Product Forums

Note: This is a open source community project and not supported by Netskope Engineering/Support. For support with issues contact John Neerdael @jneerdael@netskope.com After publishing my unofficial Pulumi provider that leverages this helm chart  for provisioning Netskope Publishers, I also wanted to share a second community project: an unofficial Helm chart for deploying Netskope Private Access Publishers on Kubernetes.The chart is called kubernetes-netskope-publisher and is designed to run Netskope Private Access Publishers on Kubernetes distributions such as k3s, kind, EKS, AKS, GKE, OpenShift, and bare-metal Kubernetes from a single Helm chart.This is not an official Netskope product or support channel. It is a community-maintained project intended to help operators who want a Kubernetes-native way to deploy and manage NPA Publishers.https://johnneerdael.github.io/kubernetes-netskope-publisher/https://artifacthub.io/packages/helm/kubernetes-netskope-publisher/kubernetes-netskope-pub

Hello,I'm building an internal framework for safely adopting MCP (Model Context Protocol) servers at FCBT. I came across the Netskope community articles on the MCP penetration testing methodology, the Netskope MCP Server (technology preview), and AI behavioral security — all directly relevant to what I'm scoping.A few questions on what's available in our tenant today:1. Does our current Netskope subscription include visibility into AI host traffic (Claude, Copilot, ChatGPT) and MCP server endpoints (e.g., URLs containing /mcp or /sse, domains like mcp.atlassian.com)? If yes, can you share or point me to the dashboard/report?2. Is the AI behavioral security capability (the "Invisible Insider" feature) available to us, or does it require a different SKU?3. Can our team get access to the Netskope MCP Server technology preview? I'd like to evaluate it as part of the framework.4. For the next 90 days, can you pull a report of FCBT user traffic to AI hosts and MCP endpoints — user, destinati

We are deploying the Tanium Client but Netskope prevents the client from peering. Once you disable Netskope Tanium work as expected. There is no documentation on the support portal. 

how to monitor Citrix traffic in Netskope. I do not want to bypass the traffic. i want to just monitor the traffic for all my users

Is there a way to report out what network location profiles exist and what the IP addresses they contain?  Bonus points if it can be tied to what SSL policies!

 Comprehensive Guide to Configuring Developer Tools with Netskope SSL InspectionLast Updated: May 2026Disclaimer and AdvisoryThis document and the guidance contained herein are provided by Netskope for informational purposes only and are intended to assist developers and administrators in configuring third-party tools to operate with the Netskope platform. "As-Is" Information: The information, scripts, and configuration examples are provided on an "as-is" basis. While Netskope makes a reasonable effort to ensure the accuracy of this information at the time of publication, we make no warranties, express or implied, regarding its completeness, accuracy, or suitability for any particular purpose. Third-Party Systems: The software, libraries, and tools discussed in this document are not owned, controlled, or maintained by Netskope. The configuration, commands, and behavior of these third-party systems are subject to change at any time without notice by their respective owners. Netskope a

Hello.. I am trying to simply add a custom header to any and all users that have the Netskope Client installed.  Basically when they access our corporate website, I want Netskope to add a header “X-Employee” with a value of “true”.I thought the solution to this was to do the following:Go to Netskope settingsClick Manage, then “Header Insertion”Click “New Header Insertion Profile”Create new application with the custom header and value.Then I went to “Security Cloud Platform”, and created a new Cloud App rule, that used the application I created above, and the domains entry has the value of my corporate domain. (i.e. example.com).I still don’t see any headers being added to the outbound browser requests when accessing a site with that domain.  Am I missing some step?Thanks 

Hello,We are using Netskope forward proxy since half a year, everything working fine. It is being used on physical machines as well as whithin our VDI Environment, hosted on premises (VMWare Horizon).We are starting to deploy NPA for mobility of our users.However, when a user is in NPA steering config and connects to a VM in the VDI environment, the connection breaks after 30s to 1min. VM is still accessible via RDP, but not via Horizon view (blast).Since the VDI is on premises, my idea would be to completely disabled NPA in the VDI environment, that way even if a user needs with NPA enabled on his physical machine needs to connect to a VM, they still can.Any idea how to do so ? A service to disable ? An installation script on the master ?ThanksBest regards,Jeremi

