Product Forums

Hi I am facing issue in my laptop having the Re-authentication for Private Apps feature enabled every 24 hours. Unfortunately there is no re-auth pop-up coming when these 24 hours expires. I have no indication from the Client whether I need to re-auth now to access the Private Applications. This is hindering my day to day work. I have also checked it with my other colleagues and facing similar issue.  The documentation says that "If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access" which is not happening. 

Hi everyone,I'm currently looking into possibilities that Netskope offers us to depreciate our current VPN solution. One of them being the Windows deployment via Always on VPN, I figured that the Pre-Logon NPA might come in handy. Unfortunately, I couldn't find anything regarding this in the docs nor the community forum.I'd greatly appreciate any help.Best regards

Browsers with Zero-Day Vulnerabilities ? What am I talking about you might think -   Well, it happened with Chrome recently -  for the third time this year - CVE-2023-3079  released earlier this month affects Google Chrome prior to 114.0.5735.110 by allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)    Sounds serious? Oh you bet - a CVSS Base Score: 8.8 HIGH is not something I'd want to ignore - NIST metrics below indicating a low level attack complexity is all you need to know here to ensure your fleet gets updated ASAP.

Managing security group configurations and maintaining tight control over organization relationships are critical factors in safeguarding Workday deployments from potential security breaches. Organizations need a comprehensive solution that not only enables them to manage user access efficiently but also empowers them to identify and address security compromising anomalies in their configuration. Among her many other talents, the Netskope SaaS Security Posture Management (SSPM) can help system administrators streamline security group management and detect policy violations within Workday deployments. With this article, we'll present a few practical recipes you can deploy with Netskope SSPM to monitor and harden your Workday deployment.   Unlike other solutions on the market, Netskope's

I am creating a DLP rule where I place the Post activity and the Block activity but it does not perform the action that is allowed, on the contrary if I select Teams there it does block the same policy.

Context: You have some users uploading sensitive data to Github. These smart users are avoiding detection by using non-text formats e.g. XLSX or docx. How to get alerted for binary commits on Github? Solution: Netskope next-gen Github API can detect and alert when a binary file is committed to Github. Create a very simple DLP rule that detects keywords for "Binary files". Call that into a profile and a Github ongoing policy. That's all that is needed. Here are the required screenshots showing how to create a DLP rule using custom entity with case insensitive keyword.  

Hi, I set up a new contingency publisher for the priv app, ran troublesshoint on the tool and everything is fine, no problems.But I can't access priv app,ran a curl , and got an http 500 return.We are not using DNS in the browser.Has anyone ever experienced this ? Or do you have an idea why?

Hey,Can anyone tell me if there is any limitation on the use of the NPA, number of users... traffic support.For a few days I have been experiencing a slowdown problem in the app and web after adding more users to the NPA.

As the AI wars heat up, Google is stepping up its game against OpenAI with the release of Bard. Google originally (early 2023) made it difficult for the average user to play around with Bard by introducing an invitation based system resulting in waitlists, again this was earlier this year when ChatGPT rocketed into the mainstream consciousness, but as it stands today, most, if not all Google account holders can access, play around, I mean, leverage Google Bard.   What are the risks involved for enterprises ? The reality is that it's not any different than the risk of using an unsanctioned app. I mean data exfiltration capabilities, privacy issues et al, makes Google Bard a veritable minefield for every security organization.   Google explicitly advertises Bard as way to make life simpler for software devs. This is the biggest risk I see for most enterprises whe

Hello!I´m preparing test environment to make support for Customer with Workspace One and Android Device.The applications installs OK! But the certificates is not present in the work "container". In personal conteiner, I installed the certificates manually from Settings (upload CA) and works fine with the browser  access (Tested with Deny Category, notifications show me this block)But in the work profile, this settings is not working.Does anybody knows how to install certificates with MDM WorkspaceOne in the work space? (container Work space) Thank you very much!

Hi, we are stumbled upon a use case where when a user is presented with justification reason box for "Policy Violation" they are required to input the reason and this should generate an email notification to our dropbox that will generate a ticket in our ticketing system (connectwise)  However, even though we configured the ticket orchestrator on cloud exchange we are able to get the "alerts" with the help of plugins notifier, netskope ITSM CTO's. This set up is not creating any tickets as you can see from the screenshot attached.  We are looking for a way for the users when they justify the reason to use blocked page, this should generate an email notification to our dropbox. We have tried adding the email to the individual policy email notifications but this does not provide us with user justification reasons.

Hi Team, Greeting  We are having a customer requirement regarding an Private application/Custom Application which SaaS based application. Like HRMS so I need to know the R-proxy part as the we can able to done reverse proxy in NG-SWG as client want a visibility to there pvt app/custom app for unmanaged user accessing the Application. I got confused a little bit here. Does R proxy able to support the custom or pvt apps or just support the known business' usage application in R proxy like 0365 Gsuite. Salesforce etc. Can i do reverse proxy integration with Custom apps and Pvt app we approaching the NPA CASB but due to some commercial they want to try it on NGSWG. 

Doubts with NPA Web browser Private Access - SAML Azure AD Hello community, as always, many thanks for your comments, advice, recommendations and your time.I have currently configured in our Tenant for user synchronization with SCIM, from Azure AD and I have SSO for Admin console access, using Azure AD, everything work OK. Now I have a huge and big doubt, I understand that for user Private Access via Web i.e. Clientless, a SAML - Reverse Proxy account must be configured. That's my big doubt: I am looking for documentation that supports this configuration, ie Private Access Web browser access with SAML - Reverse Proxy with Azure AD, but I have not found, I have only found for Okta, among others, but with Azure AD nothing. Configure Browser Access for Private Apps:

Context: Next Gen APIs and Retro Scans   If you haven't noticed yet Netskope is adding more and more apps to the Next Gen API Platform. One of the greatest advantage it comes with is - Decoupling of your ongoing scan policies from retro scans. New way to do retro scan is to create a Retro Scan Policy Group. Now you can add multiple API-Enabled Protection policies to a single retro scan policy set and scan entire group with click of a button. Definitely a better way to do the retro scans.   Retro scans are now separate from ongoing policies. In the classic version you need to select an existing policy and start Retro Scan for the respective supported SaaS app. This decoupling makes sipping through SkopeIT alerts more effective. You can start retro scans in set of policies instead of individually scanning API-Enabled Protection policies one by one.   Just keep in mind that you nee

Hello, Can I generate a report containing file movements (eg Google Drive CASB API) and also display the full path of that file? In Netskope IT -> Application Events it only shows the objects (files). It does not show the full file path. Thanks!

Netskope Private Access- Client Update config time interval Hello good evening, I hope you are all very well. I have a question, I have been searching and I have not found anything regarding the autoupdate interval of the Netskope client configuration, when changes occur e.g. changes at NPA level, e.g. new Publisher, new Private apps, private access policies. I have even been timing, because I understand that this is not 100% manual or yes ?. Could you tell me automatically when it takes the client to automatically perform the udpate of the config, when there are NPA adjustments. I have been timing the client, and in 35 minutes elapsed the client still does not update the NPA config by itself. Thank you, I remain attentive Best regards 

Hello Members   Need a help.   if any user is facing internet Speed issue or slowness issue.  what might be cause..? Any specify troubleshooting for that..? .

I am following the steps in the documentation to make apps available from the browser.Configure Browser Access for Private Apps (netskope.com)If It uses standard port 80 it seems to work but 443 or any other port I get this error message.Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

Hi All, I would like to initate a discussion on better DLP for Adoble product lines, and I believe many Netskope users here in Technology or design industries may have similar concerns.According to this article, to make sure licensed Adobe fuction correctly, we may need to allow many domains.https://helpx.adobe.com/enterprise/kb/network-endpoints.htmlHowever, a possible data breach may happen through these domain as well if we bypass all the listed domains from steering traffic, since a few are not restricted for enterprised-used.Has anyone successfully configured DLP policies for Adoble solutions?Ideally we would like to find a way to allow these domains for Adobe certification executable only, while still monitor possible file sharing or sensitive design files leakage scenarios.-AW

 When the client is installed, the end user is unable to reach certain sites like cisco.com.Meanwhile, no policies have been applied to the user.I was going to ask them to check their firewall, but this issue occurs even at home without connecting VPN.

A long time ago, Google applied for the .zip Top Level Domain(TLD) to ICANN and their application was granted. Recently, Google (Google Registry to be specific) announced that these TLDs will be available for use. These include domains like .Foo, .Zip, .Mov etc. Whilst they may seem innocuous on first glance, there is a big risk for malice when it comes to these top level domains. Let's say I write an email/blog/slack message that references a file abcd.zip. abcd.zip would never have been considered an 'internet bound link' back in the day.Of course, one ought to never blindly click on such links and ought to identify the 'linked' destination.<cough> Internet Security Awareness </cough>. But this is no longer the c

Is it possible to create a policy to block whatsapp .exe download?I created but I didn't succeed in the test.

Use NPA with logical condition Good afternoon everyone.Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type.Example:The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network.Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

Hi,Kindly advise me that we set "Exceptions" registration on certain IP,and the bypass setting seems working on TCP request, but UDP ones are blocked as below. [log said:]bypassAppMgrUDP.cpp:219 BypassAppMgr Blocking UDP connection from process: google chrome helper, dest IP:xx.xx.xx.xx(we set one on Exceptions) Do we need another setting on UDP? kindly advise me!

Hi all,   I have a customer that uses pac file mandatory, for users with the agent installed and users who don't have agent, and can't differentiate between them, therefore all the pc's use pac file.   With non-Netskope explicit proxies over ipsec, this pac file configuration does everything works ok. addon-customer1.goskope.com -> proxy*.goskope.com -> direct   When the proxy is a Netskope explicit proxy over ipsec, the agent is disabled.   Is there a way to change the behavior so that the pac file can coexist with Netskope explicit proxy ipsec without the agent not being automatically disabled?   Thanks!!