Product Forums

Hello Netskope Community, With the recent launch of Google’s AI mode in Google searches, I am looking for a way to block it using Netskope. I noticed that the URL pattern is different between the AI mode and the regular search results, however the wildcard matching cannot be used because of the way Netskope handles wildcards. I am not seeing an obvious way to use regex to match it, however if someone else does please let me know. I also explored matching the activity based on HTTP header and was unable to find a unique header field that I could match on (again if anyone knows different please let me know). My next plan of attack is to try making a custom CCI application using the Netskope App Activity recorder browser extension and block access to it, but I haven’t tried that yet. Does anyone have any other ideas?Thank you in advance. 

Hello All,Could someone please provide a clear explanation of the internet speed test? I’ve been troubleshooting an internet slowness issue, and while testing with Fast.com and Speedtest.net (https://www.speedtest.net/), I get impressive speeds (around 80 Mbps).However, when I test using Netskope's speed test (https://speedtest.goskope.com/), it shows much lower speeds (around 5 Mbps). This discrepancy is creating confusion about which test to trust, especially since the ISP technicians don’t use Netskope and rely on public websites to verify the speed

Hi everyone,I set the “Online Ads” category to Silent Block in our policy. It works fine on Google Search (ads are blocked silently), but when we try other search engines like Microsoft Bing, DuckDuckGo, Yahoo Search, or Yandex, the ads are still visible.Has anyone else run into this? Is this expected behavior, or did we miss a setting to make it apply across different search engines?Appreciate any insights!

Team, Good morning. I’m using NPA to connect to Azure Databricks via Private Link’s.My initial connection works fine but the connection fails on the second attempt.I must clear the cache on the endpoint and disable/enable all clients services in the Netskope console for the connection to work again.When the connection fails, I get the error message below. Has everyone experience this issue connecting to Azure Databricks using NPA?   

 was just talking about this in another thread here. We have a URL list that resolves this. We haven't had to update it in awhile but it's easy enough if we have to.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*  so with this regex above for Microsoft Delivery Optimization what actions are you all allowing Browse, Download, Post, ect…??

How are others solving for this? 

When I look at my Slack Channels some have “FC:” in the front of then name (e.g. FC:F063A1D5X9A:Test). What does FC mean? I was able to figure out that “DM” = direct message and “MPDM” = multi person direct message. I don’t see these defined in any Netskope documents though..

Hi Team, Wanted to know if we can restrict the USB file transfer to USB devices via EDLP? Use case- If a user attempts to transfer a file larger than 100MB, the action should be blocked. Thanks

Hi, I'm having a hard time with the netskope client on Linux. This is a WSL2 installation, and a netskope agent is running on the windows host. But the windows agent status has no influence on the behavior of the guest linux one. Very often, the nsclient config outputs a normal status with tunnel up, and private access enabled. Unfortunately the show-pa show this :  $ nsclient show-pastart process....Status: Connected (User Tunnel) Sent: 0 bytes Received: 78646 bytes and the nsdebuglog.log is spammen with this kind of errors : 2025/09/16 20:21:00.358996 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:01.381263 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:02.404470 stAgentSvc p46ba6 t46db5 error nsKernelUserShim.cpp:359 KernelUserShim Failed to register NAT flow!2025/09/16 20:21:25.547248 stAgentSvc p47489 t4755c error nsKernelUserShim.

I was wondering if there is any documentation on what this page returns for sites visited. I find that some sites users visit will show here but the majority will not. I cannot find a difference between the sites that show here and ones that do not.. Like the sites are not blocked etc.. what is Netskope using to determine what gets presented to the “Websites:” Thanks

I recall stumbling upon a Community article a while back for a regex chrome / edge pattern match used in app definition for a steering bypass.  For the life of me i cant find it, was looking to create a steering bypass for all processes except for Chrome, Edge , Safari and Firefox.anyone done this? (useful to have in some heavy dev environments for a limited group of folk)

Hi there We use MacOS in our estate. I want to build an automation with a tool like Tines or Workato whereby, when a user clicks the Disable Client/Internet Security option, the automation will run a workflow that gets the OTP via an API request.How can I go about doing this please?

Hello,I would like to know if it is possible to allow copy and paste when using ZTNA in browser access mode.If yes, could you please provide guidance on how to configure it?Thank you 

What's the best way to create a DLP Rule that looks for Email Addresses (using the Built In Netskope Email pattern) but not generate hits on our company domain ie @company.com.I was trying to make a custom Entity and then use a not clause in the DLP Rule but not sure if that will give us the behavior I was looking for.

Can anyone confirm whether Netskope enforces restrictions that prevent a Mac laptop from connecting to public Wi-Fi networks, while allowing successful connections to private Wi-Fi networks? If such a restriction exists, could you please advise which specific Netskope logs should be reviewed to verify whether the Mac laptop's access is being blocked or restricted on public Wi-Fi?

