Product Forums

Hi all, I am trying to setup a public accessable website (home.heinonline.org) as a published private app on a publisher. But it looks like that all attempts to access this website from an off-prem client steers the traffic through Netskope instead of going to the publisher. The reason I want to do this is that user when accessing the website will "auto-authenticate" when on-prem (via IP identification). And I am hoping to get the same result of "auto-authenticate" for off-prem users by publishing the website as a private app on a publisher that is on the same network as on-prem users. Any ideas on what I can do to make this work? Thanks in advance.

Hello, Team,We are using the Directory Importer tool as documented https://support.netskope.com/s/article/Netskope-User-Provisioning-with-Secure-LDAP-to-Google-Cloud-Identity.We have groups that contain users from different domains.Example: groupX = [ user1@dmainA.a, user2@domainB.b, user3@domainC.c ].I wonder if there is a solution to synchronize this kind of groupsAny ideas pleaseThanks

We have SCIM integration done between Jumpcloud and Netskope. But seems like some user groups in Netskope does not get populated with the users based on Jumpcloud. Is there any way for me to manually trigger a sync? Or check the sync logs. 

Hello, Can someone tell me how to get the entire incident dump from API query? Can you provide any sample API query and how to customize it? It is fine if the data is in json. We are looking for advanced reporting and would need additional columns than the one displayed in console hence want to explore what options will be present in query. 

Overview Cloud Exchange CLS’s Syslog forwarding gives you the ability to send Netskope Event, Alert, and WebTx messages to any Syslog server. Using the Microsoft Incoming Webhook application from the Admin center Cloud Exchange will send messages to a configured Teams channel to notify you when an Alert was seen from Netskope.  Requirements CloudExchange 3.3.3 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CLS Any Syslog server Syslog Server For testing and writing this document, I am running a Ubuntu 20 LTS Compute Engine on GCP  with Docker and Graylog running in a container. Leave a comment if you would like me to write up that setup.  Verify url/ip and port of your Syslog server In Graylog you can see the input port by going to System > Inputs Netskope Cloud Exchange setup steps Cloud Exchange Plugins On your Netskope Cloud Exchange go to Settings > Plugins You will need two plugins configured for this solu

Overview Cloud Exchange CLS’s Syslog forwarding gives you the ability to send Netskope Event, Alert, and WebTx messages to any Syslog server. Using the Microsoft Incoming Webhook application from the Admin center Cloud Exchange will send messages to a configured Teams channel to notify you when an Alert was seen from Netskope.  Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CLS Any Syslog server Syslog Server For testing and writing this document, I am running a Ubuntu 20 LTS Compute Engine on GCP  with Docker and Graylog running in a container. Leave a comment if you would like me to write up that setup.  Verify url/ip and port of your Syslog server In Graylog you can see the input port by going to System > Inputs     Netskope Cloud Exchange setup steps Cloud Exchange Plugins On your Netskope Cloud Exchange go to Settings > Plugins You will need two plugins configured f

In this article we show how to set up an automatic remediation workflow in Azure, leveraging the APIs available in Netskope’s Cloud Security Posture Management. We’ll show how a security rule can be automatically remediated in Azure, and we’ll show how that remediation can happen  either based on a time trigger or a HTTP trigger.   This workflow can be used for many types of violation, in this article we will be considering the use case where we want to remedy a violation where an Azure key Vault does not have purge protection enabled.   The source code is available at https://github.com/netskopeoss/CSPM-Azure-AutoRemediation Setting Up   Netskope SPM detects violations for key vaults where purge protection is disabled as a part of the rule: Ensure KeyVault is recoverable. In this solution there are two Azure function apps involved. The first is a FetcherForKeyVaultRecoverableHTTP used for getting a list of violating resources from Netskope SPM. The second is a

Netskope introduced REST APIs for Netskope Private Access earlier this year in R91. These REST API endpoints allow for networking and security teams to automate application onboarding, infrastructure management, and policy for Private Access. Now if you aren’t familiar with Netskope Private Access, you can find an overview here. Netskope Private Access essentially has three key components used to manage access to your enterprise applications: Publishers are lightweight virtual machines that broker access to your internal applications by connecting to the Netskope cloud. Publishers are supported in public clouds including AWS, GCP, and Azure along with private data center virtualization such as Hyper-V or ESXi. Additional platforms are supported as well. App Definitions are Netskope objects used to determine the hostnames, ports, and IP addresses that your end users can access via Netskope Private Access. Real-time Protection Policies grant or deny access to your enterprise a

Netskope’s new graph-powered SaaS Security Posture Management (SSPM) engine can help security analysts investigate root causes and identify repeating patterns for all kinds of security misconfigurations. To help one get started with the SSPM and the powerful queries made available by the Netskope Governance Language (NGL), we’ve collated this post to show you some easy sample investigations you can perform with Azure AD / Microsoft 365 environments. To get to the Next Gen SSPM features and NGL from the Netskope main view, one needs to navigate to “API-enabled Protection -> Security Posture (Next Gen) -> Inventory” and click the icon on the right side of the filters toolbar. This opens up the NGL query tool which we will be using for the rest of the article.   The most basic use case for NGL would be to simply list resources by their type. Since NGL is a pattern matching language designed to identify which resources comply with a given criteria, we need to formulate our quer

