Product Forums

Total integrations with Office 365 / Azure AD / Sharepoint / Outlook / OneDriveHi good afternoon, first of all thanks for the time and for the collaboration. I am interested in knowing which one(s) are All possible integrations with Office 365 environments, example: -Provisioning Users/Groups ? -Security Outgoing/Incoming Mail ? From Outlook web and from the desktop APP andand Mobile/Smartphone clients ? -Filtering for Onedrive desktop Apps and web access ? -Filtering for Sharepoint ( Desktop Apps and web access ? ) What are the minimum requirements to achieve this? At the level of licenses of office 365 ? Azure AD ? At the level of services ? prerequisites ? requirements etc ? Scope, Limitations, to what extent you can filter, advantages and disadvantages ? Thanks in advance for your time, support and collaboration. I remain attentive Best regards

Gostaria de verificar se é possível realizar uma configuração no Netskope onde não fique inativo quando o usuário travar a máquina.Porque temos uma política de Acesso Condicional com exceção dos IPs Netskope, mas quando o usuário bloqueia a máquina e depois tenta acessar algum aplicativo assim que loga novamente, ele não pega o IP Netskope imediatamente e gera a mensagem de bloqueio. Somente depois de um tempo após obter o IP, o aplicativo autentica o usuário novamente.

Hi all,  Wanted to get your thoughts on how to best approach something. We have a specific user account that's leverage for internal pen testing. As expected, there are Real-time Protection Policies that fire off alerts for this account's activity when active. We've had a request to see if it's possible to filter this account out of either the policies or the alerts. Is there currently a way to omit a given account from a specific policy or alert (triggering)? 

Hi Team,We are going for POC of SWG. I want to know how to check the Anti Virus Exclusion for Netskope Client.If NS client folders are excluded successfully or not also kindly share me the Docs for Netskope Client installation on MAC Windows Manually.

I would like to create a new steering Config policy that will only have a limited amount of Cloud apps steered by the Netskope Agent so it doesn't affect a Teams work, but provide us a level of DLP coverage. Is there a way to add by category (e.g. Social, Webmail, Cloud Storage, Iaas/PaaS, etc) instead of individual Cloud Apps? I would have just sorted by category in the new steering config policy and deleted cloud apps that way, but sorting on that column is not allowed.

Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Migrating from a VPN solution to a ZTNA mindset requires a deep understanding of the applications within the network and what access is needed. Netskope recently released a new feature called NPA App Discovery which assists administrators in identifying the applications and required access. Netskope’s Professional Services team has been using this feature to mitigate end-user risk while speeding up NPA deployments. With App Discovery enabled, selected users will have a traditional VPN experience and temporary access to all resources on the network. Netskope will identify all of the domains, IP’s, and ports for applications these pilot users access, taking the guesswork out of defining the applications. Netskope administrators can view this data in the Netskope UI and quickly create definitions and access policies

This is an extension to my last post on Network Tunnels and SSL DND Policies . Netskope has powerful feature called Certificated Pinned Applications; we will call it CPA for brevity here. A CPA app definition can help you tie in a process with their domains thereby allowing you to limit the scope of bypasses. When you call a CPA into a steering exception you are no longer allowing a whole domain to bypass, just the ones tied to CPA app definition! CPA app definition needs to be called into individual steering configurations further limiting the user groups that they are tied to. Only the processes that call the respective domains tied to those apps specified will be limited to bypassing those domains. Another critical use case: If you are concerned about IP restrictions and unable to allow Netskope New Edge consolidated list of IP's, define a CPA and associate to their domains. Call CPA in the steering config. This will allow traffic from that process to go DIRECT (out of your egress f

Dear community, I am needing to query by API the instances configured for AWS cloud in CSPM. In the official documentation I find queries for creation, deletion or modification but no list of IaaS instances in API Protection. Try to solve it with these links:https://docs.netskope.com/en/manage-multiple-aws-accounts.htmlhttps://docs.netskope.com/en/list-app-instances-354239.htmlhttps://docs.netskope.com/en/rest-api-v1-overview.htmlRegards

Hello all,I am not certain this is the correct group, and I apologize if this is a wrong posting, but I am running out of options and any help or advice would be appreciated. I did some search in internet and I guessed this could be the right support board. An organization for which I am working on a project has recently installed a product which redirects access to MIcrosoft Azure DevOps and inserts ".rproxy.goskope" to the URL, such as below:BEFORE: https://dev.azure.comAFTER: https://dev.azure.com.rproxy.goskope.com/This completely breaks the functionalities of Azure DevOps.I have reached out to the Microsoft support, and they indicated that this "URL changing" should be causing the problem.Unfortunately, nobody in the organization I am handling the project with currently knows why this URL change happened and what is the cause for it, so I tried to do some research by myself, which led me to this support page.If anybody has some ideas what is happening, or could

Netskope’s new graph-powered SaaS Security Posture Management (SSPM) engine can help security analysts investigate root causes and identify repeating patterns for all kinds of security misconfigurations. To help one get started with the SSPM and the powerful queries made available by the Netskope Governance Language (NGL), we’ve collated this post to show you some easy sample investigations you can perform in Salesforce environments.   Netskope Governance Language (NGL) is a rule description language created by Netskope to allow for the most granular and specific expression of security policies. With NGL, enterprises can create policies that go beyond the traditional configuration value checks to express complex rule logic that take into account the unique needs of their business infrastructure. In this article, we'll show you how to use this language with some handy queries, rules and workflows you can easily copy and modify to the needs of your own organization. For more informa

This post is mainly centered around - How to handle traffic averse to 'SSL Decryption'. Here are some best practices around deploying tunnels and managing SSL decryption exceptions. One of the reasons why you are considering upgrading to Netskope SWG is "ubiquitous growth", mix of managed and unmanaged, shared and dedicated systems. Some hosts that can install agent and others that can't take agents. Or you want to do application instance based granular policies that your on-prem proxies are blind to. As part of this deployment generally after installing  Netskope clients you are now considering network tunnels to steer traffic to Netskope on certain systems i.e. to apply inline controls to servers, IOT devices, medical devices or kiosks. When deploying IPSEC or GRE tunnels to steer traffic to Netskope New Edge  network here are certain best practices that can be followed.  Design Considerations:1. Auth or No-Auth?IPSEC/GRE tunnel originated traffic typically won't have user ID availab

Hello,   New user here.. I have a Mac device that doesn't want to connect to the internet at all unless we disable NetSkope. I noticed a ton of errors in the logs that show this as well as UDP like the one below and well as the Network interface errors. Any help will be much appreciated   stAgentNE p3662 t6691 error nsClientFlow.mm:150 nsClientFLow Flow networkInterface is nil   stAgentNE p3662 t6691 info bypassAppMgrUDP.cpp:210 BypassAppMgr Blocking UDP connection from process: safari,

Hello,   We encounter an issue that when a user's domain / UPN changes from say: admin@contoso.local > admin@newcontoso.local The private gateway will fail to establish   In my env Netskope is setup in MultiUser mode(v93.1.0.951) and is integrated with Azure AD for user provisioning / SSO   Reinstalling the Netskope client doesn't resolve the issue   Looking at the device within the Netskope Admin console its client status is 'Multiple Statuses' it will show the same user with both the new domain and the previous domain   Looking at the users profile (updated domain) it will report that the client status is up but physically on the workstation the tunnel will be down and non functional   The only solution that works is to reimage the workstation or assign another device, which feels insane Has anyone seen this before or have any advice on a resolution?   Cheers,  

Hello, We have a user that sets up our systems and they are then get the device assigned to them as the user. Is there a way to reconfigure this as it is now showing him on a lot of devices and dramatically skewing the application events and alerts? Thanks, Ron 

Hello everyone, merry Xmas to all of you 🙂 I would like to be able to know where an item is being used/assigned. e.g. a DLP File Profile, a DLP Entity, a DLP Rule, etc. The only way I found is trying to delete the item. This will show an error message if the item is being used and will show a bunch of items using that item (I think it shows up to 15, if more you won't see them all).This can do the trick if you are totally sure the item is being used somewhere. Otherwise, you take the risk of deleting the item since the confirmation is displayed BEFORE NS checks the item is being used. Performing the usage check BEFORE asking for confirmation would prevent to accidentally delete an item if it is not being used. I hope you understand what I try to explain. Of course, having a "USAGE" button next to every item to display the information would be the best. In fact, this feature would be useful for the whole solution, not only DLP. Is this feature considered

I see you can retroactively scan files in your SaaS tenant (OneDrive in my case) against DLP policies, but does that also scan for malware infected files?  Have dozens of files getting flagged in our OneDrive tenant as malware, but the problem is the inline CASB malware policies are what is detecting the files.  I would like to run a malware scan on all files retroactively on our tenant and quarantine anything malicious. However when i go to configure a retroactive scan, i only see options to detect DLP violations, not scan for threats/malware. 

Hi all, I am trying to setup a public accessable website (home.heinonline.org) as a published private app on a publisher. But it looks like that all attempts to access this website from an off-prem client steers the traffic through Netskope instead of going to the publisher. The reason I want to do this is that user when accessing the website will "auto-authenticate" when on-prem (via IP identification). And I am hoping to get the same result of "auto-authenticate" for off-prem users by publishing the website as a private app on a publisher that is on the same network as on-prem users. Any ideas on what I can do to make this work? Thanks in advance.

