Product Forums

OverviewThis guide provides step-by-step instructions for integrating OneLogin with Netskope Security Posture Management (SSPM) using the Bring Your Own App (BYOA) feature. BYOA allows you to extend SSPM's security monitoring capabilities to custom SaaS applications that are not natively supported by Netskope.BenefitsExtended Coverage: Monitor OneLogin's security posture alongside other SaaS applications Centralized Monitoring: Single pane of view for all SSPM-supported and custom apps Integrated Reporting: Unified reporting and alerting across all monitored applications Custom Rules: Create custom security rules using Netskope Governance Language (NGL)PrerequisitesNetskope tenant with BYOA feature enabled (contact Netskope support) OneLogin administrator account with API access Access to Netskope SSPM APIs (see Swagger documentation at https://<your-tenant>.goskope.com/apidocs/)Table of ContentsStep 1: Register & Onboard Custom App in Netskope SSPM Step 2: Create API Credent

In the world of modern cybersecurity, speed and scale aren’t just "nice-to-haves"—they are requirements. As organizations grow, so does the volume of telemetry. If you’re a Netskope customer, you already know that our platform generates incredible insights into your data movement and threat landscape. However,the real magic happens when you can automate the response to those insights at scale.Today, I want to highlight two new incredible workflows in Tines created by my colleague, Andre Srinivasan. These stories represent the "gold standard" of how to bridge the gap between cloud security and automated response.1. Create Tines Cases for Netskope DLP Incidents (with AI!)View Story in Tines LibraryThis workflow is a game-changer for SOC teams. It doesn’t just pull DLP incidents; it uses Tines’ AI Agent action to intelligently parse the incident details and automatically create a Tines Case.Instead of an analyst manually triaging all sensitive data movement, the AI agent can help summariz

Netskope Cloud Exchange is cybersecurity industry’s leading technology integration platform empowering global organizations to unify their siloed security tools & optimize their ROI.We are announcing the general availability of Netskope Cloud Exchange (CE) v6.0.1 patch release with the business critical security updates described atRisk Assessment, Remediation, and Mitigation Plan for Netskope Cloud Exchange Deployments - Netskope Knowledge PortalBased on recent security market research data, 42% of cloud environments (87K potentially vulnerable instances) worldwide have at least one instance of MongoDB in a version vulnerable to CVE-2025-14847, including both publicly exposed and internal resources.We strongly recommend customers to deploy/upgrade/migrate to CE v6.0.1 with critical bug fixes latest & greatest security updates to strengthen the security posture of their digital ecosystem.Please refer to the CE v6.0.1 release notes at Netskope Cloud Exchange Release Notes Versio

Please tell your CSM/TAM you support IDEA-839 - local account / non-interactive supportThe IDEA has been accepted but does not have a schedule for implementation. If you are using Active Directory to establish identity on workstations, local accounts will bypass policy - allowing the computer to browse the internet without policy restriction nor SSL inspection for DLP or malicious code. If you have non-interactive devices, like servers, the only viable solution is to shift network traffic to Netskope via IPSEC. That lacks the reporting and accountability functionality, and application-level bypasses.  This IDEA seeks to have another solution possibility.

Hello CommunityHas anyone attempted yet to detect via Netskope endpoint agent traffic toward internet-facing Clawdbots AI agents exposed via unauthenticated public endpoints?thanksAndrea

While accessing any sites on incognito mode is very slow for initial time. Once the page is loaded, all the sites are loading normally on new tabs. Once we reopen the browser with incognito mode again, the same issue happening again for initial time.any suggestions?

Hello,I received the IoC list shared by my partner, but accessing it requires a username and password.However, for the Web Page IoC Scraper Plugin, credentials should not be necessary.Is there any alternative solution available?  

Anyone else seeing steering issues when it comes to Microsoft.  For general O365 traffic, getting steered.  But with Intune and some authentication traffic, its a mix of steered and non-steered (direct to Internet).  

Overview Some environments using Netskope Client may encounter SSL or certificate validation issues when running Google Cloud CLI (gcloud) commands.This happens because gcloud relies on its own embedded cacert.pem bundle (under the SDK’s certifi package), which doesn’t automatically include enterprise root certificates — such as Netskope’s Root CA. Important note about bypassing *.googleapis.com In many enterprise deployments administrators add bypass rules for *.googleapis.com (so some Google APIs are sent directly to Google). However, simply configuring core/custom_ca_certs_file with only the Netskope root certificate — or relying only on the Netskope root in a custom bundle — frequently does not resolve SSL errors for these bypassed domains.Why this happens (observed behaviour):After a bypass, the TLS connection may be negotiated directly with Google (or with different certificate chains), or the client and the SDK may expect the full set of public root CAs. If only the Netskope roo

We've enabled the new transaction logs feature and sending it to our AWS S3.We have came across something which we wanted to point out which is the directory structure is in hours/days/month/year this is not how standard logging folders are created and is different from your old approach too. This can be an issue during manual searching or programatic querying in tools like AWS Athena. I suggest changing this to a normal directory structure to avoid these pains.

in one of our customer getting power shell attack in all users office 365 . how we can block .is it possible to block power shell access based on country using CASB or there is any other way to resolve this issue .

