Product Forums

This post is about API Protection (previously known as API Introspection) integration best practice:   Can I integrate multiple instances of the  same SaaS app (e.g. My company's Sharepoint dev and Sharepoint prod) to one Netskope tenant? -Sure you can. And most customers do. There is no problem as long as you are within your license quota. For licensing questions reach out to your Sales team. -Having multiple SaaS apps in one tenant is also not uncommon (e.g. Box, Webex, Zoom, O365 in one Netskope tenant). Again it is just the license you need to purchase for additional SaaS app.   I have more than 2 Netskope tenants but I have only one SaaS app tenant. Can I have the same instance of one SaaS app integrated to multiple Netskope tenants? Caution! Even though the integration may succeed (i.e. the instance grant process turns green on both Netskope tenants) few immediate side effects I would like to alert you about - You are essentially doubling your API usage becaus

What is the difference between App events, page events, and alerts into skope IT?

  Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Autopilot can be used to simplify and streamline the bulk deployment, setup, and configuration of Windows 10/11 devices in an organization to ensure they are provisioned and locked down according to corporate standards. It can also be used for device reset, repurpose, and recovery. Netskope has a feature called Netskope Private Access Prelogon for Private Apps which assists customers to take advantage of autopilot functionality.   Netskope’s Professional Services team has been using this feature to recognize company owned devices and associate them with appropriate enrollment workflows and configuration profiles,  automatically join devices to Azure Active Directory (Azure AD) or Active Directory, auto-enroll devices into MDM services such as Intune, and Customer Out of Box Experience (OOBE) conten

Hi community,  we are facing issues with several of our websites accessed via NPA:Reaching the website is working without any issue, but if you let it in background for a while and come back to it, sometimes it falls into error without possibility to refresh the page and make it work. User needs to disable/enable agent to make it work again. Anyone faced similar issue ?Thanks, Robin

Hello Everyone,  I am trying to block the upload and send chats for WhatsApp Cloud App. I have created the  cloud app policy for WhatsApp and selected the activity "upload" and set the action "block",when we tried to upload any file it gets blocked but we are not able to block send chats for same it is still allowing.I have also tried by creating "Chat, IM & other Communication" category and selected the activity upload, and set the action "block" but it did not worked as well. Please help on how we can block the send Chats for WhatsApp web. 

Hello Team, We want to block chat activity on Whatsapp web and allow the upload activity. How can we achieve this? 

Support for corporate applications from Mobile with Android and IOS Smartphones Hello good afternoon, thinking about SSL Pining, and applications that can not be decrypted their traffic. In environments with Android and IOS mobiles, in the following native applications not Web/Cloud: Onedrive, Outlook, Sharepoint, Office 365 Suite. Thinking about the full of features and the support of these features of the Netskope Suit ( CASB, SWG, DLP, Threat Protection, API Protection, etc ) what are the scopes, limitations with respect to mobile devices with Office 365 applications. Thanks for the collaboration, for your time and the good vibes. Best regards

Hello Netskope Community,   Wondering if I can use Discord as cloud app in my real-time policy ?   I can see the app activities (when I am using it through browser) in skope it application events, also in CCI database but I cannot see the app listed inside de policies.   It is something related to my backend licenses or I just doing something wrong.   Thanks,   And e rson      

Doubts with CCI and Real Time Protection Policy Cloud App. Hello good afternoon, first of all thank you for your time and your collaboration.I have a question, regarding the apps I see in the CCI listing, example I see the Telegram app in the listing, as poor, with its CCL all OK. But the issue is when I have to go to generate a Real Time Protection policy, I select Cloud App and look for telegram .... and it does not appear ? This is correct, it is expected or something happens ? since I am supposed to be able to invoke and link in my policies all the CCL applications and be able to use them without problems, but I search for Telegram, with lowercase t, with capital T and it does not appear. Is there any kind of restriction in this regard? Thank you, I remain attentive Best regards

Microsoft Office 365 Integrations - Privileges and Roles Hello good afternoon Netskope community. A doubt, to make SCIM integration with AzureAD for Users/Groups privisioning, with an Azure-AD user having the Application Administrator Role, he can manage enterprise applications for example SCIM and SSO usage for UI administration. Now I can't find the exact role, privilege and/or permissions or permissions that are required for an account to integrate with Onedrive, with Outlook, with Sharepoint, via API to be able to use API protection It speaks of "Global Administrator", please can you confirm me exactly the granular role that allows an account to perform this type of integration between Netskope and Office 365, I already tried with the same Role Application Administrator and does not allow me. Azure AD built-in roles:https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference Thanks to all of you for your time, collaboration and good

