Product Forums

Hello community,   Is there anyone who tested Netskope for Android? (Next-Gen SWG, CASB or NPA)  Any idea on how to set it up or any recommendations for articles/KBs ? Thank you!

Have placed this under SWG but it applies generally to the GoSkope interface.   Is there a way to export and import data from the various sections into CSV or another format? Or maybe there is some CLI or API?   For example the policies, or traffic steering exceptions, or any of the other sets of data. This will make it easier to collaborate and edit information en masse. At the moment we update each item individually and are stuck with web interface for presenting data.

Netskope Admin Console can be tied with your Identity Provider (IDP) such as Okta or Azure. It's just a few checkboxes that you would normally enable on Netskope tenant to allow users on IDP to login to Netskope using admin-role attribute for the Role Based Access Control. There are just a few checkboxes and strings you add to the Netskope tenant. Most configuration is done on the IDP. Okta and Azure have an app published for this purposed called "Netskope Admin Console".  Once SSO is enabled users assigned to this app can login by going to your Netskope tenant URL (SP initiated flow) or by going to the IDP and launching Netskope app from there (called IDP initiated flow). While turning this off you would normally uncheck the "Enable SSO" checkbox on Netskope tenant. Just wanted to make you aware that this will turn off the SP initiated flow i.e. Netskope will not redirect you to the IDP. But the users on the IDP may still be able to launch the app and login using IDP initiated flow. T

The guides linked to below illustrate how to configure Netskope IPSec tunnels with your AWS environment for egress traffic filtering and monitoring. This integration provides unmatched visibility and real-time data and threat protection for the traffic leaving your AWS environment. Steering your AWS egress traffic to the Netskope cloud allows you to apply full capabilities of the Netskope platform, including cloud network firewall, web content filtering, data leakage and threat protection, third-party risk protection, etc. You can integrate your AWS environment with Netskope with the following methods: You can establish IPSec VPN tunnels with AWS Site-to-Site VPN between your AWS virtual private gateway, which is associated with a single Amazon Virtual Private Cloud (VPC) and Netskope Points of Presence (POPs). You must repeat this implementation for each Amazon VPC from which you’d like to steer traffic to the Netskope cloud. With this option, you can stream up to 250 Mbps of bandwidt

The Netskope CSPM and Storage Scan services are multi-account security solutions that provides visibility into resources, configurations, data protection, and malware on the AWS cloud. Implementing this solution, you can identify and remediate risky misconfigurations, identify sensitive data (DLP), and detect malware and ransomware.   The purpose of the AWS Implementation Guide is to enable every AWS Marketplace customer to seamlessly activate, deploy and configure the Netskope CSPM and Storage Scan in AWS Control Tower environment while taking full advantage of the resources pre-configured by AWS Control Tower as part of the initialization.   Solution overview and features Netskope Cloud Security Posture Management (CSPM) and Storage Scan allows organizations to confidently adopt and secure multi-cloud services. The Netskope solution gives organizations the ability to continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensiti

In case you missed it IDC came out with their 2021 MarketScape for Cloud Security Gateways earlier this month.  Cloud Security Gateways is IDC's category for CASB products.   Netskope CASB was recognized as surpassing all vendors in IDC’s criteria for both Strategies and Capabilities.  In the new report, IDC specifically points out Netskope’s ability to handle “advanced use cases,” including “compromised account, data exfiltration, and malicious/accidental insider threat detection.”  If you're interested you can get your copy of the excerpt covering Netskope Get your copy of the IDC report today.

Below is a link to a very simple Netskope tool that will perform a quick check on 17 different checks across 3 security categories: (1) Web & Cloud Categorization (2) Threat Protection and (3) Data Loss Protection.   https://netskopesecuritycheck.com/   A simple online tool to gauge the effectiveness of your initial Netskope security policies.

Hello, I'm looking at deploying a Microsoft group policy for CID 1172  which is : Status of the 'MSS -  (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' setting. If I'm using a proxy to split http traffic over a SDWAN will this GPO impact my users or the proxy attempting to re-route client traffic? 

As we deply Big Sur, we have detected that it breaks WebEx and GITHUB Enterprise on AWS.Does anyone else have any other apps to report? Both of these are not a problem when we disabled the client.Strangely enough, we are not steering either (WebEx is disabled, GITHUB is an internal site), so this is a fundamental interaction problem.  @DaveKerr 

Good afternoon all, I've got a slight issue and I'm wondering if anyone here can help me with this, I'm looking to set up a VPN connection so I can create an online hybrid azure AD join from Microsoft Endpoint. I need direct visibility of our on-prem domain controllers Now I guess the first question is, is this actually possible with the options Netskope has available? I can see the following options available within Endpoint IKEv2, PPTP and L2TP All I'm looking for is a VPN tunnel which will only provide access to domain controllers over the internet during the build process. Can NetSkope facilitate this? Thanks very muchRGE_Master