Encapsulation SSL/TLS Traffic to Netskope Cloud Proxy - Netskope Endpoint ClientHello good afternoon, as always, thanks for the collaboration and for the good vibes.I have a doubt, example, I understand that the Netskope client, establishes an encapsulated SSL/TLS tunnel between the client and the Netskope Cloud Proxy or Security Gateway.Now my doubt is the following, in my local firewall, example Fortigate, Palo Alto, and/or other vendros, as all those connections that are established between the client, the endpoint and the Security Web Gateway of Netskope, would visualize all that traffic as.Basic log example:Source 10.10.10.X Destination to the Netskope tenant of SWG- proxy-<tenant-name> goskope com, port 443/TCP App SSL/HTTPS.I would see in the logs of the source firewalls the endpoint and destination Netskope ? Or would you still see the original destinations such as -facebook , -box , -dropbox, -microsoft, etc, etc ?Please confirm this point if possibleThank you very muchB

Have you been curious to get access to see how Netskope Private Access works? We are offering a free 14-day test drive for you to see how NPA seamlessly connects users everywhere to private applications hosted anywhere in data centers or public cloud environments. What you can expect: Free 14-day hands-on experience Turnkey testing environment No software to download/install Application-specific connectivity and superior user experience Single management console for user identity, application, and access policies. Admin and User Guides to help you every step of the way Click here to sign up to access your testing environment today.

Activities functionalities among others, with and without certificate installation, e.g. PAC or explicit proxy or traffic sent through GRE/IPSEC. Hello good afternoon, thank you for your time and collaboration. I have some doubts, I understand that when using the netskope client SSL decryption is by default (since part of the client setup is also preload SSL certificates on the client) and as indicated in the documentation for use cases with PAC or explicit proxy or even forwarding via GRE/IPSEC, workstations, endpoints, ie endpoints, must install Netskope certificates, this clearly to perform the correct SSL decryption and to perform inspection. Now, what happens in the case that the certificates are not installed or cannot be installed (for multiple reasons), what are the functionalities that are lost? I imagine being able to filter by activities, to delimit upload and download, to give an example and to correctly identify the applications, since seeing everything as S

Dropbox activities Web Cloud App but dont block Desktop App Hello good afternoon, as always, thank you very much for your time and your collaboration. I am performing a test with Dropbox, I generated a policy that Blocks Cloud APP Dropbox, the following activities:Activity = Create, Delete, Edit, Invite, Login Attempt, Login Failed, Login Successful, Logout, Post, Rename, Share, Unshare, Upload, View, View All.Except "Download" I do not have the Download checkbox checked, so I am allowing it, and the download works correctly, which is the desired behavior. Now I installed the Dropbox application on the Windows workstation, where I have installed the Netskope Client, where I have been doing the tests and it turns out, that when uploading a file through the App, I upload a file and the upload is completely successful. I thought it would stay forever trying to synchronize, but the 2 and 3 test files, via the Dropbox desktop application, works perfectly. Now according t

One of the most common questions I get from administrators is how does Netskope determine the optimal Data Center (DC) when steering inline traffic. I’d like to simply tell you that the client and other Netskope services are intelligent enough to steer traffic to the optimal DC. While on the surface that’s true, there is some nuance to it. Before we dive in, let’s take a high-level look at Netskope’s architecture.     NewEdge is Netskope’s underlying network that powers all of our inline services. There are NewEdge DCs across the globe in more than 60 regions in cities such as London, Miami, San Francisco, Hong Kong, Delhi, Dubai, and numerous others. You can look at our publicly available Trust Portal to see the most up to date list of active DCs. By default, the client and other Netskope services can utilize any of these DCs for services such as SWG, DLP, content filtering, inline CASB, and more. While this is the default tenant configuration, administrators can also reque

Hello,  We started using NPA for our Radiologists; they connect from home [1Gb ISP connection] via NPA [two publishers] to our on prem PACS system.  PACS studies/Images are pretty big, some studies are 2 GB+ in size. We are on 97.0.0.7294 for the publisher and per the release notes, this version supports peak throughput of 500 Mbps. But unfortunately we are not seeing that. In testing the Peak, we notice is only ~120Mbps. We have set up a speedtest docker container just for this purpose and published it through NPA. Wondering if anyone has thoughts on how to increase the throughput so the images load faster as some of our rads reported slowness in loading the studies.   

I am trying to troubleshoot an issue with a solution called Browserstack which provides developers with the ability to test their websites and mobile applications across on-demand browsers, operating systems and real mobile devices. I have created a bypass so that traffic to the Browserstack tenant is not inspected which allows a system to successfully navigate to the page, the issue occurs when the Browserstack provided OS / Mobile Device emulators attempt to load code on the device. If the NS agent is disabled it works fine, when it is enabled it is broken. Has anyone else encountered a similar issue?

