Product Forums

I can’t see a newly created Google team drive in API-Enabled Protection. It has the same configuration as the other drives that are visible in our tenant. I am also a Manager of the drive. I verified it is active in Google Admin as well. Any idea’s what could be wrong?

Hello Community,some of our clients stuck on version 114 or 117 - most updated without a problem. Has anyone encountered something similar and maybe solve it? Best regards

Hi Everyone,  Thought I would share some information about Authentication to AD and using Microsoft NPS for radius auth providing MFA when connecting to the Publishers with SSH.  This is useful instead of using the default shared account. The information I obtained to get this working was obtained from the following sources, it was quite straight forwarded and implemented without much difficulty… and I am no Linux admin. Introduction to network user authentication with SSSD | UbuntuHow to set up SSSD with Active Directory | UbuntuTroubleshooting SSSD | UbuntuAzure MFA for SSH using NPS/MFA Extension Good luck with it, hope someone else finds this helpful. 

Can CIDR blocks be scraped and pushed to a Netskope URL list using the web scraper plugin for threat exchange? I have one setup to pull from the Proofpoint Emerging Threats IP block list (https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) but it seems to only push individual IPv4 addresses and ignores anything with a CIDR. 

Team, Good morning, and Happy Friday! I had a meeting with my server admins and network engineers. I was told they must access hundreds of servers through RDP and network gear, such as routers, switches, and administration consoles. In addition, smaller subnets /24s may be created. My plan is to make administration of NPA easier, I was going to add a /16 or /8 subnet range in my NPA configuration that includes all the above devices. I wanted to know if anyone had any issues or limitations with NPA using large subnets. The extensive subnet ranges will only be used for two groups. All other teams will have one-to-one NPA configuration. Thanks again for your time and input.

If you have PAC files or WPAD deployed to user base here are recommended settings:   1. Following traffic needs to go via PAC addon-<TENANT-NAME>.goskope.com     2. Following traffic needs to go DIRECT gateway-<TENANT-NAME>.goskope.com gateway-backup-<TENANT-NAME>.goskope.com dns.google     3. Do not use Netskope consolidated IP ranges in the PAC file. If you add global range the "addon" traffic will also fall under that range.     Sample PAC file:   Here is a typical PAC file syntax. Check what's the ultimate "return" statement. The address "163.116.128.80:8080"  in this PAC file is the Netskope Explicit Proxy over Tunnel IP address.    { <snip> .. .. /* Don't proxy to access to Netskope URLs for clients     */       if (shExpMatch(host, 'gateway-<TENANT_NAME>.goskope.com'))          { return 'DIRECT'; } (repeat for

When I have installed the netskope client, my trent micro security agent gives the error Check you internet Connection and I am not able to scan. What should I configure in my netskope tenant to allow the internet connection?

We have configured a User Notification / pop-up when users receive a Block action in NPA, to advice them, that they have tried to access an application which is blocked.We also coach them to raise a ticket for this on our ServiceNow system, and ideally we would like to provide a link in the pop-up, that leads users directly to our ServiceNow instance.It says in the description:“The "User Notification" template can be customized by directly editing the HTML below. Use the insert button to insert Netskope template variables. Only simple text and links are supported.”I have already learned, that apparently variables are not an option for the NPA pop-up.How about inserting URLs into the notification?I have tried various options, but it doesn’t seem to make its way into the pop-up. --Erik 

Hello,I want to clarify if the Netskope client is required for NPA access for users who are at the office.We have deployed NPA so that we can force an external public Application traffic through a publisher to get a fixed public IP address due to public IP address whitelisting requirements.  As we have IPSec tunnels connecting the site to Netskope cloud,  do we still need to have the client installed on the users device? Do we need to have browser based access configured for this to work?For Zscaler this is not a requirement. We use Zscaler ZPA for another customer to route Guest Wifi clients to the self-registration portal. The Guest traffic goes over IPsec tunnels to the Zsclaer cloud and Zsclaer send to to a ZPA connecter. This allows the routing of Guest traffic without having to send it over the customers internal network.This set up does not seem to work in Netskope.  If application trafic is sent over the IPsec traffic Netskope, it is not sent to the Publisher. It works when the

Hey folks, does anyone have any experience so far deploying Netskope Steering Agent to macOS in versions above 15?  Our Jamf policies that have worked for some time have stopped. Specifically the VPN configuration profile fails to deploy with the error:The ‘VPN Service’ payload could not be installed. The VPN service could not be created. This continues to work on anything below 15. Anyone needed to update their Jamf policies in order to get this to work? And by policies I mean the configuration profiles?

