Product Forums

Azure has the following logic to check  Active Directory for stale users: refreshTokensValidFromDateTime > STS TokenLifetimePolicy MaxInactiveTime (default of 90 days for Azure, may vary for customer) + acceptable number of days past the refresh token, for which an account can be inactive( in this case 30).   Security Posture Management can help with custom rule for above use case as in :   User should not have LastTokenChange isEarlierThan ( -120, "days")

Public IP addresses allow Internet resources to communicate inbound to Azure resources.   Security posture Management can help with custom rules to ensure that specifically tagged VM instances  donot have a Network Interface with public IPs assigned. The custom rule would look like following:   VirtualMachine where Tags with [ Name eq "confidential" ] should not have NetworkInterfaces with [ IPConfigurations with [ PublicIP len () gt 0 ] ]

Every company uses tagging and resource labeling in their own way. Among other uses, mature labeling practices are a great way to identify resources to their cost centers, keep track of their purpose and contents for compliance requirements and for naming ownership and maintenance responsibilities. Netskope Security Posture Management can help enforce good labeling practices with a few simple custom rules suited to your needs. How to ensure that every resource of a given type is labeled properly Most common use case for label policy enforcement is to ensure that resources are labeled at all. For example, if we want to ensure that every EC2 instance in our AWS Cloud carries a label named "org-unit", we can write the following rule for AWS monitoring:  EC2Instance should have Tags with [ Name eq "orgunit" ]   Once added to a compliance profile and being monitored by a Security Posture Policy, this rule should show in the Security Posture view with findings like this:   Likewi

Organizations have their own  convention of tagging buckets containing PII objects . We can leverage Security Posture Management to create custom rules to check if these specifically tagged buckets are open to the public:   AWS : S3Bucket where Access eq "Public" should not have Tags with [ Name eq "PII" ]   Azure: StorageAccount where ( Tags with [ Name eq "PII" ] ) should have every BlobContainers with [ Access eq "None" ] or not AllowBlobPublic   GCP: Bucket should not have Policies with [ Members . AllUsers eq True or Members . AllAuthenticatedUsers eq True ] and Tags with [ Name eq "PII" ]

Inside an AWS Private S3 bucket, a specific object can be made public by using any of the following steps:     Update the object's access control list (ACL) using the Amazon S3 console Update the object's ACL using the AWS Command Line Interface (AWS CLI) In order to make sure that a specific object is not turned public inside an otherwise private S3 bucket, we can make use of the AWS Block Public Access Settings , specifically the IgnorePublicAcls (Block public access to buckets and objects granted through any access control lists (ACLs)) boolean. Netskope SPM allows to write  custom rule for checking the above  configuration for each S3 bucket: S3Bucket should have Access eq "Private"  

Build custom rules under Policies > Security Assessment using Domain Specific Language (DSL) for Security Assessment of AWS, Azure, and Google Cloud resources.   The following syntax diagram represents the general rule to write a DSL statement.     Rule Format: <entity> [where <condition>] should [not] have <condition>   For example: Entity An entity defines what the rule is checking against. It can be used alone or with a condition to further specify the entity. Here are some examples of using an entity.   Condition A condition is a standard that the rule uses to check against an entity to narrow down the result.     The following table provides examples of using a condition. The formats in this table are applicable to all properties. Function Use functions in rules to find specific information about entities. Functions use the following syntax, <entity> <function>(<argumen

Security groups (AWS, Azure) and firewall rules provide stateful filtering of ingress/egress network traffic to Cloud Provider resources. The AWS rule below provides protection against security group allowing unrestricted ingress access to port 22 (SSH). This rule can easily be modified to provide similar protection for other ports such as RDP (3389), Oracle DB (1521), PostgreSQL (5432), MySQL DB (3306), MongoDB (27017), Microsoft-DS (445), HTTP (80), TCP (445), DNS (53), FTP (21), Telnet (23), SMTP (25), and more. See below for example rules in AWS, Azure, and GCP.   AWS: EC2Instance should not have SecurityGroups with [ InboundRules with [ IPRanges with [ IP isPublic () ] and Protocol in ("-1","tcp") and ( (FromPort lte 22 and ToPort gte 22) ) ] ]   GCP: FirewallRule where Disabled eq False should not have Direction eq "INGRESS" and Allowed with [ Protocol in ("all", "tcp") and Ports with [ ( FromPort lte 23 and ToPort gte 23 ) ] ] and SourceRanges with [ Value eq 0.0.0.0/0

Hi Everyone, We have a handful of users that are still on v78.  We would like to upgrade everyone's client to v87 by allowing the client to upgrade automatically in the client configuration settings.  If this feature is enabled in the tenant, will it remove the previous version and install / overwrite with the new version automatically or we would have to manually uninstall and manually reinstall ? Thanks,David

Dear AllWe are implementing Netskope and as part of implementation we might have to set an explicit proxy (browser) for the initial phase of  implementation. I am deploying the client and if an explicit proxy setting is required for all the Windows 10 fleet then I can always achieve through a GPO settings. But I was wondering if this settings can be pushed from the tenant. This info looks promising https://docs.netskope.com/en/explicit-proxy-217835.html but I don't have enough understanding to vouch this approach. Any thoughts would be very much appreciated.

Best practice when implementing Network Private Access is to have backup connectors for your private applications,  ensuring fan-out for cloud and data center environments.   Publishers work in Active-Active mode. Active-Active mode enables higher throughput. Up to 16 publishers are supported in an Active-Active deployment per app.   A round-robin algorithm is used to spread Netskope Clients across publishers.   Adding additional publishers to the private application allows for this feature.     Note: The publishers should be able to access the applications for which they are to publish.   See the Netskope Private Access User Guide for more details: https://support.netskope.com/hc/en-us/sections/360007379173-Netskope-Private-Access-User-Guide    Credit: The Netskope Private Access Virtual Team.

Hello,   About 90% of our users are on MacOS BigSur with full admin privileges on their laptop.  With older clients (v81 or below); users can simply go to Network Preferences and Click disconnect to stop Netskope from intercepting 80/443 traffic.  I have tested on client v87 and this issue has been fixed.  But we noticed that users are finding more creative ways to disable Netskope by doing the following in terminal:(1) sudo chmod -x /Applications/Netskope Client.app/(2) Activity Monitor --> Search for Netskope Client --> Force QuitHow do we prevent such actions?Thanks!

Dear All,I am new to Netskope. I am in the process of deploying the Netskope client as a part of migration from zscaler to Netskope. I was wondering what is the best practice to check a successful client installation and connectivity from the Win10 devices without accessing the admin console.I am checking the Netskope Client Configuration screen and nslookup to the netskope server/appliance. Is there any better way to test connectivity and functions as a checklist for successful client install.Thanks in advance. 

I'd like to look for suicidal thoughts in Search Engines to help me better help students at risk. Is there a way to do this?

We have been using Netskope for 3 years now and the journey started off with the CASB product. Since beginning of this year we started using the SWG product as well and honestly it has helped us to reduce the web security risks.   Our environment has mostly Windows and Mac OS endpoints with around 100 devices running on Linux, CentOS or Ubuntu. With the current coverage from Netskope we are not able to ensure similar level of security for these devices.   Is there any plan for extending support for these platforms (Linux, CentOS, Ubuntu, etc.) going forward?

Windows: "%ProgramFiles(x86)%NetskopeSTAgent sdiag.exe" -o "%USERPROFILE%DesktopNetskope.zip”   OSX: "/Library/Application Support/Netskope/STAgent/nsdiag" -o ~/Desktop/Netskope.zip

Is anyone else seeing issues with Microsoft API throttling for Netskope forensic and quarantine data using Microsoft Sharepoint.  Where the data is not available in Netskope tenate, due to Microsoft throttling kicking off error codes. If so How did you resolve the issue?  Was moving to Azure Blob the solution? 

How to monitor / enable the restriction for Chrome OS ? 

