Product Forums

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hi all, Nice to meet you! I'm currently distributing Netskope clients on company computers (both Windows and Ubuntu). I have configured the Netskope clients to Google Workspace accounts.This works fine for users without a passkey (Yubikey), but if they enable one, the client doesn't complete the login process. Has anyone else experienced this issue and found a solution?Thank you.  

 Issue Description: A customer needs to selectively block videos from playing on Facebook while still allowing users to browse the Facebook platform. This requires a targeted approach to block specific Facebook video-related URLs and domains without completely blocking access to the entire Facebook platform. Environment: Netskope tenant with web filtering capabilities Resolution: 1. Create a URL list with the following entries:video.*\.fbcdn\.netwww.facebook.com/watchwww.facebook.com/videofb.watch 2. Create a custom category in Netskope to encapsulate the URL list:  - Navigate to the custom categories section in your Netskope tenant  - Create a new custom category  - Add the URL list created in step 1 to this category 3. Create a

Building on our discussions about traffic steering and the powerful Netskope Client, let's explore how to unlock the true potential of your Netskope SASE platform: achieving granular visibility.Deep visibility is built upon several layers of context, each with critical dependencies. Understanding these layers is key to extracting maximum value, enabling precise policy enforcement, and contributing directly to your organization's robust security and compliance posture. User, Group, and Organizational Unit (OU) Information: Value: This foundational context is paramount for establishing Identity-Centric Zero Trust. By knowing who is accessing resources, it enables explicit trust decisions, precise role-based access controls (RBAC), and granular auditing, aligning with the "never trust, always verify" principle. Compliance Reference: E

Good morning!Can Netskope identify executable files or even other types within compressed files (zip), for example?

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security.

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffi

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance 

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should b

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create S

Please let me know if there is another community thread for this issue, but I could not find one when searching.When I attempt to install CE v5.1.1, I get a failure for Docker and Podman because the installer cannot recognize the versions.  However, I have confirmed that these services are installed.  Do they need to exist in a specific file path in order for the installer to see them?

Since deploying the latest golden release of the NS client (v126.0.0.2387) the Last Event field for all systems shows 55 years ago. Is this going to be fixed? 

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) al

The Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration…What is the default (new/recently created tenants) for Custom App Domains?What is the value in your tenant for Custom App Domains? Curious if it is best practice and/or common to have this set to *, empty, or specific values. This question comes as the OOB Microsoft Office 365 Outlook.com contains the process below, that is used throughout additional Microsoft products (such as Teams and the Microsoft 365 Copilot app). If your Custom App Domains is set to * for the  Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration, then all traffic (regardless of the Microsoft app) will bypass Netskope inspection (including DLP policies).Process: msedgewebview2.exe

We have created a policy for USB content control with size limit 50 mb.Issue faced here is if i share file of 40 MB and another of 15 mb it get shared.Use case is we want to restrict complete data transfer over 50 mb not file size The file size limitation is enforced per file, not per session. What we are observing is the expected behavior by design. If your expectation is for Netskope to track the cumulative file size uploaded within a session , for example, a user uploads a 40 MB file at 10:00 AM and then another 15 MB file 15 seconds later, totaling over 50 MB , this functionality is currently not supported.

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Re

As a customer facing company, we regularly receive booking-related emails from customers and partners that contain Personally Identifiable Information (PII) such as passport numbers, ID documents, and travel itineraries. To prevent external data leakage, we’ve implemented Netskope DLP to monitor outgoing emails for PII. However, we’re facing a challenge: When our employees reply to incoming emails (even without including any PII in their response), Netskope DLP still quarantines those replies. This is because it detects the original PII from the customer’s message in the reply thread. We want to understand if there’s a way to configure DLP policies so that it only quarantines emails that are originated internally and contain PII, and not block replies to incoming messages that happen to include previously re

Hi Netskopers, For those of you which have published Active Directory via NPA, using the following guide...Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge Portal The Windows client can then always connect to and authenticate with AD (since its always available via NPA). Due to this, Windows is always applying the less restrictive Domain Firewall Profile even when the remote device is connected to an untrusted network (home wifi, public cafe etc). Normally the more restrictive Public Firewall Profile would be applied. Is this a concern for others?Have you solved this somehow?Are there any other options other than make the Domain Profile more restrictive.

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks