Product Forums

ObjectiveHighlight the outcome that improvements to international predefined entities are part of Netskope’s long-term roadmapNetskope existing detection mostly relies on a third-party entity. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can test pre-defined identifiers in their own languages, particularly in non-English regions, to verify whether they function correctly. They may only trigger the sample data demonstrated in the UI, so using a variety of real-life samples is highly recommended for more accurate verification. Do You Know?Non-numerical identifiers such as addresses, names, or terms are likely to bypass Netskope’s DLP detection mechanism without triggering

Hello everyone,We've seen a few questions lately about the best way to handle Netskope Client upgrades when you have a mixed environment of non-persistent VDIs and traditional laptops. A common challenge is that the same user might use both, but the upgrade strategy needs to be different for each.Let's break down the problem and the best-practice solution. The Challenge: Different Needs for Different Devices  Non-Persistent VDIs: You can't use the standard auto-upgrade feature from your Client Configuration. Any update applied during a session gets wiped when the VDI reverts to its golden image. Upgrades need to be manual and controlled. Laptops: You want them to auto-upgrade. It’s the easiest way to keep your users on the latest client version and maintain your security posture with minimal effort. So, how do you disable auto-upgrades fo

We tested the user alert feature and noticed that when a DLP profile is applied to the user activity 'Post' for all web access, the user alert option cannot be selected.However, once we changed the policy to apply only to specific categories, such as cloud storage, the user alert option became available.We also observed that user alerts work if no DLP profile is applied but the 'Post' user activity is regulated across all web access. App Category - Profile - Activity - Action(1) Specific Category - DLP - Post - User Alert ✅(2) All Web - DLP✅ - Post - Alert/Block(3) All Web - No Profile ❌ - Post - User Alert ✅Does anyone know the mechanism behind this behavior?

How can I change the Status for more then 100 incidents at a time, which is the dashboard limit? I have thousands of incidents created from a retro-active scan and would like to add my own custom status to them all at once.

In working with the Netskope CASB, we’ve had analysts come up with the question “would this URL be blocked?”  I know we can go into Skope IT and do a URL Lookup to see what categories a URL is linked to and what policies “cover” it.  However, this doesn’t see to answer the fundamental question, “would it be blocked?”  There is the simple solution of, “just try it”, which will provide the answer, but this has some obvious downsides.  And it seems that the Netskope system must know if a URL is blocked or not, it will block browsing to a URL afterall.  Is there something I am missing in the interface which does this?  Or, is there a safe way to validate a URL from an analyst’s system, which doesn’t involve “ya, just try visiting a potentially malicious URL”?

OK, I am sure it will be obvious when someone tells me, but I walked trough what I think is every Settings spot and cannot find the Enrollment Token Section.  The Docs start out saying “Click Create TokenSet to create a new token set on the webUI. “ but not where it is!     It feels like it should be in the “Client Configuration”…….

Hello Netskope Community,One of our customers has a requirement where a specific role should have the ability to create policies and apply global/general settings, but not be able to delete any policies or settings due to compliance reasons.Currently, this level of granularity is not supported. The available permission levels—None, View, Manage, and Manage and Apply—provide either read-only or full read-write access to a specific feature or function. However, there is no built-in option to restrict only the delete action for a role.We would like to know if there are any known workarounds or if this capability is being considered for a future release.

I have the Netskope REST API Events v2 integration configured within Postman and queries are successful. I am wondering is there a method to limit the query by user, as well as number of days?My use case is as employees is leaving the company, I would like to just add there user name into the query, and have it pull the last 30 days of Alert, Application, and Incident logs for them, so I can export in CSV format. Thanks 

Alternatives - Deployment/Enrollment with UPN - Based on Postman-SCIM - Users - GroupsHello community, how's it going? Good afternoon, I hope you're all well. I have a specific case to discuss:In a scenario where we have a complete refusal to touch anything in Azure AD or AD-onprem (nothing at all, no way - no agent, no directory import, no enterprise app, no ID entry, etc., nothing at all, it's not possible because there's absolutely no option), here we already know, we use our beloved Postman to use SCIM and start generating users/groups, so to speak, "manually." Then we have the AD users with UPNs, everyone happy without touching AD but with the AD-onprem UPN users, already in the Tenant using the Postman SCIM API.We can deploy with tools like System Center, DesktopCentral, or anything else for .msi files with UPN values. Everything's OK here too. We install, the Windows users of the AD domain start, and the UPN registration and enrollment are O

Are there any recommended guidelines to indentify and filter out known org AWS S3 traffic, and then enforce Netskope policy on only external S3 traffic? 

When creating a coaching policy, when the user enters a justification reason, where is this captured in the admin portal?

