data.  One area I cannot figure out though is Uploads to YouTube.While I do not believe we have "content creators" uploading while at work, the data is still questionable.  Searching the web for info all leads back to uploading a video.  I did find YouTube does have tracking capabilities beyond cookies. Looking at just one user at our corporate office, showed only around 1Mb of data uploaded.   This is more inline with what I found online with the tracking.  The top user for the week was around 805Mb.  So not  “content creator” I would think, but makes me wonder just how much tracking is going on.This top user also had 60 hours of viewing time.  (To be addressed

Hi 🙂 In my laboratory I did the configuration to be able to resolve names.At first it worked, I was able to access the application by name/FQDN via HTTPS, network sharing and gpupdate. It stops working out of nowhere, sometimes when restarting the NPA it starts working again and sometimes it doesn't even restart. I stopped the service, stopped the process, renamed the logs folder, to only have new logs.I enabled debug, reproduced the error and got the logs.I found error message 11001 and several other errors.Has anyone seen this error? Any tips?

DC and DR internet links have been choked as there is a heavy utilization over netskope. we raise a ticket over TAC but no resolution found as per my knowledge user client traffic is acting as DPOP traffic where in we are not able to trace out this abnorml

The majority of performance related issues faced while attempting to leverage Netskope for visibility and control on conferencing apps is root caused to improper configuration of the web conferencing app best practices associated with the UDP traffic.   Why: UDP protocol is best suited for real time audio and video traffic If customer has not enabled the necessary UDP ports when on premises, real time traffic will fallback to TCP and steered through Netskope “Using TCP in a near congested network will cause retransmissions, which in turn can create a choppy video or low bandwidth error experience. UDP does not retransmit, and will provide a better video experience

Summary During certain troubleshooting situations, Netskope Support may request various debugging output from the Google Chrome Developer Tools (DevTools for short). Specifically, HAR (HTTP Archive) is a file format used by several HTTP session tools to export detailed traffic data for analysis. Environment Users experiencing cloud app page loading or performance issues while using a browser. Application access issues Reverse proxy (SAML/Auth).   Cause Netskope Support and Engineering require HAR debug output from the affected client to provide app traffic data for analysis.

Sonoma is coming out on the September 26th. Does Netskope have any statement on whether it is supported? If so, which version of NS client?  I have not been able to see anything here or the support portal. Thank you. 

Hi team,There is one use case of server where they required a PAC file to be configured in there servers to connect the netskope dataplane can you let me know any configuration or pre-requisites is required to server connect with Netskope Dataplane Also please let me know the use cases of static server which required internet.

Dear,Today I have two policies for using WhatsApp web, one for all employees to access and send written messages, but downloading and sending files is blocked.Second policy that is full.Today I release it via online account.What I need today is that only those who have a corporate cell phone can access this, using a corporate cell phone, from what I was able to search for by cell phone number, it is not possible to make this limitation, but I don't know if I can do it through the mac address of the cell phone from the device and so I no longer use the network account.Could you please help me