Product Forums

Note:  SCCM distributions are highly customizable, and the below information is based on sample environments.  You should always consult with your SCCM administrator to create optimal Application Definitions and Policies based on your environment.   Introduction Microsoft’s System Center Configuration Manager (SCCM) is an endpoint management solution that has been combined with Intune, Autopilot, and other tools into Microsoft Endpoint Configuration Manager.  SCCM is traditionally deployed with management and distribution points on-premises or in public clouds that are used to deploy updates, configurations, and software to managed endpoints.   When on-premises, communications between the managed endpoint and SCCM distribution points are handled via enterprise networking and security tools such as site-to-site tunnels. Traditionally, remote access VPNs were used to connect remote endpoints to SCCM distribution points.  In distributed environments, this pre

Hello all, thanks for reading. We are working on migrating URL lists from ProxySG to Netskope. There are several URL lists defined for ProxySG whose matching behaviour is as follows:Imagine there are two URL lists defined: List1 and List2List1:api.facebook.comList2:facebook.com The following URLs will match as follows in proxySG:api.facebook.com -> matches List1sub.api.facebook.com -> matches List1sub.facebook.com -> matches List2facebook.com -> matches List2**Notice it matches the URL list containing the most similar entry How is Netskope handling the above scenario where a URL can be matched in multiple URL lists? How does URL list matching works in Netskope?Does exact match implicitly include subdomains? (e.g. sub2.sub1.domain.com)Does exact match implicitly include any path? (e.g. [subdomain.]domain.com/path1/path2?param1=0&param2=1)Does regex match type require a full match from start to end of the value? e.g.Is regex match type the only wa

Netskope Client - Configuration changes are updated frequently Hello good evening, thank you for your cooperation. Example if I make modification of certain access policies Web-Urls or settings of activities allowed at Clouds App level, once I make the adjustment in the Tenant of Netskope, how long it takes to take effect the change on client workstations ? if I make a modification the change is reflected immediately in the client ? I have been looking in the documentation for this information, the exact information, frequency, etc. and nothing, I can not find it, if you help me with the above questions and information I would appreciate it very much. Thanks I remain attentive to your comments Best regards

Hello, I am seeking some guidance as to how/where Netskope certificate files are imported onto MacOS. We have had numerous issues with Deloitte practitioners (mainly developers and individuals running code/CLI) where the Netskope cert prevents the application from running due to residing atop the cert chain, and therefore is not trusted by the application service. We have copies of the cert files (ca.deloitte.eu.goskope.com and caadmin.netskope.com) and have set the cert to Always Trust in Keychain; however, SSL errors are still being returned by the system. An example is below, using the brightcove.com service: 2022-09-27 09:10:16.604476-0600 USGA Dev[2698:26211] Task <BB14C893-A867-4C5C-977F-8624C991653B>.<1> finished with error [-1200] Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDo

How does Netskope process DLP Rules? I have a few different DLP Policies in place (ie. GLBA / Financial / PII / CCPA - in that order specifically and all Allow rules) - I know there is overlap in terms of what these rules look for.  The question is, if a document matches the GLBA rule, will it still process the subsequent DLP rules? Furthermore, if a document contains both US Bank Account and a SSN, will the document report both hits? Or just 1?

Quick Setup of SSH for Publisher prior to running on Centos 7Comamnd to build PublisherLink: https://docs.netskope.com/en/deploy-a-publisher.htmlPlease Note:  create another admin user in centos as when you run the pubisher command as it locks you out of root after step 3 in the link. You need to login via the other user and run the commnd below.Login with other user via SSH user created then excute the following command curl https://s3-us-west-2.amazonaws.com/publisher.netskope.com/latest/generic/bootstrap.sh | sudo bash; sudo su - $USER; exit Wait up to 10 min subject to your line speed.Setup SSH Server sudo yum –y install openssh-server openssh-clientssudo systemctl start sshdsudo systemctl status sshdEnable OpenSSH Servicesudo systemctl enable sshdservice sshd restartsudo systemctl status sshd(To check Status is Active)IF you cant SSH enable the followingFirewall Settingssudo systemctl start firewalldsudo firewall-cmd --permanent --add-service=sshsudo firewall-c

Google Play Store on Chromebook wasn't working properly after installation of the Netskope Chromebook app. I added a certificate-pinned application specifying these URLs and added a steering bypass for ChromeOS. The store works and apps can be downloaded. Note: We have a managed google play store on android & ChromeOS that only has approved apps. play.googleapis.comgoogleusercontent.comandroid.clients.google.comggpht.comgvt1.comdownloads.providers.android.com  

A Security Practitioner's Perspective Blocking Time Sensitive Materials from Public Exposure By: Stevan Pierce and Jose Ramirez   Background Netskope DLP technologies are typically known to be used for blocking a variety of materials such as Intellectual Property, databases containing employee or customer data, hashes of data to be used in Exact Data Matching, etc, etc.   Netskope is also able to provide protection of time sensitive materials from public exposure and allow for the dissemination of the material internally.  A prime use case would be blocking the ability of employees to share information about a company acquisition; and, at the same time, allow those employees to talk amongst themselves using company resources such as those which are sanctioned, i.e. Slack or Google GMail.   The example we are using to showcase this capability of time sensitive material controls is the release of an article on Forbes, Netskope – Security Transformation For Digital Tra

Hi AllWe have several tenants we manage and we have just  setup our first client that is only using NPA and i received a shock when looking at the overview dashboard which showed 0 users yet all 73 users where connected and working. Can i suggest that a Widget Dashboard is given for the users just using NPA that shows at least the number of users connected. I thing this would be great for all netskope admins as at the moment does not give you a true representation of the number of user working. Would be great if you could drill into this dashbaord showing the following key information in a list1.) Username2.) user Group relating to the private apps that can be steer3.)Time of connection4.) Time of disocnnection5.) Source IP6.) Traffic  

Hi everyone, We have a problem when installing the Netskope client on Chromebook 14 G6 HP Intel CPU. After enrolling and accepting the VPN connection configuration. The NSClient application still says "Client is waiting for configuration" and doesn't retrieve vpn configuration. Screenshots and logs attached. Best regards,Mohamed  

Hello Team, I have firewall background and I am new to Netskope, I was just referring few documents for NPA traffic flow. Just a query of mine. User (Netskope client) --> Netskope cloud (gateway - stitcher) <---  Publisher --> (Private App) Publisher states that it eliminates inbound traffic and it only makes outbound connection with stitcher. so when user request a private application it will go through Publisher as an inbound towards publisher.May be i am missing few important things, Please correct me also share any document the exact flow to understand in a better way. regards,

Hello, We have Reauth for private apps enabled and looking to have a script launch after the user tunnel has successfully established. Is there a way to do this? REF > Globalprotect Admin  

Hi AllI would like to put forward a suggestion when will NPA support mutplie login / publsiher profiles for mutple domain / sites or numerous customers.We are a support company and support several client sites using NPA and we either have unistall and then reinstall the agent relevant to the site we need to gain access to. Cant we hace profile which we could choose to connect with. I know you not a VPN solution but would be great to be able to choose a profile of sortsThanksJacques

Hi Friends, I want to share this case study with the Netskope Community about the Azure Infrastructure integration and Netskope NewEdge. I have attached the complete documentation, and here below is a brief about the challenges and how to resolve them. ==========About this Case Study: One common scenario on Azure is finding organisations using Azure Firewall that wants to connect to Netskope NewEdge without disrupting or changing the current architecture too much. Another common scenario is that companies are obligated to use Azure Firewall for compliance purposes or because it is part of the service provided under management for their providers. This Case Study aims to provide the essential information to deploy and troubleshoot the Cloud Security Connector for Azure when connecting Servers and Virtual Desktops to NewEdge and using Azure Firewall. Customer requirements: The customer is an organization with the following traffic steering requirements:

Hello, Reading through  private-access-best-practices article on docs.netskope.com, it mentions not to overlap CIDR ranges for NPA. I wonder how we can satisfy this recommendation for the following, very common scenario. Lets say we got three outlook web servers. all serve on port 443, so private app [Outlook] is created with the individual three IPs with TCP port 443 and assigned to all/general users in the organization. All good here. Now for the Admins of the Org, they would need to RDP to these outlook webservers for support/admin purposes. I would think, we need a second private app with same three IPs with TCP port 3389 and assign to IT Admins. Two separate apps for zero trust model.  So the second private creates a overlap, any pointers on how to configure this scenario adhering to best practices?   

Hi everyone, happy Friday/weekend! I just have a couple of things that I wanted to ask and get answers. I've searched the documentation and have found no information regarding my question, though I might have used incorrect keywords1. If I am steering all web traffic to Netskope, what happens to web traffic that did not hit any policy ? Does Netskope have implicit deny?2. If I have Realtime Threat Protection policy below,Source: AnyDestination: Any Categorized web traffic Activities and Constraints: Upload and DownloadProfile and Action: Default Malware scan where all severities are just alerting with no Remediation Profilewhat happens when a categorized site did not hit any severity? will it load the site or not?I know these are basic questions and I appreciate you all for taking time in providing answers.Thanks and have a great weekend! 

Hi team can i able to give access to specific users who can have disable option. And have r

Microsoft’s Azure Active Directory is widely used by thousands of organizations around the globe.  It is the largest directory and identity provider in the world with this trend only accelerating as more and more organizations migrate away from on-premises Active Directory.    Those tens of thousands of organizational directories present an interesting security challenge to ensure users only access authorized tenants and resources.  Microsoft has long provided Tenant Restrictions as a means to restrict logins to authorized tenants.         In April of 2022, Microsoft announced a new, robust method of controlling access to Azure AD directories and applications called Cross-tenant Access policies.  Cross-tenant access takes the core concepts of tenant restrictions and provides a number of key enhancements.  Cross-tenant Access policies are granular and allow administrators to specify combinations of users, groups, and applications f

Hi Guys,Does anyone know a site to check on Netskope Proxy status in Real Time ?

Hi everyone, thanks for reading. I'm trying to build some reports with Advanced Analytics.I wanted to created some widgets first and then reuse them to build several reports.I couldn't find a way to do that. I only can create widgets directly inside the report, which limits these widgets to be used in the report they were created from. If I create widgets outside a report I cannot find how to insert them in a report. NS docs say the following:WidgetsA widget is a good choice if you want to create, change, and test a report in one place but use it in multiple dashboards.The widget and the dashboard must be in the same folder. If the widget is changed, the changes to the widget will show in your dashboard. If the widget is deleted, the dashboard will show an error for this tile.REF: https://docs.netskope.com/en/creating-reports--dashboards-.html  I have both reports and widgets inside the same folder as the docs says. Does somebody know how to make it? Otherwise I wou

Hi,We have some issues with a html that shows a circle loader. This html is categorised as malware by netskope: malware name: Trojan.HTML.MALINK.FASJSNORSmd5: 51618ac2b7cf5c4937213e965c00f20aSha256: 0b41f69e6564b9c89b1b344744c5b06eb4adc0e584028909286d2b936e1afed5This is the script content that loads the HTML:  <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script>  In virustotal, it is also categorised as malwareSearching in url scan, you can see several webpages with this hash, but it always refer to 40X HTTP response.This is one example: https://urlscan.io/result/7d7170fa-b6d7-43bd-87da-df6028f0a753/  Reading this post, it seems that some hosting server, wordpress plugis, etc, are using this html loader template instead of 404 page.Most likely, some malware was pointing to some server, but then , the m

Hello All, I was wondering if there was a way to remove items from the alerts page for sites know I want to block but don't want to see in Skope IT alerts page?     An example would be items that are triggering based on "securepubads.g.doubleclick.net" as a malsite.  I know I want to block these but I don't want all of these entries filling up our Alerts log in Skope IT.  Is there a way to block this but not alert to Skope IT easily without having to pull it into a new policy with a custom URL list?   Thank you.

Enabling hybrid work is key to retaining and recruiting talent. Zero Trust Network Access (ZTNA) enables employees using any device to access desired resources to make them productive no matter where they work.   In this webinar, we’ll dive into the Netskope’s ZTNA offering, Netskope Private Access, and review its key capabilities, architecture, sample use cases such as Microsoft Autopilot integration, and new features including API for automation and pre-logon capabilities.   Join Netskope Solution Architect, Sam Shiflett as he compares legacy remote access methods with modern zero trust network access (ZTNA). You won’t want to miss live demos highlighting how to implement the below use cases at your organization. Learn how you can: Enable access for employees and contractors  (without losing control) Remotely onboard new devices including active directory and autopilot integration Secure access to applications deployed in public clouds Rapidly on

Dropbox is flexible cloud storage service increasingly exploited by attackers for opportunistic and targeted campaigns. In my latest Cloud Threats Memo, i described two recent campaigns, providing some strategies to mitigate the risk of legit cloud storage services exploited for malicious purposes.   https://www.netskope.com/blog/cloud-threats-memo-dropbox-flexible-cloud-storage-increasingly-exploited-by-attackers

What are the use cases of Netscope chrome extension? Is this designed just to address Chromebook support? Does this extension only steer browser-based traffic or other app-based web traffic as well running on any client machine? Can I push the extension through MDM or UEM?