Skip to main content
  • EN

Recently active topics

68 Topics
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in Private Access for ZTNA
Dynamic Steering

I have configured Dynamic Steering.Here are the steps I took: In the Client Config, I specified the internal web server (192.168.10.156). In Traffic Steering, I enabled the Dynamic Steering option. However, after completing the above configurations, when I check the configuration of a server located in the same network as the web server set in step 1, it shows On-premises check: Remote.Could you please advise on how to resolve this issue? Step1  Step2  It shows On-premises check: Remote 

10
Maho Fujino
Netskope Partner
M
maxkorNew Member III
asked in Discussions
Error – "Failed to save enrollment tokens"

Hi all,While attempting to install the Netskope agent using the provided BAT file, I encountered the following error:"Failed to save enrollment tokens"In addition, when retrying the process, I also receive the following error in the enrollment window:"Configuration download failed. Please authenticate again."Steps I have already taken: Ran the BAT file as Administrator Verified proper network connectivity Attempted the installation on a different machine  note:install mode IDP thanks

60
M
W
Netskope Employee
Wilfredo Marchena LuzonNetskope Employee
published in Secure Enrollment
Case Insights - Secure Enrollment

Netskope Global Technical Success (GTS)Case Insights - Secure Enrollment  Netskope Cloud Version - 126 What is this article about?As a new initiative, this report examines the most recurrent “How-to” questions raised by customers which are handled by Netskope Global Technical Success (GTS) Team. Secure EnrollmentQuestions and issues related to Secure Enrollment, including its impact on existing devices, troubleshooting expired tokens, and understanding the enrollment process. The most important part about secure enrollment is understanding its purpose, which essentially is adding an extra layer of security when accessing our provisioner service in cloud that is located behind each tenant under: addon-<tenant name>.<region>.goskope.com Addon comes into the picture when Netskope Client is installed for first time on a device, which it will query addon service to fetch and download configuration files from users, meaning that if the user is found, then provisioner provides the

150
W
Netskope Employee
M
Netskope Employee
mkoyfmanNetskope Employee
published in Next Gen SWG
Configuring CLI-based Tools and Development Frameworks to work with Netskope SSL Interception

If Netskope is deployed inline (for CASB or Web), some CLI tools will not work because they use certificate bundles distributed with those tools (i.e. Python distribution, for example), and they do not access system certificate store where Netskope client installs Netskope root CA. The guidance below will allow you to enable those tools to seamlessly work with Netskope SSL interception.In order for these tools to trust Netskope-signed certificates, they need to be configured to trust Netskope Certificate Authority (CA). This is typically accomplished by setting certain environment variables to point to Netskope CA to allow for smooth SSL operation.The variables need to be set to point to the following files that contain Netskope CA:On a Mac: /Library/Application Support/Netskope/STAgent/data/nscacert.pemOn Windows: %ProgramData%\Netskope\STAgent\data\nscacert.pemFor example to set REQUESTS_CA_BUNDLE variable on a Mac to point to the Netskope root CA, you can run this command:export REQ

112666
S
D
Netskope Employee
Davide MolinoNetskope Employee
published in ChatGPT
ChatGPT - Block Phone login

Netskope Global Technical Success (GTS)Use Case - ChatGPT - Block Phone login Netskope Cloud Version - 126ObjectiveChatGPT - Block login via phone PrerequisiteNetskope CASB Inline & SWG license is required ContextChatGPT provides a phone login option in addition to Single Sign-On (SSO). This document explains how to block users from accessing ChatGPT via phone login.Before we beingTo block ChatGPT logins via phone number, we can target the network call initiated after a user enters their country and phone number and clicks "Continue". Analysis shows the website makes a specific call at this point, which will be the focus of our blocking mechanism.  ConfigurationStep #1 - Create an URL ListPath: Netskope Tenant UI >>> Policies >>> URL ListsClick on “New URL LIsts”, add a name and the below URL as exact match, save and apply changes ℹ️ URL: auth.openai.com/api/accounts/authorize/continue  Step #2 - Create a Custom CategoryPath: Netskope Tenant UI >>>