Netskope URL Lookup Tool is a handy tool when it comes to creating Netskope web policies or submit mis-categorization requests to Netskope team. https://www.netskope.com/url-lookup This tool is accessible when Netskope client is enabled. From within tenant policies dashboard the tool also gives you other details of significant importance such as which policies or steering exceptions or custom categories the url applies to. Here is a recommend sequence of configuration tasks when creating a custom URL list. 1. Verify if the URL is part of an existing Netskope category, policy or steering using URL Lookup tab2. Create a URL list by going to URL Lists tab3. From custom categories tab attach the custom list to a new or existing custom category as "include" or "exclude" list.4. Apply the category to a Real-time protection policy

Netskope’s Secure Web Gateway supports HTTP/S traffic on any port.  While Netskope’s Cloud Firewall can control any port and protocol, Secure Web Gateway customers may have use cases to block certain high risk apps that use non-HTTP/S ports and protocols.  For example, TeamViewer uses port 5398 for communication but fails over to port 443 if port 5398 is unavailable.  By default, the Netskope Web Gateway drops non-HTTP/S traffic so administrators can block TeamViewer in its entirety by following the instructions below:   Navigate to Settings > Security Cloud Platform > Steering Configuration. Select the steering config you wish to apply this to.  Click EDIT in the top right corner.  Click the NON-STANDARD PORTS tab. Check the box next to Steer non-standard ports. Create entries and teamviewer.com and *.teamviewer.com with port 5938. Click SAVE. Change to the EXCEPTIONS tab.  Add or edit the TeamViewer Certificate Pinned Application and set the

We moved federated domain name to our Netskope tenant SSL bypass instead of the client steering but when we did that it broke the Catalina Mac's getting to VPN. We are now getting a black page. Please see screen shot. Has anyone seen this?

Dear AllI need your kind input if you have experienced similar issue as under:I have installed the netskope client without full connectivity/routing at the backend. The client connects to the tenant only. The NS Client config states <Gateway IP: N/A (Explicit Proxy: 185.x.x.x) > The zscaler proxy PAC configuration is still active and the PROD config. Then purpose of installing the NS Client is to test the deployment and to scope co-existence and prestaging the NS Client.The client was installed on a laptop connecting to the organisation through SIM. The average data usage of that device spiked from 40GB and month to 530GB. Did anyone experienced similar issue at any stage with the NS Client.I am troubleshooting the data usage through the Win10 Data Usage feature.I was also wondering if the data usage can be tracked from the NS Tenant/console?Thanks in advance. 

In this article we’ll demonstrate how you can implement automatic remediation for security posture violation findings discovered by Netskope Cloud Security Posture Management (CSPM).   Netskope CSPM continuously assess public cloud deployments to mitigate risk, detect threats, scan and protect sensitive data and monitor for regulatory compliance. Netskope simplifies the discovery of security misconfigurations across your clouds. Netskope Auto-Remediation framework for AWS enables you to automatically mitigate the risk associated with these misconfigurations in your AWS cloud environment.   Netskope CSPM security assessment results for such security benchmark standards as NIST, CIS, PCI DSS, as well as for your custom rules are available via the View Security Assessment Violations Netskope API. Netskope auto-Remediation solution for AWS deploys the set of AWS Lambda functions that query the above Netskope API on the scheduled intervals and mitigates supported violations autom

We've continued our blog series on AWS Best Practices, and just published: https://www.netskope.com/blog/a-real-world-look-at-aws-best-practices-logging . Although CloudTrail is a well-trodden subject for AWS Security, there were still a few interesting findings among a slice of our customer base:   Enable VPC flow logs: 81% of VPCs do not have VPC flow logging enabled, which will hinder incident response and investigations. Encrypt CloudTrail logs at rest: 91% of CloudTrail logs are not encrypted at rest. Encryption at rest supports data compliance controls and is easy to do. Ensure S3 bucket access logging is enabled for CloudTrail buckets: 41% of CloudTrail buckets do not have server access logging enabled. Logging should be enabled for all CloudTrail S3 buckets. Ensure CloudTrail logs are integrated with CloudWatch or a SIEM: 54% of CloudTrails are not integrated with CloudWatch. These should be reviewed to ensure they are integrated w

Azure has the following logic to check  Active Directory for stale users: refreshTokensValidFromDateTime > STS TokenLifetimePolicy MaxInactiveTime (default of 90 days for Azure, may vary for customer) + acceptable number of days past the refresh token, for which an account can be inactive( in this case 30).   Security Posture Management can help with custom rule for above use case as in :   User should not have LastTokenChange isEarlierThan ( -120, "days")