Dear Netskope TeamI am currently experiencing issues with Microsoft Teams calls while Netskope client is enabled. Specifically, the calls go on hold, and once I disable Netskope, the Microsoft Teams calls are fine without any issues.Could you please advise any ports needs to allow on firewall.  RegardsMohammed Anwar

Hi Team,We are exploring how to enforce Data Loss Prevention (DLP) controls on the Grammarly browser extension in Chrome and Edge. While our existing DLP policy successfully restricts sensitive data uploads within the Grammarly application itself, the same restrictions are not being applied to the Grammarly extension.Thanks & RegardsManisha Joshi

Hello,we have a user using intensively Power BI but sync data takes time.Without the Netskope client there is no more latency.What can we do to improve this Power BI latencies with the Netskope client.?  

hi team,Based on the certificate check available in the documentation i tried including the intermediate certificate and root certificate in one single pem file but when i tried importing the file in chrome im getting this error “Import is only supported for a single certificate” 

I am dismayed that upon seeing the below notice when logging into the tenant, the linked Help page says “The migration guide is still in progress and will be available soon “  Netskope should consider holding off doing this due to a lack of proper documentation  Policy Update: Automated Migration of Steering Exceptions Netskope is decoupling Steering Configurations from Proxy processing to provide more granular, visible control over traffic handling.What is changing? Automated Policy Creation: Starting in 136.0.0, Netskope will automatically convert existing steering exceptions into explicit SSL "Do Not Decrypt" and RTP "Allow" policies. No Traffic Disruption: Your current bypass behaviors and traffic flows remain identical. Easy Identification: Migrated policies will be prefixed with "ns-migrate" and logged under "Netskope Migration" in your audit trail. Non-standard Ports: Non-standard ports are no longer controlled by Steering Configurations and can be managed by Service Objects

OverviewTo streamline troubleshooting, organizations often want to automate log collection (e.g., triggered automatically when a user submits a support ticket).Technical Note: The Netskope REST API v2 allows for the retrieval of logs already present in the tenant. However, the "Collect Logs" function in the Netskope UI relies on a proprietary signaling mechanism that is not currently exposed via a public API. To automate the initiation of log collection, organizations must use a remote execution solution (MDM/EDR) to run the nsdiag utility locally on the endpoint.The Automation WorkflowSince the process cannot be triggered via a Netskope API call, the workflow moves from the Netskope Cloud to your internal management infrastructure. Trigger: An automation engine (e.g., ServiceNow, Jira Automation) identifies a new ticket with a hostname. Execute: Your MDM (Jamf, Intune, Kandji) or EDR (Tanium, CrowdStrike) runs the nsdiag command on the target host. Local Bundle: The nsdiag tool ge

We are experiencing an issue where Cursor AI traffic stops working when routed through Netskope with SSL decryption enabled. Specifically, the Cursor agent fails to function when traffic is inspected via Netskope.For security reasons, we do not want to bypass or exclude the Cursor AI domains from inspection. We would like to understand if there is a recommended solution that allows Cursor to function properly without bypassing SSL decryption.Could you please advise on: Any best practices for handling similar AI/agent-based applications under SSL inspection As part of our troubleshooting, we attempted lowering the HTTP version to 1.0. While this has resulted in partial functionality for some users, the issue is not fully resolved and the agent remains unstable. 

Hi Team,Quillpad is showing unknow in CCL is it safe to allow this translation app to our users. In virus total I don't see any malicious tag to the application/website. Please check and suggest.   Regards,Zakeriya Shaikh

Hello Everyone, We are unable to export the user list from Netskope tenant. We have tried to export the user list from Security Cloud Platform → User management, but unable to fetch the export option to export the user list.Kindly confirm is there any option in the Netskope tenant to export the user list from the tenant.If not, kindly suggest any alternative method for the same.