70
D
Netskope Employee
aplaza
Netskope Employee
aplazaNetskope Employee
published in Video Library
Inside Netskope 12: Tracking Client Bypasses with Netskope Endpoint SD-WANInside Netskope

Hear from our security engineers as they discuss how we use Netskope Endpoint SD-WAN for gaining real-time visibility into bypassed traffic, tracking SSL certificate-pinned applications, and uncovering the roots of "shadow IT" behavior. Learn how to: Use the SD-WAN console to capture and analyze bypass flows Configure AppX policies to flag "interesting" traffic Monitor and investigate SSL-pinned app behavior (including custom and pre-defined apps) Strengthen security posture with intelligent exception handling Leverage this capability for troubleshooting, resource tuning, and forensics For more information, check out our blog post.  View past events in this series!

120
aplaza
Netskope Employee
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Malware Protection
Why Netskope Does Not Support File Hash - SHA1

Netskope Global Technical Success (GTS)Why Netskope Does Not Support File Hash - SHA-1 Netskope Cloud Version - 126 ObjectiveHighlight the technical reasons why Netskope does not support File hash - SHA-1 PrerequisiteSWG or Next-Gen SWG license ContextCustomers can use Netskope’s File Profile configuration to allow or block files based on their hash values. Currently, the product supports MD5 and SHA-256 hashes. This document aims to explain why SHA-1 hash is not supported. Do You Know?With the current Netskope product design only MD5 and SHA-256 hashes are supported Path: Netskope Tenant UI >>> Policies >>> Profile - - - File Profile >>> Add File ProfileDetailsSHA-1?SHA-1 (Secure Hash Algorithm 1) is a hash function which takes an input and produces a 160-bit (20-byte) hash value known as a message digest – typically rendered as 40 hexadecimal digits. SHA-1 is Cryptographically Brokena. SHA-1 is no longer secure.b. Since 2005, researchers have shown that SHA

260
Mandeep Singh
Netskope Employee
D
Netskope Employee
Davide MolinoNetskope Employee
published in Tenant Administration
Replacing Expiring Entra ID SAML Certificates for Netskope Services

Netskope Global Technical Success (GTS)Replacing Expiring Entra ID SAML Certificates for Netskope Services Netskope Cloud Version - 126 ObjectiveThe purpose of this article is to explain how to replace the SAML Entra ID certificate used for Netskope SSO Tenant Access, Forward Proxy, or Reverse Proxy. This article explains the procedure for replacing the Entra ID certificate used for SAML authentication with Netskope for Tenant Access, Forward Proxy, or Reverse Proxy. PrerequisiteNetskope tenant access and Entra ID access are required. ContextWhen creating an enterprise application in Entra ID for Netskope Administration Console (SSO Tenant Access), or Netskope User Authentication (Forward Proxy or Reverse Proxy), Entra ID generates a SAML Certificate with an expiration date. When the expiration date is reached, you must renew the Entra ID SAML certificate, activate, and re-submit the certificate onto Netskope.  ℹ️ Expired certificates will trigger a warning similar to the one below i

120
D
Netskope Employee
S
Netskope Employee
Saniya MurtuzaNetskope Employee
published in Real-Time Protection: Key Policies
Best Practices - Guide to Maintaining Steering Configuration

Netskope Global Technical Success (GTS)Best Practices - Guide to Maintaining Steering Configuration Netskope Cloud Version - 126 ObjectiveEstablishing best practices to effectively maintain steering configurations via the Netskope Web UI. ContextThis document outlines the set of best practices to ensure that your Steering configuration is aligned as per Netskope’s best practices. Basic DefinitionsWhat is a Steering configuration?A steering configuration defines what type of traffic will be steered towards Netskope platform for Analysis. Netskope can only inspect and take action on the traffic that has been steered using a Steering configuration located.A Steering configuration can be found under Settings - Security Cloud platform - Steering configuration. Depending on your entitlement with Netskope, you can steer the below type of Traffic using a Steering configuration -Cloud Apps Web Traffic All Traffic (HTTP, HTTPs + Non Web Traffic) DNS trafficIt is essential to ensure that appropri