Public IP addresses allow Internet resources to communicate inbound to Azure resources.   Security posture Management can help with custom rules to ensure that specifically tagged VM instances  donot have a Network Interface with public IPs assigned. The custom rule would look like following:   VirtualMachine where Tags with [ Name eq "confidential" ] should not have NetworkInterfaces with [ IPConfigurations with [ PublicIP len () gt 0 ] ]

Every company uses tagging and resource labeling in their own way. Among other uses, mature labeling practices are a great way to identify resources to their cost centers, keep track of their purpose and contents for compliance requirements and for naming ownership and maintenance responsibilities. Netskope Security Posture Management can help enforce good labeling practices with a few simple custom rules suited to your needs. How to ensure that every resource of a given type is labeled properly Most common use case for label policy enforcement is to ensure that resources are labeled at all. For example, if we want to ensure that every EC2 instance in our AWS Cloud carries a label named "org-unit", we can write the following rule for AWS monitoring:  EC2Instance should have Tags with [ Name eq "orgunit" ]   Once added to a compliance profile and being monitored by a Security Posture Policy, this rule should show in the Security Posture view with findings like this:   Likewi

Organizations have their own  convention of tagging buckets containing PII objects . We can leverage Security Posture Management to create custom rules to check if these specifically tagged buckets are open to the public:   AWS : S3Bucket where Access eq "Public" should not have Tags with [ Name eq "PII" ]   Azure: StorageAccount where ( Tags with [ Name eq "PII" ] ) should have every BlobContainers with [ Access eq "None" ] or not AllowBlobPublic   GCP: Bucket should not have Policies with [ Members . AllUsers eq True or Members . AllAuthenticatedUsers eq True ] and Tags with [ Name eq "PII" ]

Inside an AWS Private S3 bucket, a specific object can be made public by using any of the following steps:     Update the object's access control list (ACL) using the Amazon S3 console Update the object's ACL using the AWS Command Line Interface (AWS CLI) In order to make sure that a specific object is not turned public inside an otherwise private S3 bucket, we can make use of the AWS Block Public Access Settings , specifically the IgnorePublicAcls (Block public access to buckets and objects granted through any access control lists (ACLs)) boolean. Netskope SPM allows to write  custom rule for checking the above  configuration for each S3 bucket: S3Bucket should have Access eq "Private"  

Build custom rules under Policies > Security Assessment using Domain Specific Language (DSL) for Security Assessment of AWS, Azure, and Google Cloud resources.   The following syntax diagram represents the general rule to write a DSL statement.     Rule Format: <entity> [where <condition>] should [not] have <condition>   For example: Entity An entity defines what the rule is checking against. It can be used alone or with a condition to further specify the entity. Here are some examples of using an entity.   Condition A condition is a standard that the rule uses to check against an entity to narrow down the result.     The following table provides examples of using a condition. The formats in this table are applicable to all properties. Function Use functions in rules to find specific information about entities. Functions use the following syntax, <entity> <function>(<argumen

Security groups (AWS, Azure) and firewall rules provide stateful filtering of ingress/egress network traffic to Cloud Provider resources. The AWS rule below provides protection against security group allowing unrestricted ingress access to port 22 (SSH). This rule can easily be modified to provide similar protection for other ports such as RDP (3389), Oracle DB (1521), PostgreSQL (5432), MySQL DB (3306), MongoDB (27017), Microsoft-DS (445), HTTP (80), TCP (445), DNS (53), FTP (21), Telnet (23), SMTP (25), and more. See below for example rules in AWS, Azure, and GCP.   AWS: EC2Instance should not have SecurityGroups with [ InboundRules with [ IPRanges with [ IP isPublic () ] and Protocol in ("-1","tcp") and ( (FromPort lte 22 and ToPort gte 22) ) ] ]   GCP: FirewallRule where Disabled eq False should not have Direction eq "INGRESS" and Allowed with [ Protocol in ("all", "tcp") and Ports with [ ( FromPort lte 23 and ToPort gte 23 ) ] ] and SourceRanges with [ Value eq 0.0.0.0/0

Hi Everyone, We have a handful of users that are still on v78.  We would like to upgrade everyone's client to v87 by allowing the client to upgrade automatically in the client configuration settings.  If this feature is enabled in the tenant, will it remove the previous version and install / overwrite with the new version automatically or we would have to manually uninstall and manually reinstall ? Thanks,David

Dear AllWe are implementing Netskope and as part of implementation we might have to set an explicit proxy (browser) for the initial phase of  implementation. I am deploying the client and if an explicit proxy setting is required for all the Windows 10 fleet then I can always achieve through a GPO settings. But I was wondering if this settings can be pushed from the tenant. This info looks promising https://docs.netskope.com/en/explicit-proxy-217835.html but I don't have enough understanding to vouch this approach. Any thoughts would be very much appreciated.