Product Forums

Hello,We have quite a few joint customers who utilize your security solution. Recently, we’ve observed that some of these customers are encountering challenges with server-sent events (SSE) that we employ in our production environment for near real-time communication.Could you kindly clarify if Netskope buffers SSE streams for traffic inspection? If so, is there a recommended configuration or approach to ensure uninterrupted SSE functionality? Thank you for your assistance. Best regards,John

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.   

We are just kicking the tires on the Netskope Private Access functionality.  We are trying to understand if it would be possible to drop certain traffic out of the Netskope tunnel and onto the local wire.  For example, we do not want to send print jobs from the endpoints to the publishers if we can just break that traffic out of the tunnel and drop it right to the printers in office.Any advice?  We have been tinkering with on-premise / off-premise steering configs but cannot put a finger on how this could/shoudl work.

Hello,In the context of a ZTNA project, we have the option to publish "all ZTNA applications" or only the applications necessary for the user group/OU in the Steering profile. In a ZTNA approach, it seems interesting to publish only the applications necessary for users who are members of a group.Would it be possible to obtain an API Endpoint to automate the creation and assignment of a steering profile with the necessary applications?

I need to apply different Netskope client/steering configurations to local users who are not managed by my external IDP (Entra / OneLogin etc...).Currently the only way to assign client/steering configs is via groups but as this is a local user, the default is then used, which is not a viable option to modify. To address this, could Netskope please consider implementing one of the following options: Direct User Assignment: Allow administrators to assign client and steering configurations directly to individual users, even if they are local users. Local Groups in Netskope: Enable the creation of local user groups within Netskope, independent of the external IDP, to allow for flexible configuration assignments.

I have configured SAML - Forward Proxy for Cloud Explicit Proxy Authentication. This setup has been working for some time, but now our IdP fails to verify the signature of the SAMLRequest. I have checked and re-imported the SAML configuration XML file from the tenant into the IdP and verified that the certificate is correct, but I still encounter the same error.I also have a different SAML - Forward Proxy configuration for Client Enrollment that is working fine, although I believe it works differently.I am using F5 APM as the IdP/SP. The SP is configured with the downloaded Netskope XML metadata file.The client browser is configured with eproxy-xxxxx.de.goskope.com:8081 for HTTP/HTTPS, and the certificates are imported.I have tried both Redirect Binding and POST Binding: Redirect Binding:Browser Error: Status Code Mismatch  Please contact your admin for assistance  unkn - assert.ERR_STATUS IdP Logs:Error verifying SAML message signature (with 1 certificate(s)) - RSA verification faile

Saw this but it doesn’t have clear info on how we can set identifier for different attributes of printer. https://docs.netskope.com/en/constraint-profile/ Does anyone know how to regulate the printer yet?

Our organization must review our policies to determine if the existing policies are still valid and need to be retained.  Problem we are having is that “allow” rules do not appear to log anywhere.  Short of turning all “allow” rules to be “alert” rules, does anyone have a way to validation if a web access rule is actually being used and needed to be retained?

Have been looking to see if there is a way to block instagram messaging posting.. but allow users to view the messaging window. It looks like all the available activities have not targeted the messaging feature.Has anyone ever had success in allowing viewing of the messaging page but not allow users to post messages?Thanks

Policy:Block Upload File Converter Description:In this example we will block the upload action for cloud applications from the "File Converter" category. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Policy:Block Confidential Word ChatGPT Description:Policy to prevent sensitive data from being entered into ChatGPT Video:Leandro Timotio de LimaCustomer Success ManagerLinkedin

Policy:Block Download File Type Description:Policy to prevent downloading of files that may put the organization at risk, for example binary files Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin 

Policy:Block Risk Country Description:Policy for blocking access to websites in risk countries Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin 

Policy:Block Tag Deny Description:Policy to block cloud applications using custom TAG Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

Chief Evangelist, Bob Gilbert, performs a live demo of Train Your Own Classifier, which is Netskope’s groundbreaking solution that puts the power of AI in the hands of customers. Anyone deployed on the Netskope platform with advanced data protection can now train AI/ML models using their own unique corpus of data.  

Hi, I have CASB API DLP policies configure for Slack and want to know how to exclude (whitelist) specific private channels from inspection? We are in the process of renaming our private channels with a keyword to let us know it approved to hold certain type of data. Right now its all or nothing..

Policy:Gmail Account ControlDescription:Example of how to prevent users from accessing Gmail with a personal accountVideo:Leandro Timotio de LimaCustomer Success ManagerLinkedin 

Policy:Allow Netskope Channel Youtube Description:Example of how to create channel control on YouTubeVideo:Leandro Timotio de LimaCustomer Success ManagerLinkedin

Hello Community,  I am writing to formally request a comprehensive list of all applications incorporated within the Google Suite. As we are currently assessing our permissions policy, it is imperative to identify which applications should be authorized for business use and which should be subject to restrictions. Our existing Google Suite policy grants access to all global users; however, we aim to implement restrictions on specific applications, including YouTube, for designated user groups. Having a detailed enumeration of these applications will greatly assist us in making well-informed decisions regarding access permissions. Thank you in advance for your assistance with this matter.

We are working towards implementing a rule that looks for plaintext credentials within shared documents. In doing so, we’ve utilized the Passwords (contextual) pre-defined entity. We’ve noticed that this entity is catching teams and zoom meeting passcodes. We do not want to catch these passcodes in the rule and are trying to create a “not near” advanced expression. I’m looking for guidance on how to perform this. For example here is what we have: P1 = Passwords (Contextual)D5 = Custom Dictionary of words like “meeting”, “teams”, “zoom”, etc… Both options we’ve tried: 1.) ( P1 AND ( NOT ( P1 NEAR D5 ) ) )2.) (P1 AND NOT (P1 NEAR D5)) Any help would be appreciated.  

Has anyone else had problems with communication failing when running services on localhost or loopback addresses?  I have several developer teams who receive errors when running local web services for testing.  I've added an exception to the Steering Configuration with a Destination Location but that doesn't seem to solve the issue.    

Administrative access to the Netskope tenant is restricted by the Allowlist, meaning administrators can only access the tenant if they are connecting from an IP address listed in the Allowlist. The Allowlist not only controls administrative access, but we have also noted that when attempts are being made to establish REST API connections or calls to the tenant these calls will fail if the IP address it is originating from is not on the Allowlist.There are instances where we want API calls from IP address ranges but at the same time we do not want administrative access to the tenant being granted to these IP addresses.Case in point. We are working with a Netskope SME to implement the Netskope Codeless Connector which sits in Microsoft Sentinel. The connector ingests Netskope logs directly into Sentinel via REST API calls. Sentinel does not have its own IP address range so it uses the Azure Public  IP Addresses to make those API calls. These calls will fail because the IP address which t

Is it possible to allow rdp access to a private app using a PQDN? If so, what steps would have to be implemented to enable this? 

Hello,is there a way to revoke an existing NPA session? Ex. Employee is terminated remotely but has an active NPA session they authenticated to that doesn’t expire for 6 more hours.thanks,Nate

Hello,We are ingesting Netskope logs via CE Log Shipper into Elastic. These are events and alerts. How can we ingest the Netskope client related events for users disabling/re-enabling the client? Advanced Analytics presents this information, so the logs exist. Can they be exported via CE Log Shipper?Thanks.