Hi,   We have internal web based applications and which is accessible only from allowed ip's. We have whitelisted entire Netskope ip range and still we are not able to access the web application. Is there any option?

Certificate pinned applications by definition are not susceptible to ssl interception and without ssl interception we are blind to what is going on. Unfortunately most native applications, those that are running as an executable, are certificate pinned. If you try to intercept ssl traffic from these applications you will break the application. As a result you are forced to bypass traffic from these applications. the problem then arises as to which sites is the application trying to get too. Idealy you just ask the developer, but sometimes this is not an option so as an alternative you can run this simple script to identify the sites that we see the process trying to access  for example in Windows using Powershell: get-content c:userspublic etskope sdebuglog.log -tail 5 -wait | Select-String "slack.exe"   this basically will parse the nsdebuglog.log and pull out whatever matches the process, in this case slack.exe     Once you've identified the sites you can then pl

Facing challenges on the NPA report, not able to see how many active users are connected. Is there any options o create the dashboard for npa traffic 

The Netskope Cloud Confidence Index tool allows gives you a readiness assessment of every application being accesse by your employees, contractors and other 3rd party users.   The CCI is adapted from the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). factors in more than 50 security, audibility, and business continuity controls.   In many cases, customers want a customized search of (1) applications, (2) CCLS ratings, (3) <your custom tags>, (4) categories or (5) attributes.     HINT: within the CCI toolset of your tenant, you can select 'Advanced Search".   As you begin to type a specific criteria name, the autofill option will activate (see image).   some example advanced searches include:   <apps by name> type  app = Box or app = Dropbox <CCL rating> type ccl = medium <categories> type appcategory = 'Cloud Storage' <CCI attribute> type app-cci-app-tag = San

Tenant specific configuration These configurations are common configuration shared across all the users (as they are under one tenant). Netskope client service loads these common configurations as soon as it starts and updates on these configurations are done on events like policy change, config change (checked periodically). Config Location Netskope-client for Windows stores these configurations in “%PROGRAMDATA%/netskopestagent”.Netskope-client for MacOS stores these configurations in “/Library/Application Support/Netskope/STAgent” Config Files S.No. Config File Purpose Fetching Mandatory Config API Frequency API Timeout 1 nsconfig.json contains various tenant-level configurations When Config version changes (polls for latest config) On-demand config update (from nsdiag or UI) User Login-Event (done to identify if we have config of a higher priority user group) Yes (default is generated) v2/config/org/clientconfig?orgkey=<orgkey>&

Since the upgrade to version 85, I started to notice it doesn't look as if cert pinned application exceptions recognize or apply tunnel exclusions any more. I'm opening a case with Support but I wanted to reach out here to see if anyone else experienced anything similar first. There is a exception for python.exe and if i use the tunnel settings it'll bypass any connections made to those domains but attempt to intercept everything else.    For Example:Python.exe > Tunnel Mode: pypi.org and Pythonhosted.org 

I wanted to share with all of you a video tutorial on how we recommend you manage URL recategorization process with your users via Netskope tenant.  Also, the video includes information about how to accelerate and unblock users access to certain URLs they may need to access on an exception basis or in case the recategorization request is not completed fast enough.  Hope you find this video helpful.  To create a mechanism in your blocking or coaching page to drive user to submit a recategorization requestion, please use the following example as to what should go in the User Notification page Message portion of the UI:     You are trying to visit a site that is prohibited by the company's Acceptable Use Policy and it has been blocked. If you think this site shouldn't be blocked, click <a href="https://www.netskope.com/url-lookup?url={{NS_URL}}&email={{NS_USER}}">here</a> to submit a web site recategorization.     Enjoy the video! &n

Does any one know if there is a way to build Real time access policies based on the referer site? I have a use case where a user is using a web app and trying to upload a document to an S3 bucket and unfortunately it's not pulling any instance information so it's going to a generic url we aren't comfortable with whitelisting but if we could base the access on the referer or the page site that would be something we'd be a little more comfortable with.