Some of my users are reporting errors when trying to connect to a SQL Server over NPA. The connection is successful but is erroring out due to a cert trust issue: The SQL server has forced encryption turned on; I have verified that the remote host is able to connect over the required ports.Is there another configuration that is needed to allow NPA to work with SQL Server Forced Encryption, do I need to deploy the Netskope Cert to the SQL servers? 

I have been tasked with allowing our user population to have access to the Generative AI category while also protecting the company and our patients by preventing uploads of any files with PHI in them to anything other than our internal instance of Copilot.I have created Realtime policies that I believe achieve this goal, but I have encountered an issue where certain AI sites do not upload the file in a format which Netskope can see into.  Specifically, Grok uploads files as a blob while Quillbot and Heidi Health AI upload the file in blob, json or webm formats.Is there a way for Netskope to be able to view these file uploads and apply our PHI profiles to the upload?  I have not seen any documentation which addresses this, and I am curious if anyone else in the community is running into a similar problem.

Yes, I am  going to create a case, but on the chance I can shortcut the process I thought I would ask here. Has anyone developed a solution for the AI chatbot at help.salesforce.com?We know we are going to have to SSL bypass, we just having figured out what URLs yet.  

ObjectiveHighlight the outcome that improvements to international predefined entities are part of Netskope’s long-term roadmapNetskope existing detection mostly relies on a third-party entity. PrerequisiteThis issue generally applies to all Netskope Standard and Professional DLP modules, including, but not limited to, NGSWG DLP, Email DLP, Endpoint DLP, and more. ContextCustomers can test pre-defined identifiers in their own languages, particularly in non-English regions, to verify whether they function correctly. They may only trigger the sample data demonstrated in the UI, so using a variety of real-life samples is highly recommended for more accurate verification. Do You Know?Non-numerical identifiers such as addresses, names, or terms are likely to bypass Netskope’s DLP detection mechanism without triggering alerts or appearing in DLP incidents. This means the administrator will be unable to track or investigate the data leakage incident. NotesWe’ve discovered that others have alre

Hello everyone,We've seen a few questions lately about the best way to handle Netskope Client upgrades when you have a mixed environment of non-persistent VDIs and traditional laptops. A common challenge is that the same user might use both, but the upgrade strategy needs to be different for each.Let's break down the problem and the best-practice solution. The Challenge: Different Needs for Different Devices  Non-Persistent VDIs: You can't use the standard auto-upgrade feature from your Client Configuration. Any update applied during a session gets wiped when the VDI reverts to its golden image. Upgrades need to be manual and controlled. Laptops: You want them to auto-upgrade. It’s the easiest way to keep your users on the latest client version and maintain your security posture with minimal effort. So, how do you disable auto-upgrades for VDIs while keeping them enabled for laptops, especially when the same user logs into both? The Solution: The autoupdate=off Installer Flag is Key!

2025/12/23 Issue is fixed. Currently Netskope supports to apply Post Activity applied DLP profile to trigger user alert when the real-time policy is applying to all predefined categories.* With description written: Not all activities are supported by selected apps & categories View activity supportWe tested the user alert feature and noticed that when a DLP profile is applied to the user activity 'Post' for all web access, the user alert option cannot be selected.However, once we changed the policy to apply only to specific categories, such as cloud storage, the user alert option became available.We also observed that user alerts work if no DLP profile is applied but the 'Post' user activity is regulated across all web access. App Category - Profile - Activity - Action(1) Specific Category - DLP - Post - User Alert ✅(2) All Web - DLP✅ - Post - Alert/Block(3) All Web - No Profile ❌ - Post - User Alert ✅Does anyone know the mechanism behind this behavior?

How can I change the Status for more then 100 incidents at a time, which is the dashboard limit? I have thousands of incidents created from a retro-active scan and would like to add my own custom status to them all at once.

In working with the Netskope CASB, we’ve had analysts come up with the question “would this URL be blocked?”  I know we can go into Skope IT and do a URL Lookup to see what categories a URL is linked to and what policies “cover” it.  However, this doesn’t see to answer the fundamental question, “would it be blocked?”  There is the simple solution of, “just try it”, which will provide the answer, but this has some obvious downsides.  And it seems that the Netskope system must know if a URL is blocked or not, it will block browsing to a URL afterall.  Is there something I am missing in the interface which does this?  Or, is there a safe way to validate a URL from an analyst’s system, which doesn’t involve “ya, just try visiting a potentially malicious URL”?

OK, I am sure it will be obvious when someone tells me, but I walked trough what I think is every Settings spot and cannot find the Enrollment Token Section.  The Docs start out saying “Click Create TokenSet to create a new token set on the webUI. “ but not where it is!     It feels like it should be in the “Client Configuration”…….

Hello Netskope Community,One of our customers has a requirement where a specific role should have the ability to create policies and apply global/general settings, but not be able to delete any policies or settings due to compliance reasons.Currently, this level of granularity is not supported. The available permission levels—None, View, Manage, and Manage and Apply—provide either read-only or full read-write access to a specific feature or function. However, there is no built-in option to restrict only the delete action for a role.We would like to know if there are any known workarounds or if this capability is being considered for a future release.