Hello, Team,We are using the Directory Importer tool as documented https://support.netskope.com/s/article/Netskope-User-Provisioning-with-Secure-LDAP-to-Google-Cloud-Identity.We have groups that contain users from different domains.Example: groupX = [ user1@dmainA.a, user2@domainB.b, user3@domainC.c ].I wonder if there is a solution to synchronize this kind of groupsAny ideas pleaseThanks

We have SCIM integration done between Jumpcloud and Netskope. But seems like some user groups in Netskope does not get populated with the users based on Jumpcloud. Is there any way for me to manually trigger a sync? Or check the sync logs. 

Hello, Can someone tell me how to get the entire incident dump from API query? Can you provide any sample API query and how to customize it? It is fine if the data is in json. We are looking for advanced reporting and would need additional columns than the one displayed in console hence want to explore what options will be present in query. 

Overview Cloud Exchange CLS’s Syslog forwarding gives you the ability to send Netskope Event, Alert, and WebTx messages to any Syslog server. Using the Microsoft Incoming Webhook application from the Admin center Cloud Exchange will send messages to a configured Teams channel to notify you when an Alert was seen from Netskope.  Requirements CloudExchange 3.3.3 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CLS Any Syslog server Syslog Server For testing and writing this document, I am running a Ubuntu 20 LTS Compute Engine on GCP  with Docker and Graylog running in a container. Leave a comment if you would like me to write up that setup.  Verify url/ip and port of your Syslog server In Graylog you can see the input port by going to System > Inputs Netskope Cloud Exchange setup steps Cloud Exchange Plugins On your Netskope Cloud Exchange go to Settings > Plugins You will need two plugins configured for this solu

Overview Cloud Exchange CLS’s Syslog forwarding gives you the ability to send Netskope Event, Alert, and WebTx messages to any Syslog server. Using the Microsoft Incoming Webhook application from the Admin center Cloud Exchange will send messages to a configured Teams channel to notify you when an Alert was seen from Netskope.  Requirements CloudExchange 4.2 or newer Basic Cloud Exchange setup (Netskope tenant API v1 and v2 setup) Netskope plug - Netskope CLS Any Syslog server Syslog Server For testing and writing this document, I am running a Ubuntu 20 LTS Compute Engine on GCP  with Docker and Graylog running in a container. Leave a comment if you would like me to write up that setup.  Verify url/ip and port of your Syslog server In Graylog you can see the input port by going to System > Inputs     Netskope Cloud Exchange setup steps Cloud Exchange Plugins On your Netskope Cloud Exchange go to Settings > Plugins You will need two plugins configured f

In this article we show how to set up an automatic remediation workflow in Azure, leveraging the APIs available in Netskope’s Cloud Security Posture Management. We’ll show how a security rule can be automatically remediated in Azure, and we’ll show how that remediation can happen  either based on a time trigger or a HTTP trigger.   This workflow can be used for many types of violation, in this article we will be considering the use case where we want to remedy a violation where an Azure key Vault does not have purge protection enabled.   The source code is available at https://github.com/netskopeoss/CSPM-Azure-AutoRemediation Setting Up   Netskope SPM detects violations for key vaults where purge protection is disabled as a part of the rule: Ensure KeyVault is recoverable. In this solution there are two Azure function apps involved. The first is a FetcherForKeyVaultRecoverableHTTP used for getting a list of violating resources from Netskope SPM. The second is a

Netskope introduced REST APIs for Netskope Private Access earlier this year in R91. These REST API endpoints allow for networking and security teams to automate application onboarding, infrastructure management, and policy for Private Access. Now if you aren’t familiar with Netskope Private Access, you can find an overview here. Netskope Private Access essentially has three key components used to manage access to your enterprise applications: Publishers are lightweight virtual machines that broker access to your internal applications by connecting to the Netskope cloud. Publishers are supported in public clouds including AWS, GCP, and Azure along with private data center virtualization such as Hyper-V or ESXi. Additional platforms are supported as well. App Definitions are Netskope objects used to determine the hostnames, ports, and IP addresses that your end users can access via Netskope Private Access. Real-time Protection Policies grant or deny access to your enterprise a

Netskope’s new graph-powered SaaS Security Posture Management (SSPM) engine can help security analysts investigate root causes and identify repeating patterns for all kinds of security misconfigurations. To help one get started with the SSPM and the powerful queries made available by the Netskope Governance Language (NGL), we’ve collated this post to show you some easy sample investigations you can perform with Azure AD / Microsoft 365 environments. To get to the Next Gen SSPM features and NGL from the Netskope main view, one needs to navigate to “API-enabled Protection -> Security Posture (Next Gen) -> Inventory” and click the icon on the right side of the filters toolbar. This opens up the NGL query tool which we will be using for the rest of the article.   The most basic use case for NGL would be to simply list resources by their type. Since NGL is a pattern matching language designed to identify which resources comply with a given criteria, we need to formulate our quer