Product Forums

Support for corporate applications from Mobile with Android and IOS Smartphones Hello good afternoon, thinking about SSL Pining, and applications that can not be decrypted their traffic. In environments with Android and IOS mobiles, in the following native applications not Web/Cloud: Onedrive, Outlook, Sharepoint, Office 365 Suite. Thinking about the full of features and the support of these features of the Netskope Suit ( CASB, SWG, DLP, Threat Protection, API Protection, etc ) what are the scopes, limitations with respect to mobile devices with Office 365 applications. Thanks for the collaboration, for your time and the good vibes. Best regards

Hello Netskope Community,   Wondering if I can use Discord as cloud app in my real-time policy ?   I can see the app activities (when I am using it through browser) in skope it application events, also in CCI database but I cannot see the app listed inside de policies.   It is something related to my backend licenses or I just doing something wrong.   Thanks,   And e rson      

Doubts with CCI and Real Time Protection Policy Cloud App. Hello good afternoon, first of all thank you for your time and your collaboration.I have a question, regarding the apps I see in the CCI listing, example I see the Telegram app in the listing, as poor, with its CCL all OK. But the issue is when I have to go to generate a Real Time Protection policy, I select Cloud App and look for telegram .... and it does not appear ? This is correct, it is expected or something happens ? since I am supposed to be able to invoke and link in my policies all the CCL applications and be able to use them without problems, but I search for Telegram, with lowercase t, with capital T and it does not appear. Is there any kind of restriction in this regard? Thank you, I remain attentive Best regards

Microsoft Office 365 Integrations - Privileges and Roles Hello good afternoon Netskope community. A doubt, to make SCIM integration with AzureAD for Users/Groups privisioning, with an Azure-AD user having the Application Administrator Role, he can manage enterprise applications for example SCIM and SSO usage for UI administration. Now I can't find the exact role, privilege and/or permissions or permissions that are required for an account to integrate with Onedrive, with Outlook, with Sharepoint, via API to be able to use API protection It speaks of "Global Administrator", please can you confirm me exactly the granular role that allows an account to perform this type of integration between Netskope and Office 365, I already tried with the same Role Application Administrator and does not allow me. Azure AD built-in roles:https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference Thanks to all of you for your time, collaboration and good

As a security architect or as a Netskope admin it is sometimes tempting to configure controls that are too broad. Especially when a tool's UI makes it easy for you to do so.:) Think of the implications of broader controls from an operations point of view. Think of some of the side effects: false positives, missed true positives, barge of DLP incidents in your queue to name few. A seasoned DLP admin would share stories of painstaking tasks of managing those incidents, storing chain of custodies using Legal Hold and Forensic folders, determining the right storage of choice and then the cost associated with it just storing files and meta data that may or may not make sense without a good DLP program in place. Here are some questions you might want to ask your DLP / Compliance team / or the sponsor of DLP program to get a discussion started on this topic:  It allows me to apply DLP to  "All Web Categories", should I go ahead and create such a broad DLP policy though? Answers to the questio

Hello, I need to obtain information about the file extension included in the Documents option, within Netskope - Policies - Real time protection - Policy category survey solution -ACTIVITIES & CONSTRAINTS - Activities Upload - Documents.If there is any document with the other options, please also send it. Attached imageThank you

Punycode is a standard for mapping characters using the ASCII standard and one of its functions is to provide support for Internationalized Domains Names (IDNs) to the internet. This is used when you see non-ascii characters like Cyrillic, Latin, Chinese and others on a domain name to make sure the DNS and subsequent HTTP requests are all completed successfully.   Punycode becomes a security risk in connection with homographic phishing – cyber-attacks in which criminals use the similar appearance of different characters to lure their unsuspecting victims to fake websites.   Example: netskоpe.com looks identical to netskope.com but the letter “o” used in the first example is in Cyrillic giving an attacker the ability to send the user to a completely different domain. The way browsers deal with the difference above is by converting punycode into ascii characters so by clicking on the first link would actually get you to xn--netskpe-ejg.com. You can play with this by finding a p

Netskope Private Access is a Zero Trust Network Access (ZTNA) solution that connects users and devices to applications rather than networks.  This differs from traditional network access solutions such as remote access VPNs.  Legacy VPNs provided network level access for remote users by essentially extending your internal network to the remote device.   This was simple from an administrative and user perspective, but ultimately provides unnecessary access for most employees.  In contrast, ZTNA solutions like Netskope Private Access provide access to applications based on contextual criteria such as user risk, device risk, and which resources are being accessed.  This is more secure and aligns to Zero Trust principles such as providing minimum access levels , continuously verifying context, and removing implicit trust based on the network.  While this is significantly more secure, it can also be more challenging for administrators to implement as they need

Hi There,  Looking to see if there will be support for copy, paste and print activities on Netskope reverse proxy.  Microsoft has them in their cloud app security suite for a couple of years now.       

Total applications supported by App instance - New App Instance. Hello good afternoon, first of all thanks for the collaboration, good vibes and for your time.I have a doubt, regarding the possibility of being able to identify corporate Instances. What applications are currently compatible with Netskope, to identify and define your corporate instance? That is to say by means of App instance - New App Instance ? https://docs.netskope.com/en/app-instance-profile.html#:~:text=Navigate%20to%20Skope%20IT%20%3E%20Application%20Events%20or%20Skope%20IT%20%3E%20Alerts. Thank you I remain attentive Regards and attentive to your comments

Hello, I am testing the install script of Netskope via command line.  Every time i install the client is disabled, can I enable the client via command line?

We have previously allowed Grammarly and folk think the app is awesome. From a DLP perspective, however, I have noticed that it is pretty difficult to detect DLP incidents when using the copy/paste function. The challenge is not when a colleague uploads a file to the website but when a colleague cuts and pastes documents into the portal. The cut/paste approach essentially creates a file in the Grammarly portal completely bypassing DLP checks and allows data exfiltration. I have created a custom universal connector app but cannot see anything recorded that we could then use to prevent sensitive data from being exfiltrated from the organization. I assume the site is using some clever JS that Netskope cannot inspect.  Anyone else cracked this type of challenge? Any ideas/help would be appreciated

Single Sing On - SSO Tenant UI with SAML Azure-AD Hello community Netskope, good afternoon. As always thanks for the support and collaboration. I have the following problem, I am configuring SSO for Netskope Tenant UI, to use Azure-AD credentials from Office 365. Guided by this Doc/Links:https://docs.netskope.com/en/netskope-sso-with-azure-ad.htmlConfigure an Enterprise Application in Microsoft Azure Active Directory using SAMLConfigure SSO Settings in the Netskope UIAdd Azure Active Directory Users to the Defined Application and Assign RolesDefine Custom Roles for Azure Active Directory Enterprise ApplicationNow I configure everything, everything seems to be OK, but I get the following error when trying to login to the Tenant: - "We seem to have hit a problem.Error Code: General ErrorError: Failed to get SAML IdP Certificate!"- - Is this something related to the Partner Tenant we have ? any particular step ? If I go to the Seetings- Administration -

anyone else having issues or have a solution for E911 and compliance with the below requirements. https://www.fcc.gov/911-dispatchable-location  

User groups locally defined in Netskope.Hello good evening everyone, thanks for the collaboration and your time.Reviewing the documentation and so far from what is indicated in the documentation, it indicates Active Directory or LDAP groups and / or, Organizational Units ( OU ) but I have not seen, for environments where you do not have AD, to manage groups say local, ie with locally defined users, to generate local groups and associate accounts in a personalized way and at the same time to generate policies based on these custom local groups.Is this technically feasible in Netskope ?Thank you, best regards

Interconnect NPA Private Access IPSEC to Private Apps Hello good afternoon, thank you for your cooperation. I have a doubt, is there any way to enable, example: If I have an IPSEC tunnel between my HQ and AWS, can I have an IPSEC tunnel, between my Netskope and AWS, without having to depend on installing a "Publisher" and not depending on that VM or Addon, to be able to access private APPS services, such as Private Access features ? For a SASE/ZTNA environment? Thank you, I remain attentive Best regards

Quick tips on how to identify whether it is a local user (tenant local) or directory provisioned user:   1. When you manually add users to Netskope tenant, you cannot add additional fields such as first and last name or group they belong to, only the email address.  Directory provisioned users display a first and last name in the 2nd and 3rd column (quick and handy way to distinguish) if you have tenant console open.  Security Cloud Platform > Netskope Client > Users 2. Directory provisioned users typically also have a group associated with them. 3. There is no "delete" option for directory provisioned user. (Deletion of such users is handled from the Directory).   What is Directory Provisioned users? -The users that are either Netskope AD Importer tool provisioned or pushed through SCIM provisioning apps (e.g. gallery Netskope apps on Okta or Azure AD)   How to view groups or delete user? -Select a user and click 3 dots on far right Security Cloud P

When deploying the Netskope Client (NSClient) using the "IdP" enrolment in order to associate the user to the endpoint profile asking the users to login to the desired IdP provider, and the IdP used is Microsoft Azure AD, we can encounter 2 use cases where it's useful to use the "Domain Hint" feature: Users logged onto the machine that belong to an Hybrid AD or to an Azure AD which is not the same AD used for the Netskope Client IdP enrollment will experience issues due to the Single-Sign-On process that will transparently use the same credentials of the logged-in user against the IdP, hence failing the Netskope Client enrolment Administrators may want to redirect the SSO process to the right Azure AD tenant, doing so avoiding to prompt the user all the possible different accounts they could use for the SSO, as some may not belong to the same SSO IdP domain:   On the aforementioned use cases we can rely on a Microsoft Azure AD SSO feature called "Domain Hint". Details of the fe

Endpoint with Netskope Private APP Client and VPN Client installed endpointHello, good afternoon, as always, thanks for the support and for your constant collaboration.I have a question regarding the following environment/particular case.-Workstation/Laptop, outside the network/DC (Internet modem 4g/5g - Home Internet connection - Connection from Cafe) with Netskope Client installed and with VPN Client installed and Connected to the datacenter, bound for 10.10. 10.100 (App1) 10.10.10.200 (App2) 10.10.10.250 (App3).-Tenant Netskope with NPA Private Access (policies, access, configurations already fully done)-Publisher in Datacenter and fully connected-Publisher NPA Private Access/Private Apps destinations: with IP of internal access systems: that is, App1:10.10.10.100 - App2:10.10.10.200 - App3: 10.10.10.250My question is the following, with the environment already described, what happens in the case of the workstation with the VPN client connected, with the Netskope client installed, w

Total integrations with Office 365 / Azure AD / Sharepoint / Outlook / OneDriveHi good afternoon, first of all thanks for the time and for the collaboration. I am interested in knowing which one(s) are All possible integrations with Office 365 environments, example: -Provisioning Users/Groups ? -Security Outgoing/Incoming Mail ? From Outlook web and from the desktop APP andand Mobile/Smartphone clients ? -Filtering for Onedrive desktop Apps and web access ? -Filtering for Sharepoint ( Desktop Apps and web access ? ) What are the minimum requirements to achieve this? At the level of licenses of office 365 ? Azure AD ? At the level of services ? prerequisites ? requirements etc ? Scope, Limitations, to what extent you can filter, advantages and disadvantages ? Thanks in advance for your time, support and collaboration. I remain attentive Best regards

Gostaria de verificar se é possível realizar uma configuração no Netskope onde não fique inativo quando o usuário travar a máquina.Porque temos uma política de Acesso Condicional com exceção dos IPs Netskope, mas quando o usuário bloqueia a máquina e depois tenta acessar algum aplicativo assim que loga novamente, ele não pega o IP Netskope imediatamente e gera a mensagem de bloqueio. Somente depois de um tempo após obter o IP, o aplicativo autentica o usuário novamente.

Hi all,  Wanted to get your thoughts on how to best approach something. We have a specific user account that's leverage for internal pen testing. As expected, there are Real-time Protection Policies that fire off alerts for this account's activity when active. We've had a request to see if it's possible to filter this account out of either the policies or the alerts. Is there currently a way to omit a given account from a specific policy or alert (triggering)? 

Hi Team,We are going for POC of SWG. I want to know how to check the Anti Virus Exclusion for Netskope Client.If NS client folders are excluded successfully or not also kindly share me the Docs for Netskope Client installation on MAC Windows Manually.

I would like to create a new steering Config policy that will only have a limited amount of Cloud apps steered by the Netskope Agent so it doesn't affect a Teams work, but provide us a level of DLP coverage. Is there a way to add by category (e.g. Social, Webmail, Cloud Storage, Iaas/PaaS, etc) instead of individual Cloud Apps? I would have just sorted by category in the new steering config policy and deleted cloud apps that way, but sorting on that column is not allowed.

Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Migrating from a VPN solution to a ZTNA mindset requires a deep understanding of the applications within the network and what access is needed. Netskope recently released a new feature called NPA App Discovery which assists administrators in identifying the applications and required access. Netskope’s Professional Services team has been using this feature to mitigate end-user risk while speeding up NPA deployments. With App Discovery enabled, selected users will have a traditional VPN experience and temporary access to all resources on the network. Netskope will identify all of the domains, IP’s, and ports for applications these pilot users access, taking the guesswork out of defining the applications. Netskope administrators can view this data in the Netskope UI and quickly create definitions and access policies