Product Forums

Hello everyone,I’m looking for guidance on how best to handle chat bots within business web applications, particularly when they are being blocked under Online Ads filtering.For example, we use the Blackbaud web application. While the main application functions as expected, the embedded chat bot is being blocked because it is categorized as Online Ads. The chat bot is an important feature, as it is used to create support cases for the application.Additionally, I’ve included screenshots from SkopeIT and had a couple of related questions:Is it normal for the same application to appear under multiple App Categories? What is the difference between a URL and a Page as shown in SkopeIT?Any insights or best practices would be appreciated. Business WebAppChat bot on Business WebApp 

Google Doodles are a creative and engaging way for Google to celebrate events, historical figures, and global moments. However, many of these Doodles include interactive games, which can become a distraction in corporate environments.While seemingly harmless, these games can:Reduce employee productivity during working hours Increase non-work-related internet usage Bypass traditional “Games” category controlsThis post explains how to effectively control access to Google Doodle games using Netskope SWG, without impacting legitimate business use of Google Search. 🚨 The ChallengeAt first glance, blocking Google Doodle games seems straightforward—just block the “Games” category, right?Unfortunately, that approach does not work in this case.Why?Google Doodle game URLs are classified under:➡️ Search Engines OR Web DesignThis means:They are not categorized as Games or Gambling Blocking them via category would require blocking Search Engines or Web Design entirelyAnd that would:Impact all user

Hi Team,Some of our customers would like the view under Settings → Cloud Security Platform → Devices to update (almost) in real time.Especially when selecting a specific device and clicking the refresh button, it often takes “forever” — if it has any effect at all — for the display to update and show which tunnels are currently online.The timestamp shown in the top left is current, but it does not reflect the actual status.This would be particularly helpful in troubleshooting situations.Our local SE mentioned that since this is not on the roadmap, we should submit a feature request for it. Thank you very much and best regards,Marco

Hello Netskope Community,Managing endpoint client software across an entire organization is a critical task. A key part of this is having a clear strategy for updates and, when necessary, rollbacks. This guide outlines Netskope's recommended best practices for managing client versions to ensure stability, minimize risk, and maintain business continuity. Understanding the Netskope Client's Upgrade Behavior A common question we see is, "How do I roll back the Netskope Client?"It's important to know that the Netskope Client does not have a native, in-place "downgrade" feature. The installer is designed to prevent an older version from being installed over a newer one to maintain system and configuration integrity.The Official Rollback Procedure:If you need to revert to a previous client version, the required process is a full uninstall and reinstall, orchestrated by your endpoint management tool (e.g., Intune, Jamf, SCCM). Obtain the Installer: Download the specific client version you wis

We tried with Iban (ALL) option but didn’t worked So Please provide an appropriate solution for this 

I am struggling with the props.conf setup to pull web transaction logs via S3 bucket. I have set up per Stream Logs to Splunk - Netskope Knowledge Portal .This would replace my setup for using REST API v2 for transaction logs eventually.  I currently have logs going in parallel into a temp index for validation before cut over.I am using queries below to validate time stamp detection and proper data parsing. If you have this setup to your satisfaction, Can I request you to share your props.conf? Validation queries: #Check if _time matches x-cs-timestampearliest=-10mindex=nsweb_temp sourcetype="netskope:web:test"| eval payload_time = tonumber(coalesce('x-cs-timestamp','x_cs_timestamp'))| eval splunk_time  = _time| eval diff_seconds = splunk_time - payload_time| eval status = if(diff_seconds==0, "PERFECT", "OFFSET")| eval diff_abs_s = abs(diff_seconds)| eval diff_hms   = tostring(diff_abs_s, "duration")| table _time payload_time splunk_time diff_seconds diff_hms status| sort - _time| head

Dears, Q1 : I appreciate your confirmation and guidance of how Netskope ATP sandbox license can integrate with MS Sharepoint to analyze upload/downloaded files ?Q2 : Also if Netskope sandbox can be used for manual file submission for analysis ?Thanks in advance,

With Netskope client enabled, macOS machines are failing to sync to Intune.  When I disable the client the sync works as normal.  I have all of the predefined cert pinned app exceptions for both Windows and macOS in place, and Windows machines have no issues.I found this thread in the community pages that discusses this issue on Windows, and one comment briefly discusses macOS but the thread is closed and I can’t see any of the replies so not even sure if there is more info in here I that can’t get to.  I did create and additional custom cert pinned app for macOS and included the below processes, and added ‘*’ to bypass all domains.  Nothing is working though.company portalomadmclientintunemdmagentmdmclientcompany portalmdmclientwdavdaemon_enterpriseHas anyone figured out how to get Netskope to not interfere with Company Portal on macOS?

Looking for recommendations here. We are currently trying to onboard a group of consultants and provided them a requirements document for use of Enterprise Browser. One office could not use EB due to network issues. So they are currently whitelisting the domains and ports from your list. Their question was what to replace MP with? Are there regional static MP domain names that can be used? Network Connectivity: Netskope Enterprise Browser needs access to the following domains/ports:https://nsbrowser-updates.<MP>.goskope.com: Browser updates and installer downloads. https://nsbrowser-config.<MP>.goskope.com: To retrieve tenant and user configurations.I assume if they whitelist by subnet instead, will that cover these MP domains, correct? Consolidated Whitelist CIDR Notation IP Address Range 8.36.116.0/24 8.36.116.0 - 8.36.116.255 8.39.144.0/24 8.39.144.0 - 8.39.144.255 31.186.239.0/24 31.186.239.0 - 31.186.239.255

Hiis it mandatory to provision on the tenant the users that will only have access to Browser Access apps? I mean, for third-party or contractors, that won’t install the Netskope Client and that only need access to browser access private apps, is needed to provision them via SCIM or manually?I have checked that having the user associated on the IdP, the user authenticates when trying to access the public URL of the BA private app, but if the user is not provisioned on the Netskope tenant, get a 401 error after authenticating even if the RTP policy allows “all users”The user only access the private app via BA after provisioning on the tenant. Is this correct? I wouldn’t like to provision all my contractors on the tenant Regards

Is anyone aware of a library of APIv2 scripts that can be shared?   Looking for scripts that can discover devices and details about them as well as automating some functions like URL list updates and such.

We see a discrepancy in file names being visible in DLP incidents. Currently we have a DLP policy to detect exfiltration of sensitive information using file converter tools. While we are getting the file information using forensics for https://www.sejda.com/, the same is not happening for ilovepdf and ilovepdf only captures “blob” as an object and does not show any information. Is this a known limitation? 

Hello Community,  we have an Netskope Elite offer for China and have difficulties to have WECOM working with Netskope. A lot of delay in the message exchange. Before going full bypass, which is a clear security problem for my company, I would like to know if someone managed to make this app compatible with Netskope.  Official doc: https://work.weixin.qq.com/h5app/wework_domain_ip/latest Thanks! Robin

In corporate environment there are scenario where endpoint machine needs to perform patching for their drivers, application, OS and sync-ing / upload files to corporate sanctioned file storage. How do we overcome the Advanced File Scanning’s DLP, File Profile and Threat Protection without editing the fall back behavior if we deem the destination or the source is sanctioned  ? I explore the options to use real time policy’s file constraints to overcome, however it seems to be not working just wish to check anyone have any idea to overcome it? Thanks in advance! 

Are only predefined Profiles are Working? If Any Regex is there Kindly Provide!

Hi all, Hoping for some advice. We have a user that is experiencing intermittent issues with Google Workspace suite. Namely, when he is using Sheets, Docs, Drive, etc, it throws up errors such as; “Trying to connect”, “Working offline”, etc. We have disabled QUIC on the users browser. Nobody else has reported this issue.We have raised this with Netskope Support but we are stuck in an endless loop of capturing HARs and Netskope logs. As it is intermittent, it is difficult to capture logs at the right time / on a call with support team.Does anyone have any additional troubleshooting advice or have experienced the same thing?

