Product Forums

Hi, we are stumbled upon a use case where when a user is presented with justification reason box for "Policy Violation" they are required to input the reason and this should generate an email notification to our dropbox that will generate a ticket in our ticketing system (connectwise)  However, even though we configured the ticket orchestrator on cloud exchange we are able to get the "alerts" with the help of plugins notifier, netskope ITSM CTO's. This set up is not creating any tickets as you can see from the screenshot attached.  We are looking for a way for the users when they justify the reason to use blocked page, this should generate an email notification to our dropbox. We have tried adding the email to the individual policy email notifications but this does not provide us with user justification reasons.

Hi Team, Greeting  We are having a customer requirement regarding an Private application/Custom Application which SaaS based application. Like HRMS so I need to know the R-proxy part as the we can able to done reverse proxy in NG-SWG as client want a visibility to there pvt app/custom app for unmanaged user accessing the Application. I got confused a little bit here. Does R proxy able to support the custom or pvt apps or just support the known business' usage application in R proxy like 0365 Gsuite. Salesforce etc. Can i do reverse proxy integration with Custom apps and Pvt app we approaching the NPA CASB but due to some commercial they want to try it on NGSWG. 

Doubts with NPA Web browser Private Access - SAML Azure AD Hello community, as always, many thanks for your comments, advice, recommendations and your time.I have currently configured in our Tenant for user synchronization with SCIM, from Azure AD and I have SSO for Admin console access, using Azure AD, everything work OK. Now I have a huge and big doubt, I understand that for user Private Access via Web i.e. Clientless, a SAML - Reverse Proxy account must be configured. That's my big doubt: I am looking for documentation that supports this configuration, ie Private Access Web browser access with SAML - Reverse Proxy with Azure AD, but I have not found, I have only found for Okta, among others, but with Azure AD nothing. Configure Browser Access for Private Apps:https://docs.netskope.com/en/configure-browser-access-for-private-apps-378561.html#:~:text=for%20Private%20Apps-,Configure%20Browser%20Access%20for%20Private%20Apps,-Browser%20Access%20is Reverse Proxy:

Context: Next Gen APIs and Retro Scans   If you haven't noticed yet Netskope is adding more and more apps to the Next Gen API Platform. One of the greatest advantage it comes with is - Decoupling of your ongoing scan policies from retro scans. New way to do retro scan is to create a Retro Scan Policy Group. Now you can add multiple API-Enabled Protection policies to a single retro scan policy set and scan entire group with click of a button. Definitely a better way to do the retro scans.   Retro scans are now separate from ongoing policies. In the classic version you need to select an existing policy and start Retro Scan for the respective supported SaaS app. This decoupling makes sipping through SkopeIT alerts more effective. You can start retro scans in set of policies instead of individually scanning API-Enabled Protection policies one by one.   Just keep in mind that you need to create that first time API-Enabled Protection policy and add to the next-g

Hello, Can I generate a report containing file movements (eg Google Drive CASB API) and also display the full path of that file? In Netskope IT -> Application Events it only shows the objects (files). It does not show the full file path. Thanks!

Netskope Private Access- Client Update config time interval Hello good evening, I hope you are all very well. I have a question, I have been searching and I have not found anything regarding the autoupdate interval of the Netskope client configuration, when changes occur e.g. changes at NPA level, e.g. new Publisher, new Private apps, private access policies. I have even been timing, because I understand that this is not 100% manual or yes ?. Could you tell me automatically when it takes the client to automatically perform the udpate of the config, when there are NPA adjustments. I have been timing the client, and in 35 minutes elapsed the client still does not update the NPA config by itself. Thank you, I remain attentive Best regards 

Hello Members   Need a help.   if any user is facing internet Speed issue or slowness issue.  what might be cause..? Any specify troubleshooting for that..? .

I am following the steps in the documentation to make apps available from the browser.Configure Browser Access for Private Apps (netskope.com)If It uses standard port 80 it seems to work but 443 or any other port I get this error message.Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

Hi All, I would like to initate a discussion on better DLP for Adoble product lines, and I believe many Netskope users here in Technology or design industries may have similar concerns.According to this article, to make sure licensed Adobe fuction correctly, we may need to allow many domains.https://helpx.adobe.com/enterprise/kb/network-endpoints.htmlHowever, a possible data breach may happen through these domain as well if we bypass all the listed domains from steering traffic, since a few are not restricted for enterprised-used.Has anyone successfully configured DLP policies for Adoble solutions?Ideally we would like to find a way to allow these domains for Adobe certification executable only, while still monitor possible file sharing or sensitive design files leakage scenarios.-AW

 When the client is installed, the end user is unable to reach certain sites like cisco.com.Meanwhile, no policies have been applied to the user.I was going to ask them to check their firewall, but this issue occurs even at home without connecting VPN.

A long time ago, Google applied for the .zip Top Level Domain(TLD) to ICANN and their application was granted. Recently, Google (Google Registry to be specific) announced that these TLDs will be available for use. These include domains like .Foo, .Zip, .Mov etc. Whilst they may seem innocuous on first glance, there is a big risk for malice when it comes to these top level domains. Let's say I write an email/blog/slack message that references a file abcd.zip. abcd.zip would never have been considered an 'internet bound link' back in the day.Of course, one ought to never blindly click on such links and ought to identify the 'linked' destination.<cough> Internet Security Awareness </cough>. But this is no longer the case with Google's announcement.  A threat actor could register the domain abcd.zip and point the file to a malsite abcd.zip, and subsequently, if a user were to click on such a link, trigger the auto download of a malicious file.This calls for enter

Is it possible to create a policy to block whatsapp .exe download?I created but I didn't succeed in the test.

Use NPA with logical condition Good afternoon everyone.Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type.Example:The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network.Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

Hi,Kindly advise me that we set "Exceptions" registration on certain IP,and the bypass setting seems working on TCP request, but UDP ones are blocked as below. [log said:]bypassAppMgrUDP.cpp:219 BypassAppMgr Blocking UDP connection from process: google chrome helper, dest IP:xx.xx.xx.xx(we set one on Exceptions) Do we need another setting on UDP? kindly advise me!

Hi all,   I have a customer that uses pac file mandatory, for users with the agent installed and users who don't have agent, and can't differentiate between them, therefore all the pc's use pac file.   With non-Netskope explicit proxies over ipsec, this pac file configuration does everything works ok. addon-customer1.goskope.com -> proxy*.goskope.com -> direct   When the proxy is a Netskope explicit proxy over ipsec, the agent is disabled.   Is there a way to change the behavior so that the pac file can coexist with Netskope explicit proxy ipsec without the agent not being automatically disabled?   Thanks!!  

Hi Netskope team, Congratulations on the leadership in Magic Quadrant in SSE. Please help me with my below query. As Netskope offers NGSWG, can you let me know the features of NGSWG provided in detail?As I know this includes WebDLP, URL filtering, SSL inspection, Authentication, and In-line CASB Content filtering. It's the combination of DLP SWG and CASB. Can you please let me know the limitations of DLP and CASB in NGSWG and the traditional SSE SWG and Netskope NGSWG?  

A Security Practitioner's Perspective Netskope Cloud Firewall Recommendations, Practical Advice, and Use Cases Background This document provides recommendations, practical advice, and use cases for Cloud Firewall (CFW).  When enabled in a tenant and applied to a steering profile, it will steer all traffic regardless of type-HTTP, HTTPS, and non-web traffic types. The non-web traffic includes TCP, UDP, and ICMP traffic.   CFW provides advanced security and access controls without the cost, complexity, and performance limitations of traditional firewall appliances. It accomplishes this through an integrated cloud-hosted firewall solution with granular control over outbound non-web traffic visibility.   It provides network security on outbound traffic across all ports and protocols for users and/or groups based on policy controls including a 5-tuple, fully qualified domains and wildcards as destinations, and an application layer gateway for FTP; the 5-tuple includes source

