Recently active topics

Question for the community…..Assuming we are blocking the following 2 categories (and of course blocking all of the known malicious)"Newly Observed Domain" "Newly Registered Domain"What is the opinion as to allowing “Uncategorized”?   I do understand that it is not impossible that a malicious link (in an email for example) could contain just an IP address (since all IP addresses generally are categorized as “Uncatgorized” by default) and therefore is an outlier risk (as uncommon this may be), but are there other known risks here I am not considering? The reason for the ask is that we have found that websites that are categorized by Netskope, on occasion at least, are legitimate business sites and thus have negative impact.  While we can add these to a custom policy that will allow access, it is a bit of a whack-a-mole exercise in futility since sites are added to this list all the time.

Your Netskope Monthly Highlights – September 2026The latest updates, resources, and events – all in one place.Hi there,As part of our ongoing commitment to helping you get the most value out of your Netskope investment, we’re excited to bring you this month’s Netskope Highlights—your one-stop roundup of the latest product updates, expert content, and upcoming learning opportunities. 🚀 Product Release UpdatesRelease 141.0.0 is here! Explore this month’s key features and enhancements to ensure you’re getting maximum value from your setup.📄 Release Notes - September 2026✅ Pro Tip: Check for features relevant to your current configurations. ✅ Features not to miss out!This section highlights key innovations from the recent Netskope release that can significantly enhance your Adoption and Value Realization journey.Top Highlights:1. Free / Included Standard Features Advanced Analytics HomePage Control Center : Unifies deployment health, user experience, and network telemetry metrics directl

Has anyone tried using the new Netskope MCP server through the desktop ChatGPT/Codex application? Its not on the officially support list so the instructions aren’t clear on installing the server for this application. I’d like to install it both from the OpenAI Admin side as well as the users Desktop Application.

Note to readers: This page is no longer being maintained. We're busy building a new, improved page for you!For all our latest and previous webinar recordings, please visit our dedicated Webinar Recordings Page.Thanks for your understanding! =====================Dear Valued Partners, We sincerely thank you for your active participation in the Technical Workshops hosted by Customer Solutions Group (CSG) at Netskope.In this post we are sharing Partners' Netskope Academy links, which have recording and slide-deck of the most recent workshops. To access recording of a Customer Workshop, log-in to your NETSKOPE ACADEMY account, and then click the desired link listed below.  If you are Netskope Customer, visit this community post to access the recordings. If you are Netskope employee, visit this internal page to access the recordings. Recording of Spanish and Portuguese events If you have question about partner programs, resources and certifications, visit Netskope partner portal 

The Netskope Client Golden Updates for version 141 is here: Golden Release Updates Subscription.  This document provides a summary of the new features, fixed issues, and other Netskope Client updates introduced between versions 138 and 141.

The Netskope Cloud R141.0.0 documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Version 141.0.0.The key new or updated feature is:SaaS Security Posture ManagementControl Visibility to SSPM Findings by App InstanceSubmit your feedback via docs.netskope.com.

Hi We have bypassed outlook.com and created a cert pinned app - wbxcoiex.exe,searchprotocolhost.exe,msedgewebview2.exe,winword.exe,outlook.exethese are the URLS we have added: outlook.com, outlook.office365.com, office365.com, outlook.office.com, groupsapi-prod.outlookgroups.ms, groupsapi2-prod.outlookgroups.ms, groupsapi3-prod.outlookgroups.ms, groupsapi4-prod.outlookgroups.ms, outlookgroups.ms, outlook.office365.de, outlook.office.de, outlook.de, office365.de, attachment.outlook.office365-net.de, attachment.outlook.office.de, attachments.office.net, attachments.office365.net, graph.microsoft.com  However, users on Netskope get a popup asking for their password throughout the day.  We are in the middle of a rollout and its only Netskope users that have this issue. See below popup   Are there any recommendations on how to handle outlook exceptions as we assume that something is getting inspected and Microsoft doesn’t like that. 

Does Netskope have logs to view prompts sent to AI tools (Gemini, Claude, etc)?

Google’s AI Mode is now correctly being categorized as Generative AI.As with Gemini and other AI tools, there are organization wide guardrails you can setup for corporate accounts so we would like to allow only our corporate google instance and block non-corporate or logged-out instances of Google AI Mode.To do this, the instance must first be detected in Google AI Mode.

Has anyone every written an Advanced Analytics report detailing when the last time each individual accessed a URL?

Netskope AI SecOps can stream case, user-risk, and AI-risk events into CrowdStrike Falcon Next-Gen SIEM. Once those events are available in Falcon, the integration can go beyond visibility: an NG-SIEM correlation rule can create a detection, an existing CrowdStrike AI Agent can enrich the event with endpoint and identity context, and a Fusion workflow can apply the resulting verdict to downstream response actions.This article builds on Sending Netskope AI SecOps Events to CrowdStrike Falcon Next-Gen SIEM. Complete that ingestion setup first, including the HTTP Event Collector endpoint with /raw and the netskope-sse parser. IMPORTANT   Build and validate this workflow in a test tenant before enabling response actions in production.  What this solution doesThe completed flow performs the following steps:Netskope AI SecOps sends an event such as case.created, case.assigned, or risk.user.threshold_exceeded to Falcon Next-Gen SIEM. The netskope-sse parser maps the event into searchabl

We are enhancing a Real-time Protection policy designed to prevent users from accessing personal or non-corporate accounts through sanctioned and unsanctioned cloud applications.Our current policy configuration is:Categories: Cloud Storage, Application Suite, Webmail, and Technology Activities: Login Attempt and Login Successful Constraint: From User = Non-Corporate Domains Action: Block

Enterprises are adopting AI at a pace that has outstripped the existing Zero Trust Maturity Model (ZTMM). Current security pillars are designed to verify the authenticity of human and application entities, but they are not architecturally equipped to inspect the intent and scope of autonomous AI agents. The result is not merely an operational oversight; it is a structural gap where AI interactions bypass existing telemetry streams. This document defines the framework for bridging this gap by evolving CISA ZTMM 2.0 to include a dedicated 6th Pillar for AI & Autonomous Systems.This 6th pillar is designed to own the governance and lifecycle of AI models and agents, distinguishing it from the existing five pillars (Identity, Devices, Networks, Applications & Workloads, and Data) which continue to act as "Enforcement Points" for AI security. Executive SummaryProblem: Current ZTMM 2.0 pillars are designed for known assets; they cannot interpret the autonomous intent of AI agents. Sol

Turning CrowdStrike Zero Trust Scores Into Automatic Netskope Policy ResponseA direct, visual Fusion SOAR workflow that resolves a device, applies a Netskope risk tag, and lets policy take it from there — across three tiers of risk.By Gary Jenkins, Principal Solutions Architect, Netskope Technology Alliances  Why This Approach Works WellCrowdStrike's Falcon Fusion SOAR ships a native Cloud HTTP Request action — no custom Foundry app, no code to deploy, just point it at a URL from inside a visual workflow builder. Netskope, on the Device Tags REST API, lets an external system push a tag onto a specific device, which a Device Classification rule can then watch for. Put those two together and you get a straight line from a CrowdStrike event to a Netskope policy decision, with the entire logic living in one place.That directness is the real advantage. The whole decision chain — trigger, risk-tier logic, device resolution, tag application — lives in a single visual workflow you can open and

We have created a client config such that user connected to office network, their private access should be disabled. When they are outside office network, they are getting Netskope IP. But when in Office network, they are getting ISP IP. Why such behaviour in above steering config. This is the Steering config which we have created. Why it is taking ISP IP instead of Netskope IP when connected to office network.  

Device Tags for ClassificationAPI Guide for Integration PartnersIntroductionThe Netskope Device Classification API enables partners and administrators to programmatically manage device tags within their Netskope environment. Device tags provide a flexible classification mechanism to organize and apply policies to devices based on custom risk assessment, device type, department, or any other business classification criteria.This guide demonstrates how to view existing device tags, create new tags, apply them to devices, and manage tag lifecycle through RESTful API endpoints.We will use both Device Tags and Device Classification. Here is a short description of both. Device Classifications vs Device TagsDevice ClassificationsPurpose: Automatic, rule-based classification system How they work: You create rules that automatically apply classifications to devices based on conditions (OS type, presence of other tags, etc.) API Endpoints: Create: POST /api/v2/deviceclassification/tags Create r

Goal: Learn how to automate Netskope Admin Console role assignment based on a user's login location when authenticating through Okta. Example: When logging in to the Netskope Admin Console through Okta, different admin roles should be assigned automatically depending on the country the user is signing in from. Partner requirement: Administrators should be able to configure different roles for different members, based on their own requirement definition (e.g., country, region). PrerequisitesNetskope tenant configured for SSO/SAML with Okta as the Identity Provider for Admin Console login. A local tenant admin account in Netskope with rights to view predefined roles and create custom roles. Okta Workflows enabled on the Okta tenant. Workflows is a separate entitlement/add-on and is not included in every Okta edition — confirm this is licensed before scoping the project. Admin rights in Okta to create groups, edit the Netskope SAML app configuration, and build/activate Workflows.Limitatio

The Netskope Cloud R140.1.0 hotfix documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Hotfix Version 140.1.0.Submit your feedback via docs.netskope.com.

Netskope AI SecOps can deliver Cases, User Risk, and AI Risk events to CrowdStrike Falcon Next-Gen SIEM (LogScale) in near real time through Outbound Webhooks and a Falcon HEC / HTTP Event Connector. This article walks through the full setup: creating the connector on the Falcon side, configuring the webhook on the Netskope side, and querying the parsed data once it lands.What you will buildEvents land already parsed: the netskope-sse CPS parser package — the same package that normalizes Netskope's other SSE alert and event streams — recognizes the AI SecOps envelope shape and promotes the relevant fields to ECS at ingest time. There's no separate parser-authoring step like you'd do in a query-time SIEM; select the parser once on the connector and every case/risk event that follows is normalized automatically.PrerequisitesA Netskope tenant with AI SecOps enabled and admin access to configure Outbound Webhooks. A CrowdStrike Falcon Next-Gen SIEM tenant with permission to create Data Con

Hello all!Customer’s internal domain ends is customer.net. We know that’s a public domain (.net), but it predates us, and we don’t think that migrating to customer.local or something like that is viable in the given time.We are deploying NPA and, so far so good. The issue is that their domain exists on the internet, and is not owned by the customer themselves. So, if a client resides outside of the premises, they can resolve internal names to a public IP address. And since that domain seems to have some sort of catch-all resolution, everything gets resolved.The security concerns are obvious: the owner of the public domain can learn all of their internal services hostnames and then deploy phishing sites, etc.We already have blocked that IP address, but we are trying to block DNS resolution all together. Although blocking other domains works, this one doesn’t, because it is defined in many private apps.What can we do to sucessfully block these requests?Thanks.

Hello.Is the Netskope Publisher supported on ARM hardware?Specifically the standalone Ubuntu install method Thanks!

Dear Netskope Team,As I understand, AI Post and AI Response activities should be generated when a user interacts with an AI assistant in a SaaS application such as Microsoft 365 Copilot.However, when testing M365 Copilot, I can only see Post and Response activities in Application Events and do not see any AI Post activity.Is this expected behavior, or should AI Post activity also be generated for M365 Copilot?Thank you in advance.