110
S
Netskope Employee
S
Netskope Employee
Saniya MurtuzaNetskope Employee
published in Browser Control - Brave Browser
Brave Browser - Block Native Client on Windows OS

Netskope Global Technical Success (GTS)Brave Browser - Block Native Client on Windows OS Netskope Cloud Version - 126ObjectiveRestricting web traffic originating from Brave Browser on Windows OS PrerequisiteSWG or Next-Gen SWG license ContextThis article outlines the process to block Brave Browser traffic at the Netskope Client level on Windows OS. Do You Know?Netskope acknowledges Brave as a Cloud Application and provides a pre-defined cloud app connector. As of May 22, 2025 with Netskope’s Brave predefined connector, customers can exercise control over the following activities:Netskope categorizes Brave under the 'Security' web category. DetailsBrave Browser Processes on Windows OS ConfigurationCreate Certificate Pinned Application for Windows OS Platform with the definitionPath: Netskope Tenant UI >>> Settings >>> Security Cloud Platform >>> App Definition >>> New Certificate Pinned AppNote: Here you need to define the Platform where the applicati

70
S
Netskope Employee
S
Netskope Employee
Saniya MurtuzaNetskope Employee
published in Real-Time Protection: Key Policies
Best Practices - Admin’s Guide to Securing Web UI

Netskope Global Technical Success (GTS)Best Practices - Admin’s Guide to Securing Web UI Netskope Cloud Version - 126 ObjectiveEstablishing best practices to effectively secure access to Netskope’s Web UI ContextTo provide administrators with a comprehensive set of best practices for securely configuring and managing the web user interface (Web UI), with a focus on implementing Single Sign-On (SSO), enabling Multi-Factor Authentication (MFA), and enforcing secure access controls to protect user identities and system integrity. Significance of following best practicesThe Netskope Web UI serves as a critical interface, providing comprehensive visibility into an organization's security posture and data protection policies. It displays highly sensitive information, including:Details of applied security policies governing organizational access and usage. Identification of sensitive data categories covered under Data Loss Prevention (DLP) policies. Forensic data, including information on use

180
S
Netskope Employee
D
Netskope Employee
Davide MolinoNetskope Employee
published in Netskope Client
Netskope Client - Installation on Ubuntu Linux

Netskope Global Technical Success (GTS)Netskope Client - Installation on Ubuntu Linux Netskope Cloud Version - 126 ObjectiveThe purpose of this document is to explain how to install the Netskope Client on Linux Ubuntu hosts. PrerequisiteNetskope SWG or Next-gen SWG license Ubuntu 20.04, 22.04 LTS, 24.04 LTS desktop versions Linux Mint Desktop Versions 19, 20, 21 (Cinnamon Edition) Red Hat Enterprise Linux version 9.4 (Plow)Reference: Netskope Client Supported OS and Platform ContextNetskope Client can be installed on Linux Ubuntu devices from CLI, or using email invite.To protect against the vulnerability found upon Netskope Client enrollment, customers are required to introduce authentication (mandatory) and encryption (option) tokens. ℹ️ Secure Enrolment is not needed when deploying via email invite  Netskope Client InstallationStep #1 - Download Netskope Client for LinuxInstall package can be found in the below repository:https://download-<tenantname>[.region].goskope.co

550
D
Netskope Employee
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Browser Control - Brave Browser
Brave Browser - Block All Traffic via HTTP Header

Netskope Global Technical Success (GTS)Brave Browser - Block All Traffic via HTTP Header Netskope Cloud Version - 126 ObjectiveRestricting web traffic originating from Brave Browser via HTTP Header PrerequisiteSWG or Next-Gen SWG license ContextThis article outlines the process to block Brave Browser traffic via HTTP Header via Netskope HTTP Header feature. Do You Know?What is Netskope HTTP Header Profile?A Netskope HTTP Header Profile is used to define how HTTP headers should be handled for traffic inspection and policy enforcement.Netskope Official Article on HTTP Header Profile What is User-Agent?The User-Agent in an HTTP header is a string sent by a web browser or application to identify itself to the server when making a web request. It helps the server understand what kind of client is making the request - From Browser - Google Chrome   Component Meaning Mozilla/5.0 A legacy identifier for compatibility. All modern browsers use this for historical reasons