I am writing to inquire about the current roadmap and support for Manus AI within the Netskope NewEdge network. As Manus AI gains traction as a powerful general-purpose AI agent, our organization needs to ensure robust data protection and visibility over the sensitive information being shared with this platform.1. Current Status Inquiry: Does Netskope currently have a functional Cloud App Connector for Manus AI? Specifically, are the activities (such as "Post" or "Upload") already being indexed in the CCI (Cloud Confidence Index)?2. Development Suggestion (DLP Integration): If full support is not yet available, I would like to suggest the development of specific DLP controls for Manus AI, focusing on: Prompt Protection: Real-time inspection of text inputs to prevent the leakage of PII, PHI, or source code. File Transfer Control: Monitoring and blocking sensitive documents uploaded to the Manus AI interface. Activity Monitoring: Granular visibility into user sessions to distinguish

Team,Good morning. Is there a reason I'm getting DNS Leakage? Did I forget something in my configuration  See screenshots below.  All "DNS Traffic" is enabled in the steering configuration. DNS Profile is configured with resolver IP of 162.10.1.1 Real-Time Policy is configured. Thanks.  Expand Post

Does NS Client upgrade cause any impact on end user running traffic, especially on active web sessions, Audio/Video calls ? Version 132.0.7.2513_Windows 

User case :   Git Pull/Push basic commands does not work and throws connection timeout error when i enable NPA and even i have whitelisted git hub web site with ports 22,443 but when i disable NPA and use AOVPN it works . so need some advice ?Note: even i have enabled virtio proxy enabled at wsl setting but no luck 

We are supporting a client with two separate Azure tenants and using Netskope SSE for secure access. Our configuration allows certain Azure base URLs via NPA for PaaS services, while the Azure portal routes through SWG. We use the same client and steering configuration for users accessing both tenants.Observed Behavior:When accessing via GUI/browser, traffic is correctly segregated per tenant.When using CLI, traffic always routes to the primary tenant, even when attempting to access resources in the secondary tenant.CLI-based operations cannot properly enforce tenant-specific routing.Impact: CLI operations on the secondary tenant fail or incorrectly use the primary tenant context

Hello,We are looking to control access to a social media site with cloud app access real time policy. However, the site doesn’t exist as a selectable CASB cloud app today and we have to fall back to using SWG policy instead.The site in question is www.weddingpro.com.Can we get a new cloud application created for this website?Thanks,Nick 

Just wanted to see if any of you are servicing customers that have recently implemented NinjaOne for endpoint management and patching. If so, how have you approached the third-party patching? cert pinned app bypass?  domain bypasses? ssl no decrypt policies?  mix of all of the above? We have our endpoint management team working but we just foresee a massive maintenance task in the future for the needed and potentially changing domains? A wildcard approach seems like too much of a security hole. 

Hi team,Can we use  New Policy Group based on location and move all private access Policies on this group?  Example: Site A Private Access ( Group Name)          Site A Private Access Policy 1( Example Policy Name :File Server Site A Access)          Site A Private Access Policy 2 ( Example: Private Web Application Site A Access)         Site A Private Access Policy 3   ( Example: Backup Server Access Site A Access) Site B Private Access( Group Name)         Site  B Private Access Policy1 ( Example Policy  : File Server Site B Access)          Site B Private Access Policy 2  ( Example Policy: Private Web Application Site B Access)         Site B Private Access Policy 3   ( Example Policy: Backup Server site B Access) Challenge what I am trying to solve here is that group policy based on Physical location of offices, so that i dont need go through long list of Policy and navigating through this policies is difficult. So if we arrange the Policies based on locations , we know that this p

Why sometimes on-premise detection shows “remote" and sometimes it shows “off-premise” when users are not in intranet, such as office environment.

It seems that users under SkopeIT are only displayed when accessing Cloud Apps or the Web.Events from Cloud Firewall or Private Apps are not included, resulting in limited visibility.Do you have any suggestions on how we can monitor user activity in these cases?

ObjectiveThe current Private App Segment definition conflicts with what is described in the Netskope Knowledge Base article.When Publisher DNS is enabled, both IP and URL must be defined in the host configuration of a private app segment.Reference:https://docs.netskope.com/en/private-access-best-practices#idm46139539889184In docs.goskope.com, enabling Publisher DNS can still only use URL to define Private app, 2026/1/6 PrerequisiteThis issue generally applies to Netskope Private App Segments Definitions. ContextWe observed that in the current Netskope Private App Segment configuration, once Publisher DNS is enabled, users are unable to access a private application if only the private app URL is defined. Do You Know?This mechanism appears redundant. Once Publisher DNS is enabled, it is possible to configure a random port for the URL and then define a separate policy using the private IP with the correct port, since users can no longer access the URL using the originally defined port.Thi

I would like to get some clarification on a Netskope SWG + DLP deployment scenario.We have established a firewall tunnel to the Netskope cloud and integrated ADFS for user authentication. Both corporate-managed devices and BYOD devices (phones and personal laptops) are connected to the same LAN and their traffic is forwarded to Netskope through the tunnel.My question is regarding BYOD behavior: When ADFS authentication is enabled, are BYOD devices expected to experience browsing or authentication issues? How does Netskope handle user identification and authentication for non-domain-joined devices in this setup? Are there recommended best practices for handling BYOD traffic when using ADFS with a firewall-based forwarding architecture? Any guidance or real-world experience would be appreciated.

 Ref Link Quarterly Product Release Webinar – December 2025 | Community   

Dear Team, We have implemented a policy to block the sharing of source code when a user attempts to send it via file attachments (such as TXT, PDF, DOC, etc.) to personal email domains like @gmail.com. The policy is working as expected when the source code is shared directly as plain text within the email or message body. However, when the same source code is included inside a file attachment and sent, the policy does not trigger. We have already raised this concern with the Netskope Support team, and the response received was that this use case is not supported. However, we request you to please re-check and confirm if there is any possible way to achieve this requirement. Note:We are able to block uploads entirely, but our specific requirement is to block the transfer only when the to_user does not belong to the corporate domain. We request you to please help us understand why this behaviour is occurring and assist in resolving the issue, as this use case is critical and needs to be