Product Forums

Greetings All,I’ve had a persistent issue for several months with Netskope on macOS that I wanted to throw out here to see if anyone else had come across something similar. Intermittently devices with the Netskope client installed will lose all connectivity to the internet. In the logs I see usually around 50,000 of these messages in a span of just a few seconds`critical nsDNSProcessor.cpp:149 dnsProcessor Failed to get DNS resolver values`Usually as this happens all active connections are killed, like ongoing zoom calls, even though those aren’t being steered to Netskope.Before this I see the DTLS tunnel close down with this flownpadebuglog.log```[info] npaClientHandler.cpp:748:npaClientHandlerStop():0x0 Will shutdown NPA handler and dispatch thread, tunnelId = 7f8b47.[info] tcpclient.cpp:530:shutdown():0x1086a1160 Shutdown socket fd 45[info] npaClientHandler.cpp:755:operator()():0x0 The client handler is stopping and shutting down, userId = 502.[info] tcpclient.cpp:199:handleClose():

Is there any plans to add Google Agentspace (vertexaisearch.cloud.google.com) as a managed app connector we can steer? 

Refer to case 00555037. The main reasons we have this requirement is because our IdP domain myid.ladwp.com is within the App Discovery list *.ladwp.com (which allows users access to all internal hosts within this domain). However, the problem is that NPA is steering this myid.ladwp.com domain as a Private App, which causes Okta admins to always see the gateway IP as on-premise. Okta administrators need to see the XFF/Gateway IP. So if a user is working at home or from a remote network, Okta Admins should see that remote network XFF IP address, not our DWP public IP address. When Okta evaluates the IP chain, it uses this XFF IP address to determine whether or not to MFA challenge. At the moment, a remote user always appears to be on-premise from Okta's perspective. This is a problem that we'd like to solve. Hoping you can provide a way to perform NPA bypass similar to how there is steering bypass for SWG/CASB/CFW. Another strong use case is when on-premise detection feature is used, in

Hi All, We are trying to determine if Netskope has visibility into traffic sent from java/python scripts.  For example, if I have a java script that sends an HTTP POST to a API and the POST contains sensitive data, can Netskope detect that? From my testing it doesn’t seem so, but we wanted to check with the community. Thanks!

I searched and had a hard time finding much on this, but basically, I am deploying NPA across my organization and some server admins (notably using Macs) have run into hostkey mismatches when SSHing into servers behind NPA. Does anyone have experience, specifically, with managing SSH host keys to servers when migrating to use NPA?

Searching the forums and I couldn’t find an answer. We have the need to print, to on-prem printers (via a print server), for remote users.I’ve created the Private App for the Print Server with the following portsTCP 135,137,139,445,631,9100UDP 135,137,139,445,631,9100But it doesn’t seem to be working. Although management (via mmc) of the print server is fine.Any idea?I don’t think I need to create a Private App for the printer(s) themselves, since the Print Server should be the connection manager / proxy for that traffic.

i have this Use Case For example, if a file is larger than 200 MB, I want it to be automatically redirected and uploaded to a SharePoint or S3 bucket.How can I achieve this using Netskope?

Hellow, I'm experiencing the following issue: provisioning third-party users who use mcbook. Their accounts don't have email addresses and aren't part of the domain.I've tried everything but to no avail. Could someone tell me if this is possible?

Hi Team,I’ve observed an issue where Outlook on the browser does not receive new emails when the Netskope client is enabled. However, at the same time, the Outlook desktop application continues to receive emails without any problem.This leads me to believe that the Netskope client might be interfering with mail synchronization on the browser. Could you please help investigate and provide a solution for this?

Does anyone know what the “Export User Key” is used for in Netskope? This feature is located in Setting>Security Cloud Platform>User section?I could not find any documentation on the use case for this feature. I’ve attached the screenshot below.  Is there a place to store the json file once the user key is downloaded?  Thanks.  

How can i access private applications using enterprise browser? I tried creating a realtime policy with “access method” as one of the criteria but couldn’t find enterprise browser in the option. additionally i tried to create an enterprise browser protection policy for private apps but the option is grayed out.

I think that it would be helpful to have a button (or something) to do a SSH to the publisher directly from the tenant.

Good evening, everyone, I will be using the steering “Specific Private Apps” in my dynamic steering configuration. I usually steer all private apps, but I have a use-case for one application for my on-premises users. Do I need to add the private app to a real-time policy for this to work? It looks like I only need to add the specific private app to the steering configuration. See attached screenshots. Thanks. 

Netskope Global Technical Success (GTS)Netskope DLP – Step-by-Step Beginner’s GuideNetskope Cloud Version - 127IntroductionThis article provides a high-level overview of how Data Loss Prevention (DLP) is configured and enforced in the Netskope platform. It is designed for administrators and security professionals who are implementing Netskope DLP for the first time or need a structured refresher.Netskope’s DLP framework is modular — built from several dependent components that must be configured in the correct sequence. This guide outlines those components, their roles, and the logical flow of implementation. Key Components of Netskope DLPThe DLP framework in Netskope consists of the following core building blocks: Component Description Entities Define the actual content to detect (e.g., credit card numbers, project names, customer data) DLP Rules Contain detection logic using Entities and scanning behavior DLP Profiles Group one o

Netskope Global Technical Success (GTS)Netskope DLP – Enforcing Netskope DLP Policies                                                                                    Netskope Cloud Version - 127IntroductionThis article explains how to create and apply DLP Policies in Netskope.DLP Policies represent the final enforcement layer — they determine where DLP scanning occurs, who is impacted, and what action is taken when sensitive data is detected.Policies are where DLP Profiles meet real-world enforcement across cloud apps, web traffic, private applications, and endpoint activity. What is a DLP Policy?A DLP Policy defines:Which DLP Profile is applied Which users, groups, or locations are affected Which traffic channels or applications are inspected What action is taken on policy violations (e.g., Alert, Block, Bypass, Coach)  It is the final step in operationalizing your DLP setup. Key Policy Configuration Options   Section What is it? Why does it matter? Exampl

Netskope Global Technical Success (GTS)Netskope DLP – Designing DLP Profiles and File Filters in NetskopeNetskope Cloud Version - 127 IntroductionThis article explains how to create and use DLP Profiles in Netskope.A DLP Profile is a container that brings together one or more DLP Rules and applies additional filters and classifications, including file types and size-based criteria.This step is essential for organizing DLP logic and optimizing what kinds of files and content are inspected in various use cases. What is a DLP Profile?A DLP Profile combines:One or more DLP Rules (the detection logic) A File Profile (filters files by type, size, and extension)Profiles allow you to group rules by business purpose or regulatory need, then apply them selectively using DLP Policies.  Core Components of a DLP Profile1. File Profile (Filtering by File Types and Sizes)   What is it? Why it matters Example Use Case Defines filters to include or exclude files based on MIME t

Netskope Global Technical Success (GTS)Netskope DLP – Building Effective DLP Rules in NetskopeNetskope Cloud Version - 127IntroductionThis article explains how to create and configure DLP Rules in Netskope.providesDLP Rules define how sensitive data is detected based on previously created Entities, and control the conditions, logic, and severity under which detections are triggered.Rules form the heart of Netskope DLP — without them, Entities alone cannot inspect or enforce anything.This document breaks down each part of a DLP Rule, with configuration guidance, use cases, and practical examples. What is a DLP Rule?A DLP Rule connects one or more Entities to a specific set of detection behaviors. It defines how data is matched, where it is inspected (content vs metadata), how many matches are required to trigger detection, and what severity should be assigned.Rules are then added into DLP Profiles, which are later applied to traffic via DLP Policies.  Core Components of a DLP Rule1. Ent

Netskope Global Technical Success (GTS)Netskope DLP – Creating and Using DLP Entities in NetskopeNetskope Cloud Version - 127IntroductionThis article explains how to create and use DLP Entities in Netskope.Entities are the foundation of the DLP engine — they define what kind of data is considered sensitive and must be detected and protected.Entities can be predefined or custom-built, depending on the sensitivity and uniqueness of your data.This guide will cover:The types of DLP Entities When and why to use them Practical examples and configuration steps What is a DLP Entity?A DLP Entity in Netskope is a reusable object that describes specific data patterns or terms that the system should detect during policy enforcement.Entities are used within DLP Rules to specify the nature of the sensitive data — such as PII, PCI, financial data, or confidential terms.  Types of Entities in Netskope   Entity Type Description When to Use Examples Best Practices

Hi , Has anyone followed this article and successfully got the Google Drive app working through CPA?https://support.google.com/a/answer/7644837?hl=en&src=supportwidget0&authuser=0 Best Regards,

I would like to assign multiple roles to Netskope Restricted Admins, each role has different permissions dependent on the (group) scope. Please instruct if this possible. I only see the ability to assign a single role from the drop-down list of roles.

Hello, At the moment we don’t have any parameter available to deploy the URL list(s)(/api/v2/policy/urllist/deploy)I assume it’s the same limitation than through the WebUI: when we “apply changes” in the URL list menu, we apply all pending changes, even the ones from other admins It would be great to add the {id} of the URLs list to be deployed to avoid the automation tools to apply changes on other URL lists Thank you :)

We are using REST API v2 to sync our Entra ID users and groups. We switched over from SCIM a while ago. I noticed that a group in Entra ID that has nested groups inside are not shown in Netskope, only the individual users. Is this a known issue? Is there a way to have Netskope see nested groups? Thx

Hi Folks,Our development team is currently facing an issue with Ngrok connectivity. I’ve attached a reference screenshot for your review.Could someone please guide us on how to allow this traffic?Appreciate your support.  

ObjectiveHighlight the outcome that Netskope does not re-examine files with the same MD5 hash permanently. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can initially upload a file that contains no detectable data identifiers. Later, they may modify only the file name to include sensitive keywords. As a result, they can bypass Netskope’s DLP detection mechanism, potentially leaking sensitive information through the file name alone. Do You Know?If the administrator has not changed the DLP policies that should have been triggered, such data leakage will not generate any forensic records or DLP violation alerts. This means the administrator will be unable to track or investigate the data leakage incident. NotesWe’ve discovered that others have already raised similar concerns. I encourage you to vote for this feature as well, as this design issue d

Hello everyone,Here's my problem: we have a bastion server on AWS (Active Directory authentication) that is restricted in terms of authorized IPs (at the AWS instance level), and we need mobile service providers (smartphone access points, for example, so no fixed IPs, and we can't open the entire internet without our authentication portal being blown up in 2 seconds) to be able to connect to it.The IP ranges of our Netskope server are authorized, so my question is: Would it be possible to create a specific Netskope client that service providers could activate when they need to connect to our bastion server and then deactivate it after ? Has anyone had a similar need? I asked the AI, and they told me it's possible. Theoretically, I should create a "mobility providers" user group where we could place the email addresses of our mobility providers for enrollment, but I don't have this menu, even though I'm a "tenant admin." Our Netskope account supports SWG and NPA.Thanks in advance if you