I have Slack API DLP policies generating incidents that include non-domain accounts in the “Shared With” field (e.g. mycompany, wf_bot_sd0fd333). This recently started as Agentic (AI) workflows have been created to automatically perform process functions within the app. I am currently unable to create either a Domain or Usr Profile to be used in a Exposure Exclusion because they don’t contain domains. This is creating an enormous amount of false-positive that must be triaged. Thoughts on what can be done, or whether this is something thats being worked on by Netskope? Thx

SummaryAllow administrators to configure an active/passive failover mode for publishers on a per-application basis, instead of the current active-active only model.Business justificationWe route SAP S/4HANA traffic (SAP GUI thick client) through two Private Access publishers. The SAP GUI client does not tolerate network path changes: any publisher switch immediately resets the TCP session, causing a SAP_GUI_DISCONNECT error.Hundreds of unique users experienced repeated disconnections due to publisher switching. Each Netskope "Change in Network" event triggered a PoP or publisher change, breaking the active SAP session.Current situationActive-active (current): redundancy is maintained, but publisher switching causes mass disconnections for session-sensitive applications. Single publisher (our workaround): disconnections are resolved, but redundancy is completely lost. If the publisher fails, all SAP access is down.We are forced to choose between reliability and availability.Requested fe

We have facing the issues private access re authentication issues. to resolved the issues we have restarted issues user machine. but restart option is not a solution. 

This feature is available in realtime protection. Can we make this expiration feature available in USB DLP as well so we dont need to manage removing the exemptions manually?

Hello Everyone,I have a few questions regarding External User Access to On‑Prem Exchange via Netskope Private Access or Reverse Proxy.We are using Netskope Private Access (NPA) to publish our on‑premises Exchange Server behind a Netskope Publisher. Currently, only managed devices with the Netskope Client are allowed to access OWA and Outlook, and unmanaged devices are blocked who don’t have Netskope agent Installed — this is working as expected.This behavior is working as designed and aligns with our Zero Trust access policies.We now have a requirement to allow external users to access Outlook or OWA from non-managed devices and we have not exposed our OVA to Internet.Could you please confirm the following: Can Outlook or OWA access for external users be provided using Netskope Private Access without requiring the Netskope client on the user device? is there any other supported approach  to provide external user access to an on-premises Exchange server? Thank you for your confirmatio

Hi all, I have a question, that maybe it’s already managed in other ways but I don’t know.I have many apps that use the same port, example 8080, but I need to have different application segment because of security access. Is there a way to do in a different way? For example my think is to have one or more application segment and one or more real-time policies but create a “service group” with the port number and indicate it in the police and not in the private application segment.

Hi Community Happy New Year :)  I’m keen to understand if a Publisher Reboot is necessary every time a change is made to the local host file when using it for DNS resolution of applications hosted in Azure? It seems like a Publisher reboot is required when adding in entries? Is there a service that can be restarted instead for the changes to take effect? I’ve had a scrounge through the Community and Documentation pages but haven’t been successful in finding any info. Thanks in advance.

Thee following topic covering how to block Google AI mode has been posted )How to Block Google AI Mode? | Community ) but now with Google presenting poor quality AI responses via “AI Overview” on nearly all AI searches, we are looking for a way to block these search results without completely blocking Google Search.There is a known way to block “AI Overview” by appending “&udm=14” to the search request URI, however Netskope does not appear to have any support for inline modification of URI’s. Has anyone been able to work around this limitation or found another way (such as HTTP header insertion) to block the “AI Overview”? 

Hi Team, Blocking login / post activity on clasue.ai portal is not working as expected. we see discovery only in the app catalog. we do not see the login traffic on Skope-IT/Application events. requesting you bring in this enhancement for claude.ai URL. more details on the case # 602972With regardsKarthikeyan N