As a security architect or as a Netskope admin it is sometimes tempting to configure controls that are too broad. Especially when a tool's UI makes it easy for you to do so.:) Think of the implications of broader controls from an operations point of view. Think of some of the side effects: false positives, missed true positives, barge of DLP incidents in your queue to name few. A seasoned DLP admin would share stories of painstaking tasks of managing those incidents, storing chain of custodies using Legal Hold and Forensic folders, determining the right storage of choice and then the cost associated with it just storing files and meta data that may or may not make sense without a good DLP program in place. Here are some questions you might want to ask your DLP / Compliance team / or the sponsor of DLP program to get a discussion started on this topic:  It allows me to apply DLP to  "All Web Categories", should I go ahead and create such a broad DLP policy though? Answers to the questio

Hello, I need to obtain information about the file extension included in the Documents option, within Netskope - Policies - Real time protection - Policy category survey solution -ACTIVITIES & CONSTRAINTS - Activities Upload - Documents.If there is any document with the other options, please also send it. Attached imageThank you

Punycode is a standard for mapping characters using the ASCII standard and one of its functions is to provide support for Internationalized Domains Names (IDNs) to the internet. This is used when you see non-ascii characters like Cyrillic, Latin, Chinese and others on a domain name to make sure the DNS and subsequent HTTP requests are all completed successfully.   Punycode becomes a security risk in connection with homographic phishing – cyber-attacks in which criminals use the similar appearance of different characters to lure their unsuspecting victims to fake websites.   Example: netskоpe.com looks identical to netskope.com but the letter “o” used in the first example is in Cyrillic giving an attacker the ability to send the user to a completely different domain. The way browsers deal with the difference above is by converting punycode into ascii characters so by clicking on the first link would actually get you to xn--netskpe-ejg.com. You can play with this by finding a p

Netskope Private Access is a Zero Trust Network Access (ZTNA) solution that connects users and devices to applications rather than networks.  This differs from traditional network access solutions such as remote access VPNs.  Legacy VPNs provided network level access for remote users by essentially extending your internal network to the remote device.   This was simple from an administrative and user perspective, but ultimately provides unnecessary access for most employees.  In contrast, ZTNA solutions like Netskope Private Access provide access to applications based on contextual criteria such as user risk, device risk, and which resources are being accessed.  This is more secure and aligns to Zero Trust principles such as providing minimum access levels , continuously verifying context, and removing implicit trust based on the network.  While this is significantly more secure, it can also be more challenging for administrators to implement as they need

Hi There,  Looking to see if there will be support for copy, paste and print activities on Netskope reverse proxy.  Microsoft has them in their cloud app security suite for a couple of years now.       

Total applications supported by App instance - New App Instance. Hello good afternoon, first of all thanks for the collaboration, good vibes and for your time.I have a doubt, regarding the possibility of being able to identify corporate Instances. What applications are currently compatible with Netskope, to identify and define your corporate instance? That is to say by means of App instance - New App Instance ? https://docs.netskope.com/en/app-instance-profile.html#:~:text=Navigate%20to%20Skope%20IT%20%3E%20Application%20Events%20or%20Skope%20IT%20%3E%20Alerts. Thank you I remain attentive Regards and attentive to your comments

Hello, I am testing the install script of Netskope via command line.  Every time i install the client is disabled, can I enable the client via command line?

We have previously allowed Grammarly and folk think the app is awesome. From a DLP perspective, however, I have noticed that it is pretty difficult to detect DLP incidents when using the copy/paste function. The challenge is not when a colleague uploads a file to the website but when a colleague cuts and pastes documents into the portal. The cut/paste approach essentially creates a file in the Grammarly portal completely bypassing DLP checks and allows data exfiltration. I have created a custom universal connector app but cannot see anything recorded that we could then use to prevent sensitive data from being exfiltrated from the organization. I assume the site is using some clever JS that Netskope cannot inspect.  Anyone else cracked this type of challenge? Any ideas/help would be appreciated