Hi all, thanks for reading. The regex [a-z0-9]{64} is allowed to be used as the main regex, but the UI return an error when trying to use that same regex as a regex filter in entity advanced settings. I validated that decreasing the length from 64 to 40 makes the regex to be accepted instead. Why is that? I cannot find any documentation differentiating between limitations for the main regex and the advanced filter ones. How does netskope evaluate if a regexx is supported or not Thanks in advance,Òscar

OktaAdvanced Server Access provides Zero Trust identity and access management for cloud and on-premises infrastructure. Using Okta as its source of truth, Advanced Server Access reconciles accounts to manage SSH and RDP access to Linux and Windows servers. Advanced Server Access extends secure privileged access to users, automates lifecycle management for server accounts, and eliminates the need for credential management.Okta Advanced Server Access can be configured to allow direct connection to servers or it can be configured to use a Bastion and/or an Okta ASA Gateway to provide the connection through a “Session Gateway Broker”An example of integration with Netskope leveraging Network Private Access is the following:   In this example we have a Linux and a Windows machine published through the Okta ASA Gateway, and a Linux machine published directly without the ASA Gateway.In this case we’ll configure 2 separate NPA Applications: NPA Okta ASA Gateway Application: defined for

Created a File Profile with a File Name (exclude.xlsx) and applied into a DLP Profile (tried with Match and Does not Match). When I running tests, none of them are working (not checking the exclude.xlsx file with the matching profile // not excluding the exclude.xlsx file).Can you please advise?Thanks

We've been seeing a huge uptick in macOS related connectivity issues (tunnel just drops and rebuilds). I've noticed lots of log entries like:error Unable to UDP open local Endpoint The peer closed the flow Can anyone explain what/why netskope is doing with UDP data - when TCP 80/443 (nsclient) are all that should be in play? 

Hello good afternoon, thank you for your time and for your collaboration. I have a question, checking the tenant, one of the default policies that are preconfigured at the SSL decrypt Policies level, is one related to the Office 365 Suite, which indicates that decrypt is not performed. It also indicates the following: Policy name: Default Microsoft appsuite SSL do not decrypt ruleAction: Do Not Decrypt"SNI-based policies will apply but no deep analysis performed via real-time protection policies" Based on this: ""SNI-based policies will apply but no deep analysis performed via real-time protection policies"" I understand that it is important to be able to deeply examine Office traffic, to correctly inspect, decrypt and distinguish SaaS Cloud Apps of Office 365, distinguish the movements made by users in Sharepoint, in Teams, in Onedrive, in Outlook, Office 365 in general. Now as indicated, if by default it does not perform Microsoft App Suite traffic decryption, then thi

During the course of the year we have seen instances where a signature from CTEP was involved in issues within our environment.   We have found the following documentation on CTEP signature updates (https://docs.netskope.com/en/netskope-client-traffic-exploit-prevention-system-threat-content-release-notes.html_)  but there does not seem to be a way to 'subscribe' to it to proactively receive notifications when this is updated.   Does anyone have any thoughts on how to be notified when signatures are added/removed etc.?

Hi Folks, I am sharing my modest knowledge with the Netskope community. I hope this helps a few of you on understanding the basic Netskope traffic flow and log analysis. POP Selection Versions prior to 96.1 : 1. The Netskope Client uses DNS over HTTPS (dns.google) to resolve the Netskope gateway's IP address (gateway-tenant hostname.goskope.com)2. If DNS over HTTPS is unsuccessful, the client will fail over to the LDNS technique (UDP 53) to resolve the IP address for gateway-tenant hostname.goskope.com. Version starting with 96.1: There is no longer a requirement to resolve NS Gateway domains using the Google DNS service (dns.google). The GSLB services deliver a POP list based on the client IP address while performing a REST API request to gateway.gslb.goskope.com.  Note: GSLB option will be only available when the backend tenant flag is activated. Basic Traffic flow Let’s take an example of the SaaS Application Box.

I was looking through the DLP profiles and did not find any support for triggering on Microsoft Purview Information Protection (formerly Azure Information Protection / MIP / AIP ) sensitivity labels for real-time protection policies. My goal is to coach/block users from uploading documents with certain labels to unapproved cloud storage.  I can extract the labels from the office documents metadata, but there doesn't seem to be a way for Netskope to detect the labels even with custom dictionaries or EDM.  Has anyone gotten sensitivity label detection working in real-time protection DLP policies? 

Hello Team,We have enabled  Netskope cloud firewall feature for customer, and we are not able to ping google or yahoo we wanted to test few connection, when netskope is enable still wont be able to ping. Please guide me here if Enable cloud firewall feature will it block ping by default, if yes then how can i enable it to ping google or websites on internet.