Recently active topics

We have created a client config such that user connected to office network, their private access should be disabled. When they are outside office network, they are getting Netskope IP. But when in Office network, they are getting ISP IP. Why such behaviour in above steering config. This is the Steering config which we have created. Why it is taking ISP IP instead of Netskope IP when connected to office network.  

Device Tags for ClassificationAPI Guide for Integration PartnersIntroductionThe Netskope Device Classification API enables partners and administrators to programmatically manage device tags within their Netskope environment. Device tags provide a flexible classification mechanism to organize and apply policies to devices based on custom risk assessment, device type, department, or any other business classification criteria.This guide demonstrates how to view existing device tags, create new tags, apply them to devices, and manage tag lifecycle through RESTful API endpoints.We will use both Device Tags and Device Classification. Here is a short description of both. Device Classifications vs Device TagsDevice ClassificationsPurpose: Automatic, rule-based classification system How they work: You create rules that automatically apply classifications to devices based on conditions (OS type, presence of other tags, etc.) API Endpoints: Create: POST /api/v2/deviceclassification/tags Create r

Goal: Learn how to automate Netskope Admin Console role assignment based on a user's login location when authenticating through Okta. Example: When logging in to the Netskope Admin Console through Okta, different admin roles should be assigned automatically depending on the country the user is signing in from. Partner requirement: Administrators should be able to configure different roles for different members, based on their own requirement definition (e.g., country, region). PrerequisitesNetskope tenant configured for SSO/SAML with Okta as the Identity Provider for Admin Console login. A local tenant admin account in Netskope with rights to view predefined roles and create custom roles. Okta Workflows enabled on the Okta tenant. Workflows is a separate entitlement/add-on and is not included in every Okta edition — confirm this is licensed before scoping the project. Admin rights in Okta to create groups, edit the Netskope SAML app configuration, and build/activate Workflows.Limitatio

Has anyone every written an Advanced Analytics report detailing when the last time each individual accessed a URL?

The Netskope Cloud R140.1.0 hotfix documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Hotfix Version 140.1.0.Submit your feedback via docs.netskope.com.

Netskope AI SecOps can deliver Cases, User Risk, and AI Risk events to CrowdStrike Falcon Next-Gen SIEM (LogScale) in near real time through Outbound Webhooks and a Falcon HEC / HTTP Event Connector. This article walks through the full setup: creating the connector on the Falcon side, configuring the webhook on the Netskope side, and querying the parsed data once it lands.What you will buildEvents land already parsed: the netskope-sse CPS parser package — the same package that normalizes Netskope's other SSE alert and event streams — recognizes the AI SecOps envelope shape and promotes the relevant fields to ECS at ingest time. There's no separate parser-authoring step like you'd do in a query-time SIEM; select the parser once on the connector and every case/risk event that follows is normalized automatically.PrerequisitesA Netskope tenant with AI SecOps enabled and admin access to configure Outbound Webhooks. A CrowdStrike Falcon Next-Gen SIEM tenant with permission to create Data Con

Hello all!Customer’s internal domain ends is customer.net. We know that’s a public domain (.net), but it predates us, and we don’t think that migrating to customer.local or something like that is viable in the given time.We are deploying NPA and, so far so good. The issue is that their domain exists on the internet, and is not owned by the customer themselves. So, if a client resides outside of the premises, they can resolve internal names to a public IP address. And since that domain seems to have some sort of catch-all resolution, everything gets resolved.The security concerns are obvious: the owner of the public domain can learn all of their internal services hostnames and then deploy phishing sites, etc.We already have blocked that IP address, but we are trying to block DNS resolution all together. Although blocking other domains works, this one doesn’t, because it is defined in many private apps.What can we do to sucessfully block these requests?Thanks.

Hello.Is the Netskope Publisher supported on ARM hardware?Specifically the standalone Ubuntu install method Thanks!

Dear Netskope Team,As I understand, AI Post and AI Response activities should be generated when a user interacts with an AI assistant in a SaaS application such as Microsoft 365 Copilot.However, when testing M365 Copilot, I can only see Post and Response activities in Application Events and do not see any AI Post activity.Is this expected behavior, or should AI Post activity also be generated for M365 Copilot?Thank you in advance.

Hear from our SOC manager and Sr. Data Analyst as we share how Netskope leverages AI security dashboards to monitor AI usage, uncover AI security concerns, and convert this into actionable insights. Learn how to:Monitor AI adoption, uncover risky AI usage, and gauge overall AI risk level using the AI Usage and AI Risk Assessment Dashboards Manage risky user and model behaviors using the AI Guardrails Dashboard Monitor and control AI app-to-app traffic using the AI Gateway Dashboard Monitor MCP usage using the Agentic Broker - MCP DashboardFor more information, check out our Advanced Analytics forum.   View past events in this series! Check out some customer questions below, or feel free to comment and continue the discussion!  Q: Where can I access this Activity in the AI Apps dashboard within the console?A: Visibility into user activities can be found in the "Activity in AI Apps" section of the AI Usage Dashboard.  Q: How can Netskope monitor and control the use of unsanctioned AI to

Hi We have bypassed outlook.com and created a cert pinned app - wbxcoiex.exe,searchprotocolhost.exe,msedgewebview2.exe,winword.exe,outlook.exethese are the URLS we have added: outlook.com, outlook.office365.com, office365.com, outlook.office.com, groupsapi-prod.outlookgroups.ms, groupsapi2-prod.outlookgroups.ms, groupsapi3-prod.outlookgroups.ms, groupsapi4-prod.outlookgroups.ms, outlookgroups.ms, outlook.office365.de, outlook.office.de, outlook.de, office365.de, attachment.outlook.office365-net.de, attachment.outlook.office.de, attachments.office.net, attachments.office365.net, graph.microsoft.com  However, users on Netskope get a popup asking for their password throughout the day.  We are in the middle of a rollout and its only Netskope users that have this issue. See below popup   Are there any recommendations on how to handle outlook exceptions as we assume that something is getting inspected and Microsoft doesn’t like that. 

Your Netskope Monthly Highlights – August 2026The latest updates, resources, and events – all in one place.Hi there,As part of our ongoing commitment to helping you get the most value out of your Netskope investment, we’re excited to bring you this month’s Netskope Highlights—your one-stop roundup of the latest product updates, expert content, and upcoming learning opportunities. 🚀 Product Release UpdatesRelease 140.0.0 is here! Explore this month’s key features and enhancements to ensure you’re getting maximum value from your setup. 📄 Release Notes - August 2026✅ Pro Tip: Check for features relevant to your current configurations. ✅ Features not to miss out!This section highlights key innovations from the recent Netskope release that can significantly enhance your Adoption and Value Realization journey.Top Highlights:Agentic Broker for Securing MCP CommunicationsAgentic Broker now lets you apply real-time protection policies directly to Model Context Protocol (MCP) traffic from a de

Hi Team, We needed to export the list of Certificate Pinned applications (including custom)and steering configuration list where these are part of exception. There is no option available . Please suggest where to export such details.

Hi,When we publish applications using classic authentication, we do not encounter any issues. However, when we publish applications that are federated with our Identity Provider (IdP), after the authentication process completes and then the user is redirected back to the application's original URL, the browser displays an access error: ERR_NAME_NOT_RESOLVED Does anyone know if any additional configuration is required for this type of access to work? Thx 

Netskope AI SecOps can deliver Cases, User Risk, and AI Risk events to Microsoft Sentinel in near real time through Outbound Webhooks and the Azure Monitor Logs Ingestion API. This article walks through the full setup: the Azure resources, the identity, the webhook configuration, and the queries to work with the data. Everything is copy-paste ready — replace the <angle-bracket> placeholders with your own values.Figure 1. The AI SecOps Integrations page with the Outbound webhooks tile.  What you will build  PrerequisitesAn Azure subscription with an existing Log Analytics workspace (Sentinel-enabled or plain Log Analytics both work). Permission to deploy resources into a resource group, create a Microsoft Entra app registration, and assign Azure roles. Azure CLI. Azure Cloud Shell works well; all commands below are single-line and run in PowerShell or bash. A Netskope AI SecOps tenant with the Outbound Webhooks feature.Values you will collect along the way  Value Where y

If you have spent any time online recently, you have likely encountered a CAPTCHA verification or an unexpected browser error message. Cybercriminals are banking on that exact muscle memory. Today, they are leveraging our habit of clicking through technical glitches to bypass traditional security filters entirely. At Netskope, our Global Information Security team recently launched an internal awareness campaign targeted at a highly sophisticated social engineering tactic known as "ClickFix." Rather than relying on technical exploits, these attacks trick users into manually infecting their own machines. To ensure our team remained vigilant, we deployed a real-time training mechanism using our very own Netskope Client. Here is a behind-the-scenes look at how the campaign worked, what the threat looks like, and the remarkable engagement data we gathered across our departments.What is a "ClickFix" Attack?Unlike traditional phishing where a malicious file is downloaded automatically, ClickF

Less Clicking, More DescribingSpending an entire afternoon navigating the Netskope Tenant to extract a report, conduct an investigation, or trace a misconfiguration is a familiar, time-consuming challenge. However, this entire equation is rewritten by combining the Netskope CLI with Cowork and Claude Code. Work that previously consumed hours collapses into a single conversation as you simply describe your objectives in plain English, allowing AI to convert intent into direct action instead of navigating sections in the Tenant. This post puts that promise to the test across the standard workflows administrators handle each week: examining user activity across diverse tenant sections; extracting months of Skope IT logs to optimize CASB and real-time policies; evaluating actual user experience via Digital Experience Management; and confirming the reachability and connectivity of publishers and private applications. Each of these workflows typically requires hours of data exporting, clicki

This post shares a Custom Field / widget I built in Advanced Analytics that groups devices by location based on a hostname naming convention, then maps YouTube Bytes Uploaded and Bytes Downloaded per location. It's a simple pattern that can be reused for any environment where hostnames follow a structured naming standard. The use caseIn our environment, device hostnames follow a consistent pattern:[AZ|AG] + [Location Code] + [NB|DS] + [Number]AZ / AG — identifies the business unit / region the device belongs to Location code (e.g. POA, PB, PJ, PG, PT) — identifies the site/location of the device NB / DS — indicates whether the device is a notebook or a desktop Number — a sequential device identifierSince the location code is embedded in every hostname, I wanted a way to aggregate traffic by location without having to build a filter or dimension for every single site individually. The goal was to answer a simple question: "Which locations are generating the most YouTube upload/download

Hi folks, we observed these issues with Advanced Analytics recently:Error message: <Tenant URL> didn’t send any data: This is an intermittent error caused by Netskope Client not sending data properly  PDF export goes into an infinite loop: This issue is caused by malfunction of the “Google Maps” visualization type Error message: cURL error 28: This is an intermittent error likely caused by a timeout issue in our platform Error message: The Trino database encountered an error: This is an intermittent error caused by corrupted queries in our database Our teams are aware of these issues and are working actively to troubleshoot and develop solutions. If you observe the same issues in your environment, please report this to Netskope Support or your Netskope account representatives.  

Hello,we currently have 2 publishers at our site. They frequently connect to different NetSkope datacenters (A and B) with similar RTT, which is working as designed. However, the majority of our users are routed to datacenter C, and here we are noticing a discrepancy. Around 80% of the traffic is being routed through only one publisher because it is the only one falling within the (Latency range: 0-31 ms). It seems that even a minimal difference in latency - if it unluckily falls near the threshold of this range - causes the traffic to skew heavily toward a single publisher. Do you have any recommended solutions or workarounds for this behavior?

The Netskope Cloud R140.0.0 documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Version 140.0.0.The key new or updated feature is: Netskope Private Access (NPA)NPA AI Agent for Generating App Segments & PoliciesSubmit your feedback via docs.netskope.com,

Hi Team,I do not believe "Fallback Action" is available as a standalone filter in Netskope reporting/search. Based on Netskope documentation, a fallback action is triggered when the content inspection engine cannot complete analysis (for example, file size limit exceeded, scan timeout, or internal scanning error), and the system applies the configured fallback action (Allow/Alert/Block). If the goal is to determine how many fallback actions occurred historically, we may need to look for the resulting events/actions rather than filter directly on "Fallback Action." I have not found evidence that Netskope provides a dedicated Fallback Action filter in the UI. As an alternative, it may be possible to identify these events through SkopeIT/Event exports or log analysis by looking for scan failures, timeout conditions, file size limit exceedances, or other fallback-related indicators if those fields are logged in our environment.Has anyone identified a field in SkopeIT, Reporting, or exporte

Kong AI Gateway with Netskope AI GuardrailsIntegration Guide: AI Guardrails on DemandKong AI Gateway routes and manages traffic to large language models, but provides limited native content security. This guide shows how to add Netskope AI Guardrails on Demand as a real-time inspection layer, so that every prompt flowing through Kong is checked for policy violations — prompt injection, jailbreaks, unsafe content, and more — and blocked before it reaches the model.A reference implementation of the plugin described here is published and ready to use: github.com/sandiegojenkins/kong-plugin-netskope-ai-guardrail (Apache-2.0). It has been verified end-to-end, including with a real LLM provider behind the gateway — see Step 6.Why add Netskope to KongInspect prompts in real time. Each request is evaluated against your Netskope AI Guardrail profiles before it reaches the LLM. Block policy violations at the gateway. Unsafe prompts are stopped centrally — no application code changes required. Re

    Building a CrowdStrike Falcon Dashboard on Netskope Data: a Step-by-step Guide How my team streamed Netskope web, DLP, and alert telemetry into CrowdStrike Falcon Next-Gen SIEM, wired up automated indicator sharing, and built a cross-source security dashboard that correlates Netskope, Falcon, and Okta signals in one place. Everything below is enough to build the same thing in your own tenant.   Why we built this My security operations team lives in CrowdStrike Falcon. That is where analysts triage, hunt, and respond. But a lot of the signal they need sits in Netskope: web transaction logs, DLP violations, anomaly alerts, and policy actions from the Netskope One Security Service Edge (SSE) platform. Every time an analyst had to pivot out of Falcon to check the Netskope Admin Console, we lost time and context. Our solution had two parts. First, stream Netskope logs into Falcon LogScale so analysts get a native Netskope dashboard inside Next-Gen SIEM, sitting next to t

There's a question every security vendor eventually has to answer: do you actually use your own product to protect your business? At Netskope, the answer isn't just yes — it's the foundation of how we operate. As the Customer Zero team, our job is to deploy our Netskope products before they reach customers. That includes our full portfolio of AI-powered security capabilities, which today sit at the center of how we detect threats, govern data, control access, and keep our workforce productive without sacrificing visibility. This isn't a case study from a customer. It's what we do every day. And the products we've deployed across our own environment paint a clear picture of where enterprise AI security is headed — and what it actually takes to get there.Our internal security strategy is structured around four primary pillars, which collectively ensure that our AI-driven capabilities provide comprehensive protection across every layer of the organization.  Capability Problem So