Product Forums

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security. Simplified Certificate Management: Provides native certificate management capabilities, removing the operational challenges of maintaining in-house Public Key Infrastructure (PKI) when leveraging the Netskope certificate. Flexible

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffic. It extends Netskope's security controls, including DLP, to personal or non-corporate devices, enhancing visibility and d

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance 

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should be able to pull different Client configurations anyone know if we maybe need to redirect the configuration fi

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create SAML groups using “memberof” values from the SAML assertion response and configure policies in advance even before intercepting user traffic Friendly group name mapping: Netskope administrators can manually map SAML attribute values to user-friendly group names for simplified management and improved clarity in policy configurat

Please let me know if there is another community thread for this issue, but I could not find one when searching.When I attempt to install CE v5.1.1, I get a failure for Docker and Podman because the installer cannot recognize the versions.  However, I have confirmed that these services are installed.  Do they need to exist in a specific file path in order for the installer to see them?

Since deploying the latest golden release of the NS client (v126.0.0.2387) the Last Event field for all systems shows 55 years ago. Is this going to be fixed? 

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) allows organizations to apply Threat Protection to web traffic (ports 80 and 443) for private applications, ensuring files are scanned for malware in real-time. When using Threat Protection with NPA, note that this feature:Requires Client as the Access Method. Scans all web traffic on HTTP (80) and HTTPS (443). Applies real-time scanning to protect private app access from malware and other advanced threats.Netskope One Private Access now a

The Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration…What is the default (new/recently created tenants) for Custom App Domains?What is the value in your tenant for Custom App Domains? Curious if it is best practice and/or common to have this set to *, empty, or specific values. This question comes as the OOB Microsoft Office 365 Outlook.com contains the process below, that is used throughout additional Microsoft products (such as Teams and the Microsoft 365 Copilot app). If your Custom App Domains is set to * for the  Microsoft Office 365 Outlook.com Cert Pinned App in Steering configuration, then all traffic (regardless of the Microsoft app) will bypass Netskope inspection (including DLP policies).Process: msedgewebview2.exe

We have created a policy for USB content control with size limit 50 mb.Issue faced here is if i share file of 40 MB and another of 15 mb it get shared.Use case is we want to restrict complete data transfer over 50 mb not file size The file size limitation is enforced per file, not per session. What we are observing is the expected behavior by design. If your expectation is for Netskope to track the cumulative file size uploaded within a session , for example, a user uploads a 40 MB file at 10:00 AM and then another 15 MB file 15 seconds later, totaling over 50 MB , this functionality is currently not supported.

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Rest API V2 token provisioning workflow. Previous Method: Historically, API tokens were provisioned through the user interface by navigating to Tools -> Rest API V2. Impact of RBAC V3 Enablement: Once RBAC V3 functionality is activated on a tenant, the aforementioned Rest API V2 tok

As a customer facing company, we regularly receive booking-related emails from customers and partners that contain Personally Identifiable Information (PII) such as passport numbers, ID documents, and travel itineraries. To prevent external data leakage, we’ve implemented Netskope DLP to monitor outgoing emails for PII. However, we’re facing a challenge: When our employees reply to incoming emails (even without including any PII in their response), Netskope DLP still quarantines those replies. This is because it detects the original PII from the customer’s message in the reply thread. We want to understand if there’s a way to configure DLP policies so that it only quarantines emails that are originated internally and contain PII, and not block replies to incoming messages that happen to include previously received PII. Is there a solution or best practice to achieve this behavior?

Hi Netskopers, For those of you which have published Active Directory via NPA, using the following guide...Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge Portal The Windows client can then always connect to and authenticate with AD (since its always available via NPA). Due to this, Windows is always applying the less restrictive Domain Firewall Profile even when the remote device is connected to an untrusted network (home wifi, public cafe etc). Normally the more restrictive Public Firewall Profile would be applied. Is this a concern for others?Have you solved this somehow?Are there any other options other than make the Domain Profile more restrictive.

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks

This is just in reference to this thread that I found very helpful but am unable to add a comment.All microsoft delivery optimization - regex.... | CommunityJust in case people find it helpful, I found that the regex wasn’t capturing everything and had to add a few of my own.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b.*\/msdownload\/.* I found that the following examples were being blocked:70.156.87.153/c/msdownload/update/software/updt/2025/03/windows11.0-kb5054980-x64-ndp481_d8ca7b3b24823cc8480dbe3cf3355ae0ca0c311e.cab?cacheHostOrigin=2.au.download.windowsupdate.com177.128.21

It was mentioned that the setting can be configured under Settings > Manage > Multi-Factor Authentication Integration, but in my environment, the Multi-Factor Authentication Integration tab does not appear, as shown in the screenshot below.Has there been an update?Could you let me know where I can configure this?https://docs.netskope.com/en/multi-factor-authentication/ 

Hi all,Has anyone had any issues with using the Netskope proxy and Microsoft Safelinks?We currently use Microsoft safelinks to protect clicks within the Microsoft suite.It is sporadic, but if a user clicks a link within an email, (typically marketing emails) Netskope correctly blocks access due to a SSL mismatch.if we use the safelink decoder to get the actual URL,  we can get to the website without any issues.its two popular products, so i’m assuming others have this same issue, any ideas? We don’t want to bypass the SSL Host Mismatch error. thanks  

I understand that Netskope’s DLP supports multiple languages and offers high detection accuracy. Could you please share whether the keyword matching inspection is performed using external libraries, or if Netskope uses an in-house developed engine?If external libraries are being used, would it be possible for you to disclose information about them?I am particularly interested in how Netskope has addressed challenges such as multilingual support and detecting word boundaries accurately.

When creating a policy to detect email addresses, I used the following regular expression:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}However, the string "csv test" triggered a detection, even though it does not contain an "@" symbol and therefore should not match the expression above.Is there any limitation or specific behavior in how regular expressions are interpreted on the Netskope side that might explain this?

I have configured Dynamic Steering.Here are the steps I took: In the Client Config, I specified the internal web server (192.168.10.156). In Traffic Steering, I enabled the Dynamic Steering option. However, after completing the above configurations, when I check the configuration of a server located in the same network as the web server set in step 1, it shows On-premises check: Remote.Could you please advise on how to resolve this issue? Step1  Step2  It shows On-premises check: Remote 

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in