Product Forums

Below is a link to a very simple Netskope tool that will perform a quick check on 17 different checks across 3 security categories: (1) Web & Cloud Categorization (2) Threat Protection and (3) Data Loss Protection.   https://netskopesecuritycheck.com/   A simple online tool to gauge the effectiveness of your initial Netskope security policies.

Hello, I'm looking at deploying a Microsoft group policy for CID 1172  which is : Status of the 'MSS -  (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' setting. If I'm using a proxy to split http traffic over a SDWAN will this GPO impact my users or the proxy attempting to re-route client traffic? 

As we deply Big Sur, we have detected that it breaks WebEx and GITHUB Enterprise on AWS.Does anyone else have any other apps to report? Both of these are not a problem when we disabled the client.Strangely enough, we are not steering either (WebEx is disabled, GITHUB is an internal site), so this is a fundamental interaction problem.  @DaveKerr 

Good afternoon all, I've got a slight issue and I'm wondering if anyone here can help me with this, I'm looking to set up a VPN connection so I can create an online hybrid azure AD join from Microsoft Endpoint. I need direct visibility of our on-prem domain controllers Now I guess the first question is, is this actually possible with the options Netskope has available? I can see the following options available within Endpoint IKEv2, PPTP and L2TP All I'm looking for is a VPN tunnel which will only provide access to domain controllers over the internet during the build process. Can NetSkope facilitate this? Thanks very muchRGE_Master

Netskope URL Lookup Tool is a handy tool when it comes to creating Netskope web policies or submit mis-categorization requests to Netskope team. https://www.netskope.com/url-lookup This tool is accessible when Netskope client is enabled. From within tenant policies dashboard the tool also gives you other details of significant importance such as which policies or steering exceptions or custom categories the url applies to. Here is a recommend sequence of configuration tasks when creating a custom URL list. 1. Verify if the URL is part of an existing Netskope category, policy or steering using URL Lookup tab2. Create a URL list by going to URL Lists tab3. From custom categories tab attach the custom list to a new or existing custom category as "include" or "exclude" list.4. Apply the category to a Real-time protection policy

Netskope’s Secure Web Gateway supports HTTP/S traffic on any port.  While Netskope’s Cloud Firewall can control any port and protocol, Secure Web Gateway customers may have use cases to block certain high risk apps that use non-HTTP/S ports and protocols.  For example, TeamViewer uses port 5398 for communication but fails over to port 443 if port 5398 is unavailable.  By default, the Netskope Web Gateway drops non-HTTP/S traffic so administrators can block TeamViewer in its entirety by following the instructions below:   Navigate to Settings > Security Cloud Platform > Steering Configuration. Select the steering config you wish to apply this to.  Click EDIT in the top right corner.  Click the NON-STANDARD PORTS tab. Check the box next to Steer non-standard ports. Create entries and teamviewer.com and *.teamviewer.com with port 5938. Click SAVE. Change to the EXCEPTIONS tab.  Add or edit the TeamViewer Certificate Pinned Application and set the

We moved federated domain name to our Netskope tenant SSL bypass instead of the client steering but when we did that it broke the Catalina Mac's getting to VPN. We are now getting a black page. Please see screen shot. Has anyone seen this?

Dear AllI need your kind input if you have experienced similar issue as under:I have installed the netskope client without full connectivity/routing at the backend. The client connects to the tenant only. The NS Client config states <Gateway IP: N/A (Explicit Proxy: 185.x.x.x) > The zscaler proxy PAC configuration is still active and the PROD config. Then purpose of installing the NS Client is to test the deployment and to scope co-existence and prestaging the NS Client.The client was installed on a laptop connecting to the organisation through SIM. The average data usage of that device spiked from 40GB and month to 530GB. Did anyone experienced similar issue at any stage with the NS Client.I am troubleshooting the data usage through the Win10 Data Usage feature.I was also wondering if the data usage can be tracked from the NS Tenant/console?Thanks in advance. 

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM).   Netskope CSPM continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for AWS enables you to automatically mitigate the risk associated with these misconfigurations in your AWS cloud environment.   Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API. Netskope auto-Remediation solution for AWS deploys the set of AWS Lambda functions that query the above Netskope API on the scheduled intervals and mitigates supported violations autom

We've continued our blog series on AWS Best Practices, and just published: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-logging . Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base:   Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated w

Azure has the following logic to check  Active Directory for stale users: refreshTokensValidFromDateTime > STS TokenLifetimePolicy MaxInactiveTime (default of 90 days for Azure, may vary for customer) + acceptable number of days past the refresh token, for which an account can be inactive( in this case 30).   Security Posture Management can help with custom rule for above use case as in :   User should not have LastTokenChange isEarlierThan ( -120, "days")

Public IP addresses allow Internet resources to communicate inbound to Azure resources.   Security posture Management can help with custom rules to ensure that specifically tagged VM instances  donot have a Network Interface with public IPs assigned. The custom rule would look like following:   VirtualMachine where Tags with [ Name eq "confidential" ] should not have NetworkInterfaces with [ IPConfigurations with [ PublicIP len () gt 0 ] ]

Every company uses tagging and resource labeling in their own way. Among other uses, mature labeling practices are a great way to identify resources to their cost centers, keep track of their purpose and contents for compliance requirements and for naming ownership and maintenance responsibilities. Netskope Security Posture Management can help enforce good labeling practices with a few simple custom rules suited to your needs. How to ensure that every resource of a given type is labeled properly Most common use case for label policy enforcement is to ensure that resources are labeled at all. For example, if we want to ensure that every EC2 instance in our AWS Cloud carries a label named "org-unit", we can write the following rule for AWS monitoring:  EC2Instance should have Tags with [ Name eq "orgunit" ]   Once added to a compliance profile and being monitored by a Security Posture Policy, this rule should show in the Security Posture view with findings like this:   Likewi

Organizations have their own  convention of tagging buckets containing PII objects . We can leverage Security Posture Management to create custom rules to check if these specifically tagged buckets are open to the public:   AWS : S3Bucket where Access eq "Public" should not have Tags with [ Name eq "PII" ]   Azure: StorageAccount where ( Tags with [ Name eq "PII" ] ) should have every BlobContainers with [ Access eq "None" ] or not AllowBlobPublic   GCP: Bucket should not have Policies with [ Members . AllUsers eq True or Members . AllAuthenticatedUsers eq True ] and Tags with [ Name eq "PII" ]

Inside an AWS Private S3 bucket, a specific object can be made public by using any of the following steps:     Update the object's access control list (ACL) using the Amazon S3 console Update the object's ACL using the AWS Command Line Interface (AWS CLI) In order to make sure that a specific object is not turned public inside an otherwise private S3 bucket, we can make use of the AWS Block Public Access Settings , specifically the IgnorePublicAcls (Block public access to buckets and objects granted through any access control lists (ACLs)) boolean. Netskope SPM allows to write  custom rule for checking the above  configuration for each S3 bucket: S3Bucket should have Access eq "Private"  

Build custom rules under Policies > Security Assessment using Domain Specific Language (DSL) for Security Assessment of AWS, Azure, and Google Cloud resources.   The following syntax diagram represents the general rule to write a DSL statement.     Rule Format: <entity> [where <condition>] should [not] have <condition>   For example: Entity An entity defines what the rule is checking against. It can be used alone or with a condition to further specify the entity. Here are some examples of using an entity.   Condition A condition is a standard that the rule uses to check against an entity to narrow down the result.     The following table provides examples of using a condition. The formats in this table are applicable to all properties. Function Use functions in rules to find specific information about entities. Functions use the following syntax, <entity> <function>(<argumen

