Product Forums

We have previously allowed Grammarly and folk think the app is awesome. From a DLP perspective, however, I have noticed that it is pretty difficult to detect DLP incidents when using the copy/paste function. The challenge is not when a colleague uploads a file to the website but when a colleague cuts and pastes documents into the portal. The cut/paste approach essentially creates a file in the Grammarly portal completely bypassing DLP checks and allows data exfiltration. I have created a custom universal connector app but cannot see anything recorded that we could then use to prevent sensitive data from being exfiltrated from the organization. I assume the site is using some clever JS that Netskope cannot inspect.  Anyone else cracked this type of challenge? Any ideas/help would be appreciated

Single Sing On - SSO Tenant UI with SAML Azure-AD Hello community Netskope, good afternoon. As always thanks for the support and collaboration. I have the following problem, I am configuring SSO for Netskope Tenant UI, to use Azure-AD credentials from Office 365. Guided by this Doc/Links:https://docs.netskope.com/en/netskope-sso-with-azure-ad.htmlConfigure an Enterprise Application in Microsoft Azure Active Directory using SAMLConfigure SSO Settings in the Netskope UI

anyone else having issues or have a solution for E911 and compliance with the below requirements. https://www.fcc.gov/911-dispatchable-location  

User groups locally defined in Netskope.Hello good evening everyone, thanks for the collaboration and your time.Reviewing the documentation and so far from what is indicated in the documentation, it indicates Active Directory or LDAP groups and / or, Organizational Units ( OU ) but I have not seen, for environments where you do not have AD, to manage groups say local, ie with locally defined users, to generate local groups and associate accounts in a personalized way and at the same time to generate policies based on these custom local groups.Is this technically feasible in Netskope ?Thank you, best regards

Interconnect NPA Private Access IPSEC to Private Apps Hello good afternoon, thank you for your cooperation. I have a doubt, is there any way to enable, example: If I have an IPSEC tunnel between my HQ and AWS, can I have an IPSEC tunnel, between my Netskope and AWS, without having to depend on installing a "Publisher" and not depending on that VM or Addon, to be able to access private APPS services, such as Private Access features ? For a SASE/ZTNA environment? Thank you, I remain attentive Best regards

Quick tips on how to identify whether it is a local user (tenant local) or directory provisioned user:   1. When you manually add users to Netskope tenant, you cannot add additional fields such as first and last name or group they belong to, only the email address.  Directory provisioned users display a first and last name in the 2nd and 3rd column (quick and handy way to distinguish) if you have tenant console open.  Security Cloud Platform > Netskope Client > Users 2. Directory provisioned users typically also have a group associated with them. 3. There is no "delete" option for directory provisioned user. (Deletion of such users is handled from the Directory).   What is Directory Provisioned users? -The users that are either Netskope AD Importer tool provisioned or pushed through SCIM provisioning apps (e.g. gal

When deploying the Netskope Client (NSClient) using the "IdP" enrolment in order to associate the user to the endpoint profile asking the users to login to the desired IdP provider, and the IdP used is Microsoft Azure AD, we can encounter 2 use cases where it's useful to use the "Domain Hint" feature: Users logged onto the machine that belong to an Hybrid AD or to an Azure AD which is not the same AD used for the Netskope Client IdP enrollment will experience issues due to the Single-Sign-On process that will transparently use the same credentials of the logged-in user against the IdP, hence failing the Netskope Client enrolment Administrators may want to redirect the SSO process to the right Azure AD tenant, doing so avoiding to prompt the user all the possible different accounts they could use for the SSO, as some may not belong to the same SSO IdP domain:

Endpoint with Netskope Private APP Client and VPN Client installed endpointHello, good afternoon, as always, thanks for the support and for your constant collaboration.I have a question regarding the following environment/particular case.-Workstation/Laptop, outside the network/DC (Internet modem 4g/5g - Home Internet connection - Connection from Cafe) with Netskope Client installed and with VPN Client installed and Connected to the datacenter, bound for 10.10. 10.100 (App1) 10.10.10.200 (App2) 10.10.10.250 (App3).-Tenant Netskope with NPA Private Access (policies, access, configurations already fully done)-Publisher in Datacenter and fully connected-Publisher NPA Private Access/Private Apps destinations: with IP of internal access systems: that is, App1:10.10.10.100 - App2:10.10.10.200 - App3: 10.10.10.250My question is the following, with the environment already described, what happens in the case of the workstation with the VPN clien