Hello everyone,We've seen a few questions lately about the best way to handle Netskope Client upgrades when you have a mixed environment of non-persistent VDIs and traditional laptops. A common challenge is that the same user might use both, but the upgrade strategy needs to be different for each.Let's break down the problem and the best-practice solution. The Challenge: Different Needs for Different Devices  Non-Persistent VDIs: You can't use the standard auto-upgrade feature from your Client Configuration. Any update applied during a session gets wiped when the VDI reverts to its golden image. Upgrades need to be manual and controlled. Laptops: You want them to auto-upgrade. It’s the easiest way to keep your users on the latest client version and maintain your security posture with minimal effort. So, how do you disable auto-upgrades for VDIs while keeping them enabled for laptops, especially when the same user logs into both? The Solution: The autoupdate=off Installer Flag is Key!

Hello! We are experiencing some issues with the Netskope Client failing to reconnect when our users move the LAN cable from their Laptops to their Docking stations. The Netskope client fails to connect anytime the connection is attempted from the docking station’s NIC. From the laptop’s onboard NIC no issues are encountered. Attempted means to remedy include the following but to no avail:Updated Docking Station Firmware to latest available Updated Driver for NIC on Dock as well as Docking station driver Reinstalled Netskope Client & Netskope Endpoint SDWAN ModuleI’ve sent out a preliminary inquiry on the same to our rep at Netskope and was just curious if anyone in the community had encountered similar issues and were able to work through them. If so could you suggest any possibly remedies? Thank you!Chris WarrenCybersecurity Analyst II

Thank you in advance - as a security measure, I was wondering if rather than bypassing traffic to AWS Workspaces from Netskope, might it be possible instead to source anchor traffic from our AWS Netskope publishers and configure IP restrictions from the AWS-end, such that access to our Workspaces tenant was restricted to our AWS/Netskope publishers? We’d ideally only like for access to AWS Workspaces to be driven from Netskope client-driven endpoints.

Hello I have NextGen API for Microsoft outlook. For 12 of my users I want to steer the outlook traffic via netskope.I know it is the pinned app and got a bypass, but is there any way to steer via Netskope

SUBJECT- Issue with Activity Control Policy for Banking/Finance URLs in Netskope Hello Team,Today, I created a policy related to custom URLs for banking and finance/accounting websites. I selected specific domains to control user activity and configured the policy properly.However, I am unable to control activities on banking websites in particular. I am not sure why this is happening.When I perform a URL lookup in Netskope, it shows that the traffic is being steered to Netskope, so the steering is working.If anyone knows how to resolve this issue—especially for banking sites—please guide me

Generated with the assistance of Claude Opus 4.6 (Anthropic) -- but any slop is my fault for not managing context.Summary We need a per-user, one-time enrollment token mechanism for IdP-mode enrollments on devices that cannot receive tokens via MDM (mostly Chrome or Linux laptops, unmanaged or “lightly managed” endpoints). The current Secure Enrollment model provides tenant-wide shared tokens distributed via MDM. We have specific questions about how Enforced/Not Enforced status interacts with IdP vs UPN enrollment, and whether per-user scoped tokens are available or planned. EnvironmentTenant: XXXX.goskope.com Secure Enrollment Service: Enabled Token set 1: Created Jan 2026, Status: Enforced (auth + encryption), Expiry: roughly 1 yr Token set 2: Created Mar 2026, Status: Not Enforced (auth + encryption), Expiry: roughly1yr Secure Configuration Service: Enabled IdP: Okta (SAML Forward Proxy configured with Client Enrollment access method) Deployment modes: UPN via Intune/Jamf (Windows/m

Hi everyone,I’m looking for a solution to define a policy in Netskope Standard edition to give me an alert on shared folders that are unsafely shared among external and al internal users.I’ve already have a policy in place for files but I can’t find a way to define it specifically for folders. I’ll appreciate it if anyone has a comment on the solution.

We have been informed by the Support team that if you create cases on behalf of customers, the SLA associated with the customer’s purchased support level will not be honored.Quoted from Support, with company information masked:“Also, regarding the SLA request, the reason is that the case was raised by a vendor account rather than the customer.Please sync with your account team for any further queries.”