Security groups (AWS, Azure) and firewall rules provide stateful filtering of ingress/egress network traffic to Cloud Provider resources. The AWS rule below provides protection against security group allowing unrestricted ingress access to port 22 (SSH). This rule can easily be modified to provide similar protection for other ports such as RDP (3389), Oracle DB (1521), PostgreSQL (5432), MySQL DB (3306), MongoDB (27017), Microsoft-DS (445), HTTP (80), TCP (445), DNS (53), FTP (21), Telnet (23), SMTP (25), and more. See below for example rules in AWS, Azure, and GCP.   AWS: EC2Instance should not have SecurityGroups with [ InboundRules with [ IPRanges with [ IP isPublic () ] and Protocol in ("-1","tcp") and ( (FromPort lte 22 and ToPort gte 22) ) ] ]   GCP: FirewallRule where Disabled eq False should not have Direction eq "INGRESS" and Allowed with [ Protocol in ("all", "tcp") and Ports with [ ( FromPort lte 23 and ToPort gte 23 ) ] ] and SourceRanges with [ Value eq 0.0.0.0/0

Hi Everyone, We have a handful of users that are still on v78.  We would like to upgrade everyone's client to v87 by allowing the client to upgrade automatically in the client configuration settings.  If this feature is enabled in the tenant, will it remove the previous version and install / overwrite with the new version automatically or we would have to manually uninstall and manually reinstall ? Thanks,David

Dear AllWe are implementing Netskope and as part of implementation we might have to set an explicit proxy (browser) for the initial phase of  implementation. I am deploying the client and if an explicit proxy setting is required for all the Windows 10 fleet then I can always achieve through a GPO settings. But I was wondering if this settings can be pushed from the tenant. This info looks promising https://docs.netskope.com/en/explicit-proxy-217835.html but I don't have enough understanding to vouch this approach. Any thoughts would be very much appreciated.

Best practice when implementing Network Private Access is to have backup connectors for your private applications,  ensuring fan-out for cloud and data center environments.   Publishers work in Active-Active mode. Active-Active mode enables higher throughput. Up to 16 publishers are supported in an Active-Active deployment per app.   A round-robin algorithm is used to spread Netskope Clients across publishers.   Adding additional publishers to the private application allows for this feature.     Note: The publishers should be able to access the applications for which they are to publish.   See the Netskope Private Access User Guide for more details: https://support.netskope.com/hc/en-us/sections/360007379173-Netskope-Private-Access-User-Guide    Credit: The Netskope Private Access Virtual Team.

Hello,   About 90% of our users are on MacOS BigSur with full admin privileges on their laptop.  With older clients (v81 or below); users can simply go to Network Preferences and Click disconnect to stop Netskope from intercepting 80/443 traffic.  I have tested on client v87 and this issue has been fixed.  But we noticed that users are finding more creative ways to disable Netskope by doing the following in terminal:(1) sudo chmod -x /Applications/Netskope Client.app/(2) Activity Monitor --> Search for Netskope Client --> Force QuitHow do we prevent such actions?Thanks!

Dear All,I am new to Netskope. I am in the process of deploying the Netskope client as a part of migration from zscaler to Netskope. I was wondering what is the best practice to check a successful client installation and connectivity from the Win10 devices without accessing the admin console.I am checking the Netskope Client Configuration screen and nslookup to the netskope server/appliance. Is there any better way to test connectivity and functions as a checklist for successful client install.Thanks in advance. 

I'd like to look for suicidal thoughts in Search Engines to help me better help students at risk. Is there a way to do this?

We have been using Netskope for 3 years now and the journey started off with the CASB product. Since beginning of this year we started using the SWG product as well and honestly it has helped us to reduce the web security risks.   Our environment has mostly Windows and Mac OS endpoints with around 100 devices running on Linux, CentOS or Ubuntu. With the current coverage from Netskope we are not able to ensure similar level of security for these devices.   Is there any plan for extending support for these platforms (Linux, CentOS, Ubuntu, etc.) going forward?

Windows: "%ProgramFiles(x86)%NetskopeSTAgent sdiag.exe" -o "%USERPROFILE%DesktopNetskope.zip”   OSX: "/Library/Application Support/Netskope/STAgent/nsdiag" -o ~/Desktop/Netskope.zip