Product Forums

Hello the community.I need your help.I’ve opened a high-priority support ticket separately, but I’m looking for information on how DNS works (ping / nslookup).We’re having an issue with our business applications.I have an internal application published on our DNS. I don’t have any issues at work.But outside of work, when I ping it, I get the following response:C:\Users\THOMAJULIE>ping wug.XXX.frSending a ‘ping’ request to wug.XXX.fr [100.64.0.1]  > Normal comportmentC:\Users\THOMAJULIE>nslookup wug.XXX.frServer:  UnKnownAddress:  192.168.1.254Non-authoritative answer:Name:    wug.XXX.fr.transports.comAddresses:  2a01:7e01::f03c:95ff:feeb:9d4b          2a01:7e01::f03c:95ff:fe00:2692          2a01:7e01::2000:dff:fec1:5cdb          2a01:7e01::f03c:95ff:feed:783e          2a01:7e01::f03c:95ff:fe91:5d91          139.162.181.76          172.104.149.86          172.104.251.198          139.162.174.209          172.104.203.186Is this normal behavior?Can you tell me how ping/nslookup r

Background :We have Netskope SMTP DLP, Endpoint DLP, and Microsoft Exchange integrated with Netskope. Users are currently imported via Directory Importer (LDAP/AD) with a synchronization interval of 180 minutes.Use CaseWe are implementing a Leavers Email and Endpoint Monitoring Policy (Monitor/Allow mode only). When HR raises a MyAccess request, the user is automatically added to a dedicated LDAP group. The Netskope policy is configured against this group.The challenge is that policy enforcement is delayed until the next Directory Import sync, which can take up to 60 minutes. Our requirement is for the policy to become effective immediately after the user is added to the LDAP group.  Options ConsideredSCIM Provisioning: We considered using SCIM to provision the specific leavers group and apply policies based on SCIM group membership. However, our understanding is that users already imported through Directory Importer should not also be provisioned through SCIM, as this could create ide

I have Slack configured via Next Gen API connector. I have DLP policies to identify specific data types being shared externally. After opening an incident I can clearly see the channel name identified. However, I have no way of whitelisting or filtering on them. We have a channel naming convention to identify false positives, but no way to filter them out besides manual review. What can be done? 

Will Endpoint DLP support Airdrop as a device control in the future?

how to bypass loom desktop  application ?

Hello Everyone,I have a query regarding Netskope with Sensitivity Labels for Email DLP.We have integrated Netskope with the "Sensitivity Label" feature and successfully published all labels into Netskope. Using this integration, our Endpoint DLP, Cloud and Web DLP label‑based policies are working as expected.However, for SMTP Email Proxy, labeled attachments (Secret, Top Secret, Restricted) are getting bypassed. We tested multiple approaches:GUID‑based method: Extracted GUIDs from the MIP Compliance Portal and created custom regex entities (e.g., MSIP_Label_<GUID>_Name These did not trigger in SMTP DLP. Metadata extraction workaround: For Word files, we extracted metadata via File → Info → Properties → Advanced Properties → Custom and used regex ( ClassificationContentMarkingHeaderText.*Restricted This works only for Word attachments. Excel do not expose metadata in the Custom tab.its empty. Service account permissions: Assigned EXPORT role to the service account used for Sensiti

In our environment, we found that M365 Copilot Cowork is not working when user’s connection is protected behind Netskope. Other customers using Netskope seems to be reporting the same issue as well.Microsoft’s documentation on network requirements for Copilot Cowork has been published here Cowork network endpoints (Frontier) | Microsoft Support and they cited requirements around supporting long-lived connection. Microsoft support has also shared an internal document that mentioned about the use of Server-Sent Events--which based on Internet research is not something SASE/SWG products support by default.Do you have a recommended configuration that we can use to make Copilot Cowork to work behind Netskope? Any plan to make this configuration to be part of the standard M365 policy from Netskope so that we don’t need to request a configuration change in our company? 

Hello Team,We were trying to automate sending user invites over email which we are currently doing manually using as per below KB. Can Netskope team develope an API endpoint to send user invites over email.Sharing the documentation of the Netskope User Invite process which we are trying to automate but not able to find API endpoint to perform the task.https://docs.netskope.com/en/netskope-client-enrollment-using-email-inviteWe have also raised a Netskope case - 00643908

Team,We are facing an issue with GitHub access control, where we are unable to restrict access to Enterprise accounts only and block access through personal or external domains.During our investigation, we observed that the instance is identifying the user as IRIS_mansi.mittal instead of the corporate email address (mansi.mittal@irissoftware.com). Due to this, we are unable to apply the required controls based on the enterprise domain.We need assistance in understanding why the instance is capturing the username in this format and what configuration or solution can be implemented to enforce access only for Enterprise accounts while restricting personal or external accounts.Please help us with the recommended approach to resolve this issue.

Hi all, just reposting this in the ZTNA channel.The script allows for automated deployment for Netskope Private Access Publishers in AWS using CloudFormation. I updated the script to support the latest publisher and Ubuntu version.https://github.com/Mitsj0l/Netskope-ZTNA-Publisher-AWS-CloudformationIf you are interested in this you might also want to checkout: Copy from the GIT:This repository contains:netskope-publisher.yaml netskope-parameters.json nsk-deployment.shThe deployment flow is:CloudFormation creates the AWS resources. User data downloads nsk-deployment.sh from S3. The script creates the Publisher in Netskope. The script retrieves the registration token and registers the Publisher. Optional post-registration steps can run automatically: Browser Access AnyApp enablement System update and publisher image upgrade sensitive artifact cleanup

Hello Everyone,I am currently working on a requirement to block the chat feature on X.com. I have attempted to restrict access by blocking relevant URLs and applying regex patterns; however, these approaches have not been successful.I also tried identifying the exact destinations used by X.com for its chat functionality, but was unable to pinpoint them.Could anyone please assist or share guidance on how to effectively implement this use case?Thank you in advance for your support.

Are their plans to fully support Linear (linear.app) as a steered app, so I can build real-time CASB DLP policies for it? Or, will you be supporting it as a NextGen CASB API app? Thx

Hi all: Is anyone out there running WSL Version two and using Netskope? 

We are facing one issue where users are sharing google docs from external domains eg: gmail.com to nykaa.com, and nykaa.com users are able to access the google docs or sheets on which they can paste /write the sensitive information.So how do we block this transaction with Netskope

HI Team,We are currently receiving 24-hour scheduled reports for USB activity from Netskope; however, this does not fully meet our organization’s monitoring requirements.We would like to highlight a specific requirement from our end:• Whenever USB access is granted to any user, we need the ability to capture and receive activity details immediately (near real-time or on demand).• The report/log should include:o User detailso Device informationo Type of activity (Allow/Block/Alert)o Files accessed or transferredo Accurate timestamp of the activityAt present, while these activities are visible in the Alerts/Events section, the scheduled 24-hour reports do not provide complete visibility, especially for all actions (Allow/Alert/Block) in a timely manner.Therefore, we request you to:1. Validate this requirement from a product capability standpoint.2. Confirm whether real-time or near real-time reporting/export for USB (Device Control) activity is feasible.3. Advise on any configuration cha

I am experiencing intermittent periods when I am unable to update incidents (In Progress/Resolved/False Positive) which last for hours at a time. Is it possible that another user making changes is causing this?

This is not an improvement for administrators, in my opinion.The Last Event filter used to have “Admin disabled” and “User Disabled” making it easy.Now one has to select “Actor” and “Status disabled”

Hello.Netskope was installed to replace a competitor product and I have been having intermittent issues ever since. Sometimes the laptop can be up for days without issue - sometimes I have to reboot multiple times in a day. - I cannnot replicate this issue at will.After a reboot the laptop Non-Paged Pool is approximately 1.2GB - that looks high but I had no reason to look at this before the Netskope client was installed.Usually the first I am aware of an issue is in a Teams call - when it becomes unresponsive - but not every Teams call.When I look at the non-paged pool size it is up to about 26GB. at this point nothing much works and I have to Hard reset the laptop (Hold the power button down for 20 seconds),I have a higher end DELL laptop with 32GB of Physical memory installed (the standard is 16GB).I now find myself camped in Task Manager watching the value to see if it is rising - and rebooting the laptop before every important eams call, just in case.Using tools I cannot attribute