Private access - NPA Threat Protection Inspection Hello good afternoon, as always thanks for the collaboration, your time and good vibes.Reviewing the NPA topics, and validating to generate an NPA type policy, I don't see that it allows me to add a Netskope Threat Protection profile. For example if I have at NPA level, some SMB type access, for shared folders against some File server, Storage or NAS, via the corresponding UDP/TCP ports used by SMBv2 and SMBv3 and I add them as a NPA type APP, at that point Netskope performs or not the inspection of that traffic flow? Netskope Threat Protection for NPA does or does not perform inspection of NPA/Private access APPs.I remain attentive Best regards

Hello community, how are you doing. I am running a test from my Netskope client, Mobile Android version. When I check the event logs of Page events, the following appears and I don't have any policy that generates bypass at SSL decrypt level or Real time rule.I'm testing and I don't see it blocking the sites that it does block in a rule with the client on a workstation, but from the Netskope Mobile Client on Android the following appears: Bypass Reason:Bypass_reasonSSL Do Not Decrypt Bypass Policy MatchedBypass Traffic:yesSrc Time:Tue Apr 18 20:22:00 2023Ssl Decrypt Policy:yesUser Generated:yesType:connectionPolicy Name:Default do-not-decrypt Android traffic for versions Nougat and above Are there any restrictions on client installation and use of Mobile Android ? Is there any extra step to do when installing the client on the mobile Android from the invitation ? The Android version I am using in the test is "11". According to the Netskope site it is supported.

Good afternoon all,   So I've made some great progress on getting netskope to run so I can access all my network resources etc when it's up and running. However I've run into an issue when it comes to doing a remote Hybrid AD join.   The application is packaged up and working   I can access my domain controllers when not on a VPN through netskope private access.   What I can't do at the moment is domain join machines remotely, is there a way that I can for want of a better word, bodge the install or configure it in such a way so I can open network access and then authenticate against my on-prem domain controllers? I read somewhere that you can use NSBranding.JSON or something to enable the configuration but I can't find any official documentation.   Thanks RGE_Master

Hello - We have configured steering exceptions for VPN gateway IPs, domains, and cert pinned app for the VPN processes so that Netskope will not impact vpn connections and works as expected when users connect to VPN. But after enabling private app discovery users are not able to connect to VPN gateway via VPN client and not sure what is causing problem. As part of App discovery configuration we added the company wild card domain and VPN gateway FQDN matches the domain. Did anyone face similar issue before? If yes can someone provide guidance on this issue? Thanks

Hi, We are currently in the process of setting up a new netskope installation for private access and DLP. Things a re going fairly well and most stuff is working. We have a lot of devs in our organization and a lot of them use WSL on windows for things like their buildtools and docker etc. What we have found is we have to install the netskope linux client in WSL for it to be able to get private access. This is in addition to the windows client. Although this is logical as wsl is a hyperv vm underneath the hood, its far from optimal. Has anyone else got and alternative ways of doing it?ie can the windows netskope client provide a proxy we could define via the https_proxy variables etc? 

Hello community the new ZTNA NEXT was announced. Does anyone know the release date yet?how can we test it?Will it be a separate license?need to change the topology?

Hello all, I considered posting this here since my comment in the following post might be not seen:Netskope DLP use cases for ChatGPT - The Netskope Community We found the reason DLP is not working for chatGPT.ChatGPT input is sent as a HTTP POST, sending the message inside the JSON payload.The problem comes when the input text contains newline characters.Nweline characters are sent as ' ' and Netskope does not treat these as newline but as a literal '' and an 'n'.This means if I send for instance a list of card numbers or SSN numbers as follows:132412341234132412341234 What is being actually sent is "132412341234 132412341234".Netskope sets implicitly word boundaries to entities, this means word boundary characters (dot, coma, semicolon, whitespace, etc) must be found before and after the sensitive data to match. Considering the format the data is sent to chatgpt, what netskope sees is:"132412341234" and "n132412341234".Thus the second SSN numbers won't match beca

I was looking for anyone with experiences with converting over to SWG that includes the Epic (www.Epic.com).  Lessons learned, SWG implementation schedule, really anything.