Hello,We have quite a few joint customers who utilize your security solution. Recently, we’ve observed that some of these customers are encountering challenges with server-sent events (SSE) that we employ in our production environment for near real-time communication.Could you kindly clarify if Netskope buffers SSE streams for traffic inspection? If so, is there a recommended configuration or approach to ensure uninterrupted SSE functionality? Thank you for your assistance. Best regards,John

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.   

We are just kicking the tires on the Netskope Private Access functionality.  We are trying to understand if it would be possible to drop certain traffic out of the Netskope tunnel and onto the local wire.  For example, we do not want to send print jobs from the endpoints to the publishers if we can just break that traffic out of the tunnel and drop it right to the printers in office.Any advice?  We have been tinkering with on-premise / off-premise steering configs but cannot put a finger on how this could/shoudl work.

Hello,In the context of a ZTNA project, we have the option to publish "all ZTNA applications" or only the applications necessary for the user group/OU in the Steering profile. In a ZTNA approach, it seems interesting to publish only the applications necessary for users who are members of a group.Would it be possible to obtain an API Endpoint to automate the creation and assignment of a steering profile with the necessary applications?

I need to apply different Netskope client/steering configurations to local users who are not managed by my external IDP (Entra / OneLogin etc...).Currently the only way to assign client/steering configs is via groups but as this is a local user, the default is then used, which is not a viable option to modify. To address this, could Netskope please consider implementing one of the following options: Direct User Assignment: Allow administrators to assign client and steering configurations directly to individual users, even if they are local users. Local Groups in Netskope: Enable the creation of local user groups within Netskope, independent of the external IDP, to allow for flexible configuration assignments.

I have configured SAML - Forward Proxy for Cloud Explicit Proxy Authentication. This setup has been working for some time, but now our IdP fails to verify the signature of the SAMLRequest. I have checked and re-imported the SAML configuration XML file from the tenant into the IdP and verified that the certificate is correct, but I still encounter the same error.I also have a different SAML - Forward Proxy configuration for Client Enrollment that is working fine, although I believe it works differently.I am using F5 APM as the IdP/SP. The SP is configured with the downloaded Netskope XML metadata file.The client browser is configured with eproxy-xxxxx.de.goskope.com:8081 for HTTP/HTTPS, and the certificates are imported.I have tried both Redirect Binding and POST Binding: Redirect Binding:Browser Error: Status Code Mismatch  Please contact your admin for assistance  unkn - assert.ERR_STATUS IdP Logs:Error verifying SAML message signature (with 1 certificate(s)) - RSA verification faile

Saw this but it doesn’t have clear info on how we can set identifier for different attributes of printer. https://docs.netskope.com/en/constraint-profile/ Does anyone know how to regulate the printer yet?

Our organization must review our policies to determine if the existing policies are still valid and need to be retained.  Problem we are having is that “allow” rules do not appear to log anywhere.  Short of turning all “allow” rules to be “alert” rules, does anyone have a way to validation if a web access rule is actually being used and needed to be retained?

Have been looking to see if there is a way to block instagram messaging posting.. but allow users to view the messaging window. It looks like all the available activities have not targeted the messaging feature.Has anyone ever had success in allowing viewing of the messaging page but not allow users to post messages?Thanks

Policy:Block Upload File Converter Description:In this example we will block the upload action for cloud applications from the "File Converter" category. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Policy:Block Confidential Word ChatGPT Description:Policy to prevent sensitive data from being entered into ChatGPT Video:Leandro Timotio de LimaCustomer Success ManagerLinkedin

Policy:Block Download File Type Description:Policy to prevent downloading of files that may put the organization at risk, for example binary files Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin 

Policy:Block Risk Country Description:Policy for blocking access to websites in risk countries Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin 

Policy:Block Tag Deny Description:Policy to block cloud applications using custom TAG Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Chief Evangelist, Bob Gilbert, performs a live demo of Train Your Own Classifier, which is Netskope’s groundbreaking solution that puts the power of AI in the hands of customers. Anyone deployed on the Netskope platform with advanced data protection can now train AI/ML models using their own unique corpus of data.