Hello fellow Skopers,if you are like me, you sometimes struggle analyzing Netskope client logs because they are so noisy, span multiple files, and are difficult to filter. Especially if you are faced with a problem where you’re not quite sure what to look for. The fact that there is no reference guide available for these logs complicates things further.That’s why I built a little CLI tool to help me analyze the logs and separate the signal from the noise.It’s very early in its development, but it can already do these things:Output a chronological, scoped timeline of high-signal events, showing errors and client status changes Filters relevant events like client lifecycle and UI status, config and update activity, tunnel and gateway events, DNS/proxy/PAC problems, Fail Closed and captive portal signals, NPA connection events, and TLS/certificate issues Analyze and inventory client log bundles (the zip files) with useful informationMuch more is planned, like an interactive dashboard in t

We are currently observing multiple “Compromised Website” alerts in Netskope for several local news websites and some insurance company websites that users frequently access.These appear to be legitimate websites, but Netskope is flagging them as compromised or malicious. We would like to understand: What threat intelligence source/classification is being used for these detections? Has anyone else experienced similar alerts with legitimate local news websites? Could this be related to shared hosting reputation or a temporary website compromise? What is the best approach to validate whether these are true positives or false positives? We are trying to determine whether the websites are genuinely compromised or if additional tuning/exclusions may be required.Any guidance or similar experiences would be appreciated. 

There is currently no available RTP App for the AI platform Draftwise. This makes it very difficult to bypass all Draftwise traffic.

Hello Everyone,I have a few questions regarding  Reverse Proxy as a Service (RaaS) configuration with Microsoft Entra ID.We have configured Reverse Proxy as a Service (RaaS) with Microsoft Entra ID by following the official Netskope documentation below:Reference Document:https://docs.netskope.com/en/reverse-proxy-as-a-service-with-microsoft-entra-id-1 Configuration Summary Created an Enterprise Application in Microsoft Entra ID for Reverse Proxy Exchanged all required URLs and certificates between Entra ID and Netskope Configured SAML Reverse Proxy on Netskope and selected “Reverse Proxy as a Service” as the application type Shared the required URLs with the Entra application and completed Reverse Proxy configuration Reverse Proxy redirection is working as expected Created a DLP policy to block upload, download, and post actions for source code DLP policy is enforced successfully when traffic goes through Reverse Proxy for Cloud apps Observed Behavior From a managed device (w

I would like to find out whether the Netskope POP IP addresses change frequently.We currently have a cloud-hosted application that only permits access from our organization’s public internet IP address. However, the monitoring TVs are connected to the same LAN as the User LAN and their traffic is routed through the Netskope tunnel.Due to this setup, the source public IP seen by the cloud application may become the Netskope tunnel IP instead of our normal internet public IP.Kindly advise on the following:Should we whitelist the Netskope tunnel/POP IP addresses on the cloud application side?Is there a way within the Netskope proxy configuration to bypass the Netskope tunnel for this specific application or traffic, so that it uses our normal public internet IP instead?If bypass is possible, what would be the recommended approach or best practice? 

Hello TeamI'm setting up the Log Shipper plugin in Cloud Exchange and I'm getting the error shown in the attached image. Steps taken:I've already updated the API token generated in the Netskope tenant (with the necessary permissions for integration with CE).I have verified connectivity between Cloud Exchange and the tenant.Despite this, the system won’t let me complete the plugin creation. Has anyone experienced a similar issue, or do you know if there are any additional settings in the Log Shipper configuration that I should check?Best regards :)

From the investigation:The primary application itself is not being blocked. During the session workflow, the application initiates requests to external third-party tracking/analytics domains. Netskope identifies the traffic under the application context, but the actual blocked request is towards a third-party analytics/tracking endpoint. The current policy categorizes the request under a risk/control policy and blocks it, resulting in a user-facing warning/interstitial.Requirement:Allow the application workflow to continue without user interruption. Avoid broadly allowing all third-party tracking traffic globally. Maintain the existing security posture and policy controls.Questions:What is the recommended Netskope approach for handling embedded third-party analytics/tracking requests initiated from applications?  embedded third party urls are connect.facebook.net/log/error , facebook.com/tr & www.facebook.com/privacy_sandbox/pixel/register/trigger/ Is there a best practice to suppr