Product Forums

Is anyone else seeing issues with Microsoft API throttling for Netskope forensic and quarantine data using Microsoft Sharepoint.  Where the data is not available in Netskope tenate, due to Microsoft throttling kicking off error codes. If so How did you resolve the issue?  Was moving to Azure Blob the solution? 

How to monitor / enable the restriction for Chrome OS ? 

Hi,   We have internal web based applications and which is accessible only from allowed ip's. We have whitelisted entire Netskope ip range and still we are not able to access the web application. Is there any option?

Certificate pinned applications by definition are not susceptible to ssl interception and without ssl interception we are blind to what is going on. Unfortunately most native applications, those that are running as an executable, are certificate pinned. If you try to intercept ssl traffic from these applications you will break the application. As a result you are forced to bypass traffic from these applications. the problem then arises as to which sites is the application trying to get too. Idealy you just ask the developer, but sometimes this is not an option so as an alternative you can run this simple script to identify the sites that we see the process trying to access  for example in Windows using Powershell: get-content c:userspublic etskope sdebuglog.log -tail 5 -wait | Select-String "slack.exe"   this basically will parse the nsdebuglog.log and pull out whatever matches the process, in this case slack.exe     Once you've identified the sites you can then pl

Facing challenges on the NPA report, not able to see how many active users are connected. Is there any options o create the dashboard for npa traffic 

The Netskope Cloud Confidence Index tool allows gives you a readiness assessment of every application being accesse by your employees, contractors and other 3rd party users.   The CCI is adapted from the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM). factors in more than 50 security, audibility, and business continuity controls.   In many cases, customers want a customized search of (1) applications, (2) CCLS ratings, (3) <your custom tags>, (4) categories or (5) attributes.     HINT: within the CCI toolset of your tenant, you can select 'Advanced Search".   As you begin to type a specific criteria name, the autofill option will activate (see image).   some example advanced searches include:   <apps by name> type  app = Box or app = Dropbox <CCL rating> type ccl = medium <categories> type appcategory = 'Cloud Storage' <CCI attribute> type app-cci-app-tag = San

Tenant specific configuration These configurations are common configuration shared across all the users (as they are under one tenant). Netskope client service loads these common configurations as soon as it starts and updates on these configurations are done on events like policy change, config change (checked periodically). Config Location Netskope-client for Windows stores these configurations in “%PROGRAMDATA%/netskopestagent”.Netskope-client for MacOS stores these configurations in “/Library/Application Support/Netskope/STAgent” Config Files S.No. Config File Purpose Fetching Mandatory Config API Frequency API Timeout 1 nsconfig.json contains various tenant-level configurations When Config version changes (polls for latest config) On-demand config update (from nsdiag or UI) User Login-Event (done to identify if we have config of a higher priority user group) Yes (default is generated) v2/config/org/clientconfig?orgkey=<orgkey>&

Since the upgrade to version 85, I started to notice it doesn't look as if cert pinned application exceptions recognize or apply tunnel exclusions any more. I'm opening a case with Support but I wanted to reach out here to see if anyone else experienced anything similar first. There is a exception for python.exe and if i use the tunnel settings it'll bypass any connections made to those domains but attempt to intercept everything else.    For Example:Python.exe > Tunnel Mode: pypi.org and Pythonhosted.org 

I wanted to share with all of you a video tutorial on how we recommend you manage URL recategorization process with your users via Netskope tenant.  Also, the video includes information about how to accelerate and unblock users access to certain URLs they may need to access on an exception basis or in case the recategorization request is not completed fast enough.  Hope you find this video helpful.  To create a mechanism in your blocking or coaching page to drive user to submit a recategorization requestion, please use the following example as to what should go in the User Notification page Message portion of the UI:     You are trying to visit a site that is prohibited by the company's Acceptable Use Policy and it has been blocked. If you think this site shouldn't be blocked, click <a href="https://www.netskope.com/url-lookup?url={{NS_URL}}&email={{NS_USER}}">here</a> to submit a web site recategorization.     Enjoy the video! &n

Does any one know if there is a way to build Real time access policies based on the referer site? I have a use case where a user is using a web app and trying to upload a document to an S3 bucket and unfortunately it's not pulling any instance information so it's going to a generic url we aren't comfortable with whitelisting but if we could base the access on the referer or the page site that would be something we'd be a little more comfortable with. 

Here's a slightly different perspective on building policies to manage users' activities within cloud applications. Keeping both data risk and operational risk low through the use of user alerts and coaching... [recorded presentation - 5m 49s]  

If you find yourself in a situation where you are not using the client and need to know exactly what to bypass in SSL Decryption policy or Steering Exceptions, you can use the following to quickly determine what domains you need to focus on.   Netskope relies on private keys in order to determiner the URLs for any HTTP traffic that has been encrypted using TLS.  If you don't have the private keys, you can query the SNI from the certificate exchange for the domains being called.   To do this, simply capture a successful application session using Wireshark then run the following command against the PCAP to pull the domains from the SNI in the certificate exchanges.   tshark -r ~/file.pcapng -T fields -e tls.handshake.extensions_server_name | sed ‘/^$/d’   This will produce a list separate from the below example: a88.oms.opinsights.azure.com dc.services.visualstudio.com management.azure.com login.microsoftonline.com batchexplorer.azuree