ObjectiveThe combination of English characters and other special characters is treated as a single word. Netskope Regex does not support detection when English characters are combined with uncommon symbols, even underscore, and the specification of Netskope Regex rules remains unclear. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can validate this issue by adding an underscore (“_”) or random characters after the English keyword they want to detect, as demonstrated below. Do You Know?Users can easily bypass Netskope’s DLP detection mechanism

From this article, it mentions the feature flag Netskope Entity Modifier. Could you clarify the difference in behavior before and after it is enabled?Note:Can we suggest allowing a longer period for comments on articles? Otherwise, we have to create a new article just to ask follow-up questions.

I used the locally installed Postman application to send API POST requests with test data to evaluate whether Netskope could detect them. While SkopeIT is logging the events, the policy doesn't seem to be triggering, and I’m unable to view the actual data being transmitted in the API request. Has anyone encountered this issue or have insights on what might be going wrong?  

Hi,I have integrated a Syslog SIEM with the Cloud Exchange Log Shipper module, and everything is working fine. However, in the mapping file pushed to the SIEM, I’d like to include the User Group information from the alerts/events, and I can’t figure out how to do that.When I check the Mapping File Wizard to edit an existing mapping—or even when creating a new one—I can't find any “Netskope Field” that corresponds to the User Group attribute of the generated alerts/events. I need to send that attribute to the SIEM.Does anyone know how I can map it?Thanks in advance.Regards

Greetings All,I’ve had a persistent issue for several months with Netskope on macOS that I wanted to throw out here to see if anyone else had come across something similar. Intermittently devices with the Netskope client installed will lose all connectivity to the internet. In the logs I see usually around 50,000 of these messages in a span of just a few seconds`critical nsDNSProcessor.cpp:149 dnsProcessor Failed to get DNS resolver values`Usually as this happens all active connections are killed, like ongoing zoom calls, even though those aren’t being steered to Netskope.Before this I see the DTLS tunnel close down with this flownpadebuglog.log```[info] npaClientHandler.cpp:748:npaClientHandlerStop():0x0 Will shutdown NPA handler and dispatch thread, tunnelId = 7f8b47.[info] tcpclient.cpp:530:shutdown():0x1086a1160 Shutdown socket fd 45[info] npaClientHandler.cpp:755:operator()():0x0 The client handler is stop

Is there any plans to add Google Agentspace (vertexaisearch.cloud.google.com) as a managed app connector we can steer? 

Refer to case 00555037. The main reasons we have this requirement is because our IdP domain myid.ladwp.com is within the App Discovery list *.ladwp.com (which allows users access to all internal hosts within this domain). However, the problem is that NPA is steering this myid.ladwp.com domain as a Private App, which causes Okta admins to always see the gateway IP as on-premise. Okta administrators need to see the XFF/Gateway IP. So if a user is working at home or from a remote network, Okta Admins should see that remote network XFF IP address, not our DWP public IP address. When Okta evaluates the IP chain, it uses this XFF IP address to determine whether or not to MFA challenge. At the mo

Hi All, We are trying to determine if Netskope has visibility into traffic sent from java/python scripts.  For example, if I have a java script that sends an HTTP POST to a API and the POST contains sensitive data, can Netskope detect that? From my testing it doesn’t seem so, but we wanted to check with the community. Thanks!

I searched and had a hard time finding much on this, but basically, I am deploying NPA across my organization and some server admins (notably using Macs) have run into hostkey mismatches when SSHing into servers behind NPA. Does anyone have experience, specifically, with managing SSH host keys to servers when migrating to use NPA?

Searching the forums and I couldn’t find an answer. We have the need to print, to on-prem printers (via a print server), for remote users.I’ve created the Private App for the Print Server with the following portsTCP 135,137,139,445,631,9100UDP 135,137,139,445,631,9100But it doesn’t seem to be working. Although management (via mmc) of the print server is fine.Any idea?I don’t think I need to create a Private App for the printer(s) themselves, since the Print Server should be the connection manager / proxy for that traffic.

i have this Use Case For example, if a file is larger than 200 MB, I want it to be automatically redirected and uploaded to a SharePoint or S3 bucket.How can I achieve this using Netskope?

Hellow, I'm experiencing the following issue: provisioning third-party users who use mcbook. Their accounts don't have email addresses and aren't part of the domain.I've tried everything but to no avail. Could someone tell me if this is possible?

Hi Team,I’ve observed an issue where Outlook on the browser does not receive new emails when the Netskope client is enabled. However, at the same time, the Outlook desktop application continues to receive emails without any problem.This leads me to believe that the Netskope client might be interfering with mail synchronization on the browser. Could you please help investigate and provide a solution for this?

How can i access private applications using enterprise browser? I tried creating a realtime policy with “access method” as one of the criteria but couldn’t find enterprise browser in the option. additionally i tried to create an enterprise browser protection policy for private apps but the option is grayed out.