Single Sing On - SSO Tenant UI with SAML Azure-AD Hello community Netskope, good afternoon. As always thanks for the support and collaboration. I have the following problem, I am configuring SSO for Netskope Tenant UI, to use Azure-AD credentials from Office 365. Guided by this Doc/Links:https://docs.netskope.com/en/netskope-sso-with-azure-ad.htmlConfigure an Enterprise Application in Microsoft Azure Active Directory using SAMLConfigure SSO Settings in the Netskope UIAdd Azure Active Directory Users to the Defined Application and Assign RolesDefine Custom Roles for Azure Active Directory Enterprise ApplicationNow I configure everything, everything seems to be OK, but I get the following error when trying to login to the Tenant: - "We seem to have hit a problem.Error Code: General ErrorError: Failed to get SAML IdP Certificate!"- - Is this something related to the Partner Tenant we have ? any particular step ? If I go to the Seetings- Administration -

anyone else having issues or have a solution for E911 and compliance with the below requirements. https://www.fcc.gov/911-dispatchable-location  

User groups locally defined in Netskope.Hello good evening everyone, thanks for the collaboration and your time.Reviewing the documentation and so far from what is indicated in the documentation, it indicates Active Directory or LDAP groups and / or, Organizational Units ( OU ) but I have not seen, for environments where you do not have AD, to manage groups say local, ie with locally defined users, to generate local groups and associate accounts in a personalized way and at the same time to generate policies based on these custom local groups.Is this technically feasible in Netskope ?Thank you, best regards

Interconnect NPA Private Access IPSEC to Private Apps Hello good afternoon, thank you for your cooperation. I have a doubt, is there any way to enable, example: If I have an IPSEC tunnel between my HQ and AWS, can I have an IPSEC tunnel, between my Netskope and AWS, without having to depend on installing a "Publisher" and not depending on that VM or Addon, to be able to access private APPS services, such as Private Access features ? For a SASE/ZTNA environment? Thank you, I remain attentive Best regards

Quick tips on how to identify whether it is a local user (tenant local) or directory provisioned user:   1. When you manually add users to Netskope tenant, you cannot add additional fields such as first and last name or group they belong to, only the email address.  Directory provisioned users display a first and last name in the 2nd and 3rd column (quick and handy way to distinguish) if you have tenant console open.  Security Cloud Platform > Netskope Client > Users 2. Directory provisioned users typically also have a group associated with them. 3. There is no "delete" option for directory provisioned user. (Deletion of such users is handled from the Directory).   What is Directory Provisioned users? -The users that are either Netskope AD Importer tool provisioned or pushed through SCIM provisioning apps (e.g. gallery Netskope apps on Okta or Azure AD)   How to view groups or delete user? -Select a user and click 3 dots on far right Security Cloud P

When deploying the Netskope Client (NSClient) using the "IdP" enrolment in order to associate the user to the endpoint profile asking the users to login to the desired IdP provider, and the IdP used is Microsoft Azure AD, we can encounter 2 use cases where it's useful to use the "Domain Hint" feature: Users logged onto the machine that belong to an Hybrid AD or to an Azure AD which is not the same AD used for the Netskope Client IdP enrollment will experience issues due to the Single-Sign-On process that will transparently use the same credentials of the logged-in user against the IdP, hence failing the Netskope Client enrolment Administrators may want to redirect the SSO process to the right Azure AD tenant, doing so avoiding to prompt the user all the possible different accounts they could use for the SSO, as some may not belong to the same SSO IdP domain:   On the aforementioned use cases we can rely on a Microsoft Azure AD SSO feature called "Domain Hint". Details of the fe

Endpoint with Netskope Private APP Client and VPN Client installed endpointHello, good afternoon, as always, thanks for the support and for your constant collaboration.I have a question regarding the following environment/particular case.-Workstation/Laptop, outside the network/DC (Internet modem 4g/5g - Home Internet connection - Connection from Cafe) with Netskope Client installed and with VPN Client installed and Connected to the datacenter, bound for 10.10. 10.100 (App1) 10.10.10.200 (App2) 10.10.10.250 (App3).-Tenant Netskope with NPA Private Access (policies, access, configurations already fully done)-Publisher in Datacenter and fully connected-Publisher NPA Private Access/Private Apps destinations: with IP of internal access systems: that is, App1:10.10.10.100 - App2:10.10.10.200 - App3: 10.10.10.250My question is the following, with the environment already described, what happens in the case of the workstation with the VPN client connected, with the Netskope client installed, w