Product Forums

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hi all, Nice to meet you! I'm currently distributing Netskope clients on company computers (both Windows and Ubuntu). I have configured the Netskope clients to Google Workspace accounts.This works fine for users without a passkey (Yubikey), but if they enable one, the client doesn't complete the login process. Has anyone else experienced this issue and found a solution?Thank you.  

 Issue Description: A customer needs to selectively block videos from playing on Facebook while still allowing users to browse the Facebook platform. This requires a targeted approach to block specific Facebook video-related URLs and domains without completely blocking access to the entire Facebook platform. Environment: Netskope tenant with web filtering capabilities Resolution: 1. Create a URL list with the following entries:video.*\.fbcdn\.netwww.facebook.com/watchwww.facebook.com/videofb.watch 2. Create a custom category in Netskope to encapsulate the URL list:  - Navigate to the custom categories section in your Netskope tenant  - Create a new custom category  - Add the URL list created in step 1 to this category 3. Create a block policy or add to an existing AUP Custom Category:  - Navigate to the policies section in your Netskope tenant  - Create a new policy or edit an existing one  - Set the action to "Block"  - Apply the custom category created in step 2 as the target 4. Save

Building on our discussions about traffic steering and the powerful Netskope Client, let's explore how to unlock the true potential of your Netskope SASE platform: achieving granular visibility.Deep visibility is built upon several layers of context, each with critical dependencies. Understanding these layers is key to extracting maximum value, enabling precise policy enforcement, and contributing directly to your organization's robust security and compliance posture. User, Group, and Organizational Unit (OU) Information: Value: This foundational context is paramount for establishing Identity-Centric Zero Trust. By knowing who is accessing resources, it enables explicit trust decisions, precise role-based access controls (RBAC), and granular auditing, aligning with the "never trust, always verify" principle. Compliance Reference: Essential for meeting NIST Cybersecurity Framework (CSF) Identify Function (ID.AM) - Access Management and ISO 27001 Annex A Control A.9 (Access Contro

Good morning!Can Netskope identify executable files or even other types within compressed files (zip), for example?

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security. Simplified Certificate Management: Provides native certificate management capabilities, removing the operational challenges of maintaining in-house Public Key Infrastructure (PKI) when leveraging the Netskope certificate. Flexible

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffic. It extends Netskope's security controls, including DLP, to personal or non-corporate devices, enhancing visibility and d

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance 

Hello Netskope Community, With the recent launch of Google’s AI mode in Google searches, I am looking for a way to block it using Netskope. I noticed that the URL pattern is different between the AI mode and the regular search results, however the wildcard matching cannot be used because of the way Netskope handles wildcards. I am not seeing an obvious way to use regex to match it, however if someone else does please let me know. I also explored matching the activity based on HTTP header and was unable to find a unique header field that I could match on (again if anyone knows different please let me know). My next plan of attack is to try making a custom CCI application using the Netskope App Activity recorder browser extension and block access to it, but I haven’t tried that yet. Does anyone have any other ideas?Thank you in advance. 

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should be able to pull different Client configurations anyone know if we maybe need to redirect the configuration fi

Here's an article for Netskope on blocking Base64 encoded sensitive data using custom regex, along with the step-by-step DLP policy creation process. Blocking Base64 Encoded Sensitive Data with Netskope DLP: A Step-by-Step Guide In today's cloud-centric world, organizations face the persistent challenge of preventing sensitive data from leaving their control. While traditional DLP solutions are effective against clear-text data, a common evasion technique involves encoding sensitive information, particularly using Base64, to bypass detection. This article will demonstrate how Netskope's powerful DLP capabilities, combined with custom regular expressions, can effectively block the sharing of sensitive data transformed into Base64 encoded strings.The Challenge: Evading DLP with Base64 EncodingBase64 encoding is a method of representing binary data in an ASCII string format. While legitimate for many purposes, it can be misused to obscure sensitive information like credit card numbers, so

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create SAML groups using “memberof” values from the SAML assertion response and configure policies in advance even before intercepting user traffic Friendly group name mapping: Netskope administrators can manually map SAML attribute values to user-friendly group names for simplified management and improved clarity in policy configurat

Please let me know if there is another community thread for this issue, but I could not find one when searching.When I attempt to install CE v5.1.1, I get a failure for Docker and Podman because the installer cannot recognize the versions.  However, I have confirmed that these services are installed.  Do they need to exist in a specific file path in order for the installer to see them?

Since deploying the latest golden release of the NS client (v126.0.0.2387) the Last Event field for all systems shows 55 years ago. Is this going to be fixed? 

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) allows organizations to apply Threat Protection to web traffic (ports 80 and 443) for private applications, ensuring files are scanned for malware in real-time. When using Threat Protection with NPA, note that this feature:Requires Client as the Access Method. Scans all web traffic on HTTP (80) and HTTPS (443). Applies real-time scanning to protect private app access from malware and other advanced threats.Netskope One Private Access now a

The Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration…What is the default (new/recently created tenants) for Custom App Domains?What is the value in your tenant for Custom App Domains? Curious if it is best practice and/or common to have this set to *, empty, or specific values. This question comes as the OOB Microsoft Office 365 Outlook.com contains the process below, that is used throughout additional Microsoft products (such as Teams and the Microsoft 365 Copilot app). If your Custom App Domains is set to * for the  Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration, then all traffic (regardless of the Microsoft app) will bypass Netskope inspection (including DLP policies).Process: msedgewebview2.exe

We have created a policy for USB content control with size limit 50 mb.Issue faced here is if i share file of 40 MB and another of 15 mb it get shared.Use case is we want to restrict complete data transfer over 50 mb not file size The file size limitation is enforced per file, not per session. What we are observing is the expected behavior by design. If your expectation is for Netskope to track the cumulative file size uploaded within a session , for example, a user uploads a 40 MB file at 10:00 AM and then another 15 MB file 15 seconds later, totaling over 50 MB , this functionality is currently not supported.

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Rest API V2 token provisioning workflow. Previous Method: Historically, API tokens were provisioned through the user interface by navigating to Tools -> Rest API V2. Impact of RBAC V3 Enablement: Once RBAC V3 functionality is activated on a tenant, the aforementioned Rest API V2 tok

As a customer facing company, we regularly receive booking-related emails from customers and partners that contain Personally Identifiable Information (PII) such as passport numbers, ID documents, and travel itineraries. To prevent external data leakage, we’ve implemented Netskope DLP to monitor outgoing emails for PII. However, we’re facing a challenge: When our employees reply to incoming emails (even without including any PII in their response), Netskope DLP still quarantines those replies. This is because it detects the original PII from the customer’s message in the reply thread. We want to understand if there’s a way to configure DLP policies so that it only quarantines emails that are originated internally and contain PII, and not block replies to incoming messages that happen to include previously received PII. Is there a solution or best practice to achieve this behavior?