1530
Mandeep Singh
Netskope Employee
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Browser Control - Brave Browser
Brave Browser - Block Native Client on macOS

Netskope Global Technical Success (GTS)Brave Browser - Block Native Client on macOS Netskope Cloud Version - 126 ObjectiveRestricting web traffic originating from Brave Browser on macOS PrerequisiteSWG or Next-Gen SWG license ContextThis article outlines the process to block Brave Browser traffic at the Netskope Client level on macOS. Do You Know?Netskope acknowledges Brave as a Cloud Application and provides a pre-defined cloud app connector. As of May 22, 2025 with Netskope’s Brave predefined connector, customers can exercise control over the following activities:Netskope categorizes Brave under the 'Security' web category. DetailsBrave Browser Processes on macOS ConfigurationCreate Certificate Pinned Application for macOS Platform with the definitionPath: Netskope Tenant UI >>> Settings >>> Security Cloud Platform >>> App Definition >>> New Certificate Pinned AppNote: Here you need to define the Platform where the application will be used, if need

80
Mandeep Singh
Netskope Employee
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Browser Control - Brave Browser
Brave Browser - Restrict Installations from the Web

Netskope Global Technical Success (GTS)Brave Browser - Restrict Installations from the Web Netskope Cloud Version - 126 ObjectiveRestrict End-Users from Downloading Brave Browser from the Web PrerequisiteNext-Gen SWG License ContextEnd users can download the Brave Browser through both official and unofficial channels. The native Brave Browser application is available for download from the official website, as well as from various third-party sources. Official Channel Third-party Sources Do You Know?Netskope acknowledges Brave as a Cloud Application and provides a pre-defined cloud app connector. As of May 22, 2025 with Netskope’s Brave predefined connector, customers can exercise control over the following activities:Netskope categorizes Brave under the 'Security' web category. ConfigurationOfficial Channel                                                                                                                                                Create a Realtime protection policyPat

130
Mandeep Singh
Netskope Employee
Mandeep Singh
Netskope Employee
Mandeep SinghNetskope Employee
published in Browser Control - Brave Browser
Brave Browser - Block Web Access

Netskope Global Technical Success (GTS)Brave Browser - Block Web Access Netskope Cloud Version - 126 ObjectiveBlock Brave web access PrerequisiteNext-Gen SWG ContextHow to block Brave web access via Realtime Protection Policy Do You Know?Netskope acknowledges Brave as a Cloud Application and provides a pre-defined cloud app connector. As of May 22, 2025 with Netskope’s Brave predefined connector, customers can exercise control over the following activities: Netskope categorizes Brave under the 'Security' web category. ConfigurationCreate a Realtime protection policyPath: Netskope Tenant UI >>> Policies >>> Real-time Protection >>> New Policy VerificationAccess Brave - https://brave.comNote - User Notification format used above Link Terms and ConditionsAll documented information undergoes testing and verification to ensure accuracy. In the future, it is possible that the application's functionality may be altered by the vendor. If any such changes are brought

130
Mandeep Singh
Netskope Employee
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in DLP
Unexpected Match in Email Address Detection Policy Using Regular Expression

When creating a policy to detect email addresses, I used the following regular expression:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}However, the string "csv test" triggered a detection, even though it does not contain an "@" symbol and therefore should not match the expression above.Is there any limitation or specific behavior in how regular expressions are interpreted on the Netskope side that might explain this?

161
G
D
Netskope Employee
Davide MolinoNetskope Employee
published in Tenant Administration
Role Based Access Control V3 (RBAC V3)

Netskope Global Technical Success (GTS)Role Based Access Control v3 (RBAC v3) Netskope Cloud Version - 125 ObjectiveThis article explains the new capabilities introduced with RBAC V3, available starting from Netskope release R125 - Link RequirementTo enable RBAC V3, a backend flag needs to be enabled. Customers are requested to raise a support case ‘Case Type: How-To Question’ Author NotesIn the near future, this RBAC V3 will be rolled out to all tenants. DetailsNew features introduced with RBACv3(A). Roles for Rest API endpointsThe role definition remained unchanged in comparison to RBAC V2, however, each function has now a set of associated REST API endpoints, which are granted when selecting the functions, for example:  ℹ️ For Users and Groups provisioning through SCIM, the below function will be needed:   More info can be found in the following article: SCIM Allowlist and RBAC v3 enabling - Customer Instructions   (B.) Roles for IP Allowlist Within the role, it is now