Total integrations with Office 365 / Azure AD / Sharepoint / Outlook / OneDriveHi good afternoon, first of all thanks for the time and for the collaboration. I am interested in knowing which one(s) are All possible integrations with Office 365 environments, example: -Provisioning Users/Groups ? -Security Outgoing/Incoming Mail ? From Outlook web and from the desktop APP andand Mobile/Smartphone clients ? -Filtering for Onedrive desktop Apps and web access ? -Filtering for Sharepoint ( Desktop Apps and web access ? ) What are the minimum requirements to achieve this? At the level of licenses of office 365 ? Azure AD ? At the level of services ? prerequisites ? requirements etc ? Scope, Limitations, to what extent you can filter, advantages and disadvantages ? Thanks in advance for your time, support and collaborati

Gostaria de verificar se é possível realizar uma configuração no Netskope onde não fique inativo quando o usuário travar a máquina.Porque temos uma política de Acesso Condicional com exceção dos IPs Netskope, mas quando o usuário bloqueia a máquina e depois tenta acessar algum aplicativo assim que loga novamente, ele não pega o IP Netskope imediatamente e gera a mensagem de bloqueio. Somente depois de um tempo após obter o IP, o aplicativo autentica o usuário novamente.

Hi all,  Wanted to get your thoughts on how to best approach something. We have a specific user account that's leverage for internal pen testing. As expected, there are Real-time Protection Policies that fire off alerts for this account's activity when active. We've had a request to see if it's possible to filter this account out of either the policies or the alerts. Is there currently a way to omit a given account from a specific policy or alert (triggering)? 

Hi Team,We are going for POC of SWG. I want to know how to check the Anti Virus Exclusion for Netskope Client.If NS client folders are excluded successfully or not also kindly share me the Docs for Netskope Client installation on MAC Windows Manually.

I would like to create a new steering Config policy that will only have a limited amount of Cloud apps steered by the Netskope Agent so it doesn't affect a Teams work, but provide us a level of DLP coverage. Is there a way to add by category (e.g. Social, Webmail, Cloud Storage, Iaas/PaaS, etc) instead of individual Cloud Apps? I would have just sorted by category in the new steering config policy and deleted cloud apps that way, but sorting on that column is not allowed.

Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Migrating from a VPN solution to a ZTNA mindset requires a deep understanding of the applications within the network and what access is needed. Netskope recently released a new feature called NPA App Discovery which assists administrators in identifying the applications and required access. Netskope’s Professional Services team has been using this feature to mitigate end-user risk while speeding up NPA deployments. With App Discovery enabled, selected users will have a traditional VPN experience and temporary access to all resources on the network. Netskope will identify all of the domains, IP’s, and ports for applications these pilot users access, taking the guesswork out of defin

This is an extension to my last post on Network Tunnels and SSL DND Policies . Netskope has powerful feature called Certificated Pinned Applications; we will call it CPA for brevity here. A CPA app definition can help you tie in a process with their domains thereby allowing you to limit the scope of bypasses. When you call a CPA into a steering exception you are no longer allowing a whole domain to bypass, just the ones tied to CPA app definition! CPA app definition needs to be called into individual steering configurations further limiting the user groups that they are tied to. Only the processes that call the respective domains tied to those apps specified will be limited to bypassing those domains. Another critical use case: If you

Dear community, I am needing to query by API the instances configured for AWS cloud in CSPM. In the official documentation I find queries for creation, deletion or modification but no list of IaaS instances in API Protection. Try to solve it with these links:https://docs.netskope.com/en/manage-multiple-aws-accounts.htmlhttps://docs.netskope.com/en/list-app-instances-354239.htmlhttps://docs.netskope.com/en/rest-api-v1-overview.htmlRegards

Hello all,I am not certain this is the correct group, and I apologize if this is a wrong posting, but I am running out of options and any help or advice would be appreciated. I did some search in internet and I guessed this could be the right support board. An organization for which I am working on a project has recently installed a product which redirects access to MIcrosoft Azure DevOps and inserts ".rproxy.goskope" to the URL, such as below:BEFORE: https://dev.azure.comAFTER: https://dev.azure.com.rproxy.goskope.com/This completely breaks the functionalities of Azure DevOps.I have reached out to the Microsoft support, and they indicated that this "URL changing" should be causi

Netskope’s new graph-powered SaaS Security Posture Management (SSPM) engine can help security analysts investigate root causes and identify repeating patterns for all kinds of security misconfigurations. To help one get started with the SSPM and the powerful queries made available by the Netskope Governance Language (NGL), we’ve collated this post to show you some easy sample investigations you can perform in Salesforce environments.   Netskope Governance Language (NGL) is a rule description language created by Netskope to allow for the most granular and specific expression of security policies. With NGL, enterprises can create policies that go beyond the traditional configuration value checks to express complex rule logic that take into account the unique needs of their business infrastructure. In th

This post is mainly centered around - How to handle traffic averse to 'SSL Decryption'. Here are some best practices around deploying tunnels and managing SSL decryption exceptions. One of the reasons why you are considering upgrading to Netskope SWG is "ubiquitous growth", mix of managed and unmanaged, shared and dedicated systems. Some hosts that can install agent and others that can't take agents. Or you want to do application instance based granular policies that your on-prem proxies are blind to. As part of this deployment generally after installing  Netskope clients you are now considering network tunnels to steer traffic to Netskope on certain systems i.e. to apply inline controls to servers, IOT devices, medical devices or kiosks. When deploying IPSEC or GRE tunnels to steer traffic to Netskope New Edge  network here are certain best pra

Hello,   New user here.. I have a Mac device that doesn't want to connect to the internet at all unless we disable NetSkope. I noticed a ton of errors in the logs that show this as well as UDP like the one below and well as the Network interface errors. Any help will be much appreciated   stAgentNE p3662 t6691 error nsClientFlow.mm:150 nsClientFLow Flow networkInterface is nil   stAgentNE p3662 t6691 info bypassAppMgrUDP.cpp:210 BypassAppMgr Blocking UDP connection from process: safari,

Hello,   We encounter an issue that when a user's domain / UPN changes from say: admin@contoso.local > admin@newcontoso.local The private gateway will fail to establish   In my env Netskope is setup in MultiUser mode(v93.1.0.951) and is integrated with Azure AD for user provisioning / SSO   Reinstalling the Netskope client doesn't resolve the issue   Looking at the device within the Netskope Admin console its client status is 'Multiple Statuses' it will show the same user with both the new domain and the previous domain   Looking at the users profile (updated domain) it will report that the client status is up but physically on the workstation the tunnel will be down and non functional   The only solution t

Hello, We have a user that sets up our systems and they are then get the device assigned to them as the user. Is there a way to reconfigure this as it is now showing him on a lot of devices and dramatically skewing the application events and alerts? Thanks, Ron 

Hello everyone, merry Xmas to all of you 🙂 I would like to be able to know where an item is being used/assigned. e.g. a DLP File Profile, a DLP Entity, a DLP Rule, etc. The only way I found is trying to delete the item. This will show an error message if the item is being used and will show a bunch of items using that item (I think it shows up to 15, if more you won't see them all).This can do the trick if you are totally sure the item is being used somewhere. Otherwise, you take the risk of deleting the item since the confirmation is displayed BEFORE NS checks the item is being used. Performing the usage check BEFORE asking for confirmation would prevent to accidentally delete an item if it is not being used. I hope you understand what I try to explain. Of course, having a "USAGE" button next to every item to display the information would be the best. In fact, this feature would be useful for

I see you can retroactively scan files in your SaaS tenant (OneDrive in my case) against DLP policies, but does that also scan for malware infected files?  Have dozens of files getting flagged in our OneDrive tenant as malware, but the problem is the inline CASB malware policies are what is detecting the files.  I would like to run a malware scan on all files retroactively on our tenant and quarantine anything malicious. However when i go to configure a retroactive scan, i only see options to detect DLP violations, not scan for threats/malware. 

Hi all, I am trying to setup a public accessable website (home.heinonline.org) as a published private app on a publisher. But it looks like that all attempts to access this website from an off-prem client steers the traffic through Netskope instead of going to the publisher. The reason I want to do this is that user when accessing the website will "auto-authenticate" when on-prem (via IP identification). And I am hoping to get the same result of "auto-authenticate" for off-prem users by publishing the website as a private app on a publisher that is on the same network as on-prem users. Any ideas on what I can do to make this work? Thanks in advance.