SASE means Secure Access Service Edge, a term crafted by Gartner. SASE architecture delivers both “WAN capabilities” and “security” as a “cloud service” directly to the source (users, devices, IoT, etc.) without backhauling to enterprise data centers.   It is a fact that the Internet was not designed by keeping security in mind, as in the beginning it was not meant for business. Later, Internet security started with the Firewall when businesses started connecting to the internet. Firewall blocks outsider access to the business network while allowing returning traffic when employees access public services (websites). As the internet grew, firewalls were enhanced with URL-filtering based on URL-categorization to block website access based on content categories such as business, gambling, education, and violence. Firewalls were further enhanced with App-Control and Data-Loss-Prevention (DLP) capabilities as employees, as well as businesses, started using cloud apps from the enterpris

Hi everyone   if you still haven't registered for this event, you still have time, it starts in 30 min....   May 26 , 2021 8:00am PDT   If you would like to attend the session please register with the following link https://events.netskope.com/highestimpactcasbtipsbestpract   please feel free to reach out if you have any questions.

Has anyone used Private access to tunnel in for services on servers, I know I can install it but if its not logged in as a user is there a way to get it to steer traffic still.  I dont think this is possible without scripting in a login with a service account but figured id ask.  

Has anyone had any issues with interactive login's executed via powershell when behind the Netskope SWG?For example: when connecting to exchange online or any kind of Microsoft service via powershell you are typically prompted with a O365 login prompt but when behind SWG we get "New-ExoPSSession : An error occurred while sending the request.." I found 2 work arounds 1) disabling the Netskope client and 2) custom app in the steering configuration to bypass login.microsoft.com when connecting via powershell.exe. I'm wondering if anyone else had experienced this or could think of another work around.

The SkopeIT query bar is powerful tool to show filtered data. Sometimes it is a bit challenging to find the name of a field to be used in a query. E.g. we recently introduced a new SkopeIT field called "Netskope Pop". This field tells you, where the traffic was enforced. The get field name for a query just mouse over the field in the detailed event view (see screenshot). Then you can use it in a query like this: "netskope_pop like FRA1".

Does anybody know how to change the name of a custom Certificate Pinned Application created for traffic steering, is that even possible?

In case you weren't aware, Netskope has been supporting RBI for several months now.  With RBI, risky web pages are rendered in a remote browser and only the pixels (not the potentially malicious code) are sent down to the user's browser.  I've deployed this recently with a few of my customers and great use cases have surfaced.  RBI automatically prevents downloads/uploads from risky sites.  This allows users to browse sites but prevents potentially malicious downloads.  The second use case comes into play when Uncategorized websites are sent to RBI.  You may have a newly registered domain for an app like yourcompany.altlassian.com.  If you are blocking the Uncategorized category, users will most likely open up support tickets and the site will need to be whitelisted.  With RBI, users will still be able to see those sites as they will be safely rendered in the remote browser session.  One customer mentioned that this will greatly reduce their

Question: How can I tell if my traffic is being intercepted by Netskope from a browser?

Interested in checking out Netskope's FedRAMP status?   Click HERE.  

Collaboration & Messaging apps like Webex, Zoom, Teams, and Slack can be challenging for any organization to tackle. As these cloud resources are being consumed from remote locations maintaining control of what users can and cannot share has become more challenging. Furthermore, consider apps like QQ, WeChat, and KakaoTalk that use certificate pinning, and you quickly realize that control becomes a privacy concern. This doesn't always have to be the case, however in this battle for control its more important than ever to address privacy first.   Here are a few things to consider: Some applications leverage other Cloud Storage Resources to share content. For instance Cisco Webex Teams uses alternate domains for Cisco Spark Messaging and chat. MS Teams uses OneDrive, Zoom can use Google Drive. Mapping collaboration and messaging apps to Cloud Storage will minimize false negatives and make policy creation and testing much easier. De-sanctioning of cloud apps and understanding wh

The first step in adopting a Zero Trust or cloud based Remote Access solution is to ensure you have an Identity & Access Management solution that integrates with your SASE provider to deliver rich contextual access based controls.  Below is an example of how Netskope integrates with Okta to ensure identity and source of truth governance are defined and delivered as part of a Zero Trust adoption strategy.   

The February 2021 Cloud And Threat Report highlights 5 themes we saw in 2021 for our NG-SWG customers:   The majority of malware is delivered via cloud apps Malicious Office documents continue to be used to deliver malware Nearly half of all cloud apps in use in the enterprise have a poor CCI rating 83% of users upload data to personal apps on managed devices Cloud phishing continues to increase, using cloud-hosted baits and targeting cloud credentials Along with the report, we have published a series of blog posts that contain additional details from the report.    If you want to find out more about what is happening in your environment, you can use Advanced Analytics.  The following screenshot shows the malware, phishing, and CCI breakdown for apps within a specific enterprise environment.  This particular environment sees more cloud malware and less cloud phishing than the report shows.  How do you stack up?     https://resources.netskope.c

Businesses everywhere are facing the challenge of how to keep remote workers collaborative while also protecting their users and data. In this Straight Talk video, Netskope CISO, Lamont Orange discusses the importance of secure collaboration for today’s remote world.