430
D
Netskope Employee
D
Netskope Employee
Davide MolinoNetskope Employee
published in CASB/SWG Inline
DLP - Scan documents for a particular keyword

 Netskope Global Technical Success (GTS)DLP - Scan documents for a particular keyword Netskope Cloud Version - 125 ObjectiveThis article aims to detect all the downloaded/uploaded documents which contains a specific keyword PrerequisiteSWG or Next-Gen SWG with Standard DLP ContextA company would like to block all the upload activities related to files which contains the “confidential” keyword ConfigurationStep #1 - Define the DLP EntityPath: Netskope Tenant UI Policies >>> Profiles >>> DLP >>> DLP Rules >>>  EntitiesDefine a new entity to identify the “confidential” work like below: ℹ️ With the confidential regex we’re matching all the files containing the “confidential” string   Step #2 - Define the DLP RulePath: Netskope Tenant UI Policies >>> Profiles >>> DLP >>> DLP Rules >>>  RulesEntity: Select the entity created at the Step #1 as shown above Exact match: No changes Advanced options: No changes Content:

290
D
Netskope Employee
H
Netskope Partner
hshimizuNetskope Partner
asked in Next Gen SWG
The function of setting specific condiftion onto SAML authentication bypass

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in

312
H
Netskope Partner
Aaron_Zhang
Netskope Employee
Aaron_ZhangNetskope Employee
published in Discussions
May 2025 Office Hours Recap

Hello Folks, Below you can find a recap of the topics discussed during the September Advanced Analytics office hours and those sent in that we were not able to cover in the session. Feel free to comment and continue the discussion, as well as attend our future sessions that can be found from the Community Events Calendar! Q: We recently onboarded Netskope in our organization and need to understand the recommended best practice on analytics, especially how to improve our security posture using Advanced Analytics.A: There are 3 different “health check” dashboards in our community. All of them are great starting points for you to explore your environment, identify security gaps, and enhance your security posture. CASB Health Check DashboardThe purpose of this dashboard is to help you maximize the ROI of your Netskope investment and to ensure you are using Netskope products to their full potential. With a focus on CASB, the dashboard covers multiple topics such as NewEdge Network, Traffic

200
Aaron_Zhang
Netskope Employee
Z
zmcinroy
asked in Private Access for ZTNA
How do I configure NPA to work with On-Premise DNSSEC

Looking for any information about how to best configure steering for private app access when DNSSEC is enabled on the on prem DNS servers, or if this is even possible.  I have verified my NPA publisher is able to query DNS and get proper RSIG response. However remote clients do not get a valid response from the domain even with the Netskope suggested Active Directory configuration from: Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge PortalAll nslookups come back as unsecured and Non-authoritative

574
J
Netskope Employee
Lionel
Netskope Partner
LionelNetskope Partner
asked in Additional Discussions
Single Sign-On BWAN / ZTNA

Hello,In the context of a project involving the Netskope agent (ZTNA) and BWAN, we use the SAML Forward proxy component to authenticate users on first login (and periodically).Today, users are subject to two authentication procedures. As a result, the user experience is degraded.Is it possible to have a single sign-on between the two Netskope / BWAN agents?

1104
J
rodborges
Netskope Partner
rodborgesNetskope Partner
asked in DLP
DLP Support for Claude.AI and Perplexity.AI

Hi, Some customers asked about DLP support for Claude.AI and Perplexity.AI.They are on the roadmap? If so, there’s any estimate on when will it be available? Regards,Rodrigo Borges

436
Rohit_Bhaskar
Netskope Employee
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in DLP
Regarding the definition of "activity"

What is the definition of "Formpost," which is one of the activity types?

282
V
Netskope Employee

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings