Product Forums

Hii community,   I have noticed that in netskope platform, we are not able to see incidents but alerts so i had a question that "How do DLP incidents get converted into Netskope Alerts?".   Looking forward to answer. Thanks

Does anyone out there know if you can embed a link into the custom block page messages a user receives?

We are looking to deploy the Netskope client in our VDI environment. The VDI systems are running Windows 10 are non persistent with FSLogix, so upon logging out of the Virtual machine, the device is removed from the environment and then rebuit, thus a fresh machine that could be randomly assigned to any user. FSLogix allows the clients to maintain data they want persistent in their profile.I am wondering if there is any special configuration that I need to do when deploying the client to these VDI systems on the Golden Image/Master Build? Would this below suffice?******\servershareNetskopeNSClient-90.1.0.805.msi token=12345abcde host=addon-company.goskope.com mode=peruserconfig autoupdate=off /qn******Would there be anything else I need to do on the client? We use the above command to deploy to our physical Windows endpoints successfully.Thank you.

In our latest Cloud and Threat Report, we breakdown the most significant trends we saw in 2021: Google Drive emerges as the top app for malware downloads Emotet copycats continue to abuse Microsoft Office documents More than half of managed cloud app instances are targeted by credential attacks Rate at which users leave their jobs (and take data with them when they do) doubles   One of the major highlights was the while OneDrive was the top app for malware downloads in 2020, Google Drive took the top spot in 2021, with OneDrive coming in second place.               And then, in our December Threat Labs Report, you will find a detailed view of last month’s threat activity, which shows that even tho Google Drive was at the top for most of the year, it has already begun to fall, being replaced yet again by Microsoft OneDrive.     What is going on here? Well, OneDrive and Google Drive are incredibly popular, so attackers try to abuse th

Dear All, We are migrating to Netskope Proxy and was wondering if it is possible to block IE11 traffic to the internet. We will still want to allow any intranet traffic (create rules as business case comes up supporting legacy app in the intranet). I am aware that this can be done by Applocker and AV policies but I was thinking that NetSkope CASB would be the ideal technology so that the configuration is dynamic enough to allow legacy app as required. This initiative is to align with ASCS Essential 8 maturity model. The closest info that I have is https://www.netskope.com/blog/ie-vulnerability Thanks in advance.  

Environment: Netskope client installed with client configuration "Allow disabling of Clients" disabled Requirement: Need to Disable/Enable Netskope client from admin console instantly.   Hi Folks,   We might have faced an event where we have to enabledisable Netskope client from the admin console, But it takes more than 2-3 minutes to get it reflected on the Client. Sometimes it takes more than 5 minutes to get it reflected on the end-user machine which really makes the troubleshooting duration extended.   Resolution:   1) EnableDisable Netskope client from Security Cloud Platform > Netskope Client > Devices 2) Add some dump changes on Client steering configuration (Security Cloud Platform > Traffic Steering > Steering Configuration)3) Revert the steering configuration changes back.4) Click OK.5) Update the Netskope client configuration. Now Client will be enableddisabled instantly.   eg: Check the attached screenshot. Here I have edited "s" fr

Hi All,  I am looking for getting alerts from the Netskope tenant. So far I am seeing 2 API endpoints which gives me similar results.  https://docs.netskope.com/en/get-alerts-data.html https://docs.netskope.com/en/view-security-assessment-violations.htmlCan someone please help me understand the difference between them? And when should I use which endpoints?  I am very new here, let me know if I started the discussion at the wrong place. thanks!

For some reason I felt that in a recently Netskope release I saw something about a referrer policy.   We have run into issues in our organization with some websites functioning properly as we silently block the "Online Ads" URL category. Often times, a URL may be classified as Online Ads, but may be necessary for the website to function. We have often just created a real-time protection policy to permit the URLs in a URL list and applied this to the appropriate users. I thought I saw something about using a referrer policy in a recent release that if you permitted the main page, any subsequent URLs that were loaded were also permitted. Almost like a parent-child relationship with processes. I may be dreaming, but I could not find anything in the recent release notes or documentation.   If this does not exist, does this functionality exist if Netskope does not have a defined Cloud App that would permit the associated URLs? Would the only action be to create the URL lists as we

We began updating a test group to client release 90 earlier in the week, and have experienced issues with VPN (Cisco Anyconnect) and launching web apps from Citrix (even on-prem hosted).  Just curious if anyone else has experienced issues with Client R90?

Hello community,   Is there anyone who tested Netskope for Android? (Next-Gen SWG, CASB or NPA)  Any idea on how to set it up or any recommendations for articles/KBs ? Thank you!

Have placed this under SWG but it applies generally to the GoSkope interface.   Is there a way to export and import data from the various sections into CSV or another format? Or maybe there is some CLI or API?   For example the policies, or traffic steering exceptions, or any of the other sets of data. This will make it easier to collaborate and edit information en masse. At the moment we update each item individually and are stuck with web interface for presenting data.

Netskope Admin Console can be tied with your Identity Provider (IDP) such as Okta or Azure. It's just a few checkboxes that you would normally enable on Netskope tenant to allow users on IDP to login to Netskope using admin-role attribute for the Role Based Access Control. There are just a few checkboxes and strings you add to the Netskope tenant. Most configuration is done on the IDP. Okta and Azure have an app published for this purposed called "Netskope Admin Console".  Once SSO is enabled users assigned to this app can login by going to your Netskope tenant URL (SP initiated flow) or by going to the IDP and launching Netskope app from there (called IDP initiated flow). While turning this off you would normally uncheck the "Enable SSO" checkbox on Netskope tenant. Just wanted to make you aware that this will turn off the SP initiated flow i.e. Netskope will not redirect you to the IDP. But the users on the IDP may still be able to launch the app and login using IDP initiated flow. T

The guides linked to below illustrate how to configure Netskope IPSec tunnels with your AWS environment for egress traffic filtering and monitoring. This integration provides unmatched visibility and real-time data and threat protection for the traffic leaving your AWS environment. Steering your AWS egress traffic to the Netskope cloud allows you to apply full capabilities of the Netskope platform, including cloud network firewall, web content filtering, data leakage and threat protection, third-party risk protection, etc. You can integrate your AWS environment with Netskope with the following methods: You can establish IPSec VPN tunnels with AWS Site-to-Site VPN between your AWS virtual private gateway, which is associated with a single Amazon Virtual Private Cloud (VPC) and Netskope Points of Presence (POPs). You must repeat this implementation for each Amazon VPC from which you’d like to steer traffic to the Netskope cloud. With this option, you can stream up to 250 Mbps of bandwidt

The Netskope CSPM and Storage Scan services are multi-account security solutions that provides visibility into resources, configurations, data protection, and malware on the AWS cloud. Implementing this solution, you can identify and remediate risky misconfigurations, identify sensitive data (DLP), and detect malware and ransomware.   The purpose of the AWS Implementation Guide is to enable every AWS Marketplace customer to seamlessly activate, deploy and configure the Netskope CSPM and Storage Scan in AWS Control Tower environment while taking full advantage of the resources pre-configured by AWS Control Tower as part of the initialization.   Solution overview and features Netskope Cloud Security Posture Management (CSPM) and Storage Scan allows organizations to confidently adopt and secure multi-cloud services. The Netskope solution gives organizations the ability to continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensiti

In case you missed it IDC came out with their 2021 MarketScape for Cloud Security Gateways earlier this month.  Cloud Security Gateways is IDC's category for CASB products.   Netskope CASB was recognized as surpassing all vendors in IDC’s criteria for both Strategies and Capabilities.  In the new report, IDC specifically points out Netskope’s ability to handle “advanced use cases,” including “compromised account, data exfiltration, and malicious/accidental insider threat detection.”  If you're interested you can get your copy of the excerpt covering Netskope Get your copy of the IDC report today.

Below is a link to a very simple Netskope tool that will perform a quick check on 17 different checks across 3 security categories: (1) Web & Cloud Categorization (2) Threat Protection and (3) Data Loss Protection.   https://netskopesecuritycheck.com/   A simple online tool to gauge the effectiveness of your initial Netskope security policies.

Hello, I'm looking at deploying a Microsoft group policy for CID 1172  which is : Status of the 'MSS -  (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' setting. If I'm using a proxy to split http traffic over a SDWAN will this GPO impact my users or the proxy attempting to re-route client traffic? 

As we deply Big Sur, we have detected that it breaks WebEx and GITHUB Enterprise on AWS.Does anyone else have any other apps to report? Both of these are not a problem when we disabled the client.Strangely enough, we are not steering either (WebEx is disabled, GITHUB is an internal site), so this is a fundamental interaction problem.  @DaveKerr 

Good afternoon all, I've got a slight issue and I'm wondering if anyone here can help me with this, I'm looking to set up a VPN connection so I can create an online hybrid azure AD join from Microsoft Endpoint. I need direct visibility of our on-prem domain controllers Now I guess the first question is, is this actually possible with the options Netskope has available? I can see the following options available within Endpoint IKEv2, PPTP and L2TP All I'm looking for is a VPN tunnel which will only provide access to domain controllers over the internet during the build process. Can NetSkope facilitate this? Thanks very muchRGE_Master

Netskope URL Lookup Tool is a handy tool when it comes to creating Netskope web policies or submit mis-categorization requests to Netskope team. https://www.netskope.com/url-lookup This tool is accessible when Netskope client is enabled. From within tenant policies dashboard the tool also gives you other details of significant importance such as which policies or steering exceptions or custom categories the url applies to. Here is a recommend sequence of configuration tasks when creating a custom URL list. 1. Verify if the URL is part of an existing Netskope category, policy or steering using URL Lookup tab2. Create a URL list by going to URL Lists tab3. From custom categories tab attach the custom list to a new or existing custom category as "include" or "exclude" list.4. Apply the category to a Real-time protection policy

Netskope’s Secure Web Gateway supports HTTP/S traffic on any port.  While Netskope’s Cloud Firewall can control any port and protocol, Secure Web Gateway customers may have use cases to block certain high risk apps that use non-HTTP/S ports and protocols.  For example, TeamViewer uses port 5398 for communication but fails over to port 443 if port 5398 is unavailable.  By default, the Netskope Web Gateway drops non-HTTP/S traffic so administrators can block TeamViewer in its entirety by following the instructions below:   Navigate to Settings > Security Cloud Platform > Steering Configuration. Select the steering config you wish to apply this to.  Click EDIT in the top right corner.  Click the NON-STANDARD PORTS tab. Check the box next to Steer non-standard ports. Create entries and teamviewer.com and *.teamviewer.com with port 5938. Click SAVE. Change to the EXCEPTIONS tab.  Add or edit the TeamViewer Certificate Pinned Application and set the

We moved federated domain name to our Netskope tenant SSL bypass instead of the client steering but when we did that it broke the Catalina Mac's getting to VPN. We are now getting a black page. Please see screen shot. Has anyone seen this?

Dear AllI need your kind input if you have experienced similar issue as under:I have installed the netskope client without full connectivity/routing at the backend. The client connects to the tenant only. The NS Client config states <Gateway IP: N/A (Explicit Proxy: 185.x.x.x) > The zscaler proxy PAC configuration is still active and the PROD config. Then purpose of installing the NS Client is to test the deployment and to scope co-existence and prestaging the NS Client.The client was installed on a laptop connecting to the organisation through SIM. The average data usage of that device spiked from 40GB and month to 530GB. Did anyone experienced similar issue at any stage with the NS Client.I am troubleshooting the data usage through the Win10 Data Usage feature.I was also wondering if the data usage can be tracked from the NS Tenant/console?Thanks in advance. 

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM).   Netskope CSPM continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for AWS enables you to automatically mitigate the risk associated with these misconfigurations in your AWS cloud environment.   Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API. Netskope auto-Remediation solution for AWS deploys the set of AWS Lambda functions that query the above Netskope API on the scheduled intervals and mitigates supported violations autom

We've continued our blog series on AWS Best Practices, and just published: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-logging . Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base:   Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated w