Recently active topics

 If you monitor your Netskope proxy logs or Real-Time Protection events, you have likely come across traffic destined for raw public IP addresses where the Host FQDN looks something like this: http://77.111.102.203/filestreamingservice/files/ff268a10-8dd6-4190-8bc1-d1db06722d0c?P1=...&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.comhttps://194.36.32.209/92f3b6cc-ee7d-4056-af0d-6026e0d4e2f2/.../86ec8c94.intunewin.bin?cacheHostOrigin=swdb02-mscdn.manage.microsoft.comSeeing raw IP addresses in HTTP GET requests can immediately raise red flags for SOC and network teams. However, this pattern is completely normal behavior for Microsoft Delivery Optimization (DO).In this post, we’ll explain why this happens and show you how to build a hyper-efficient, lightweight regex URL profile to accurately match and bypass/steer this traffic in Netskope.Understanding the Behavior: Why Raw IPs?When Windows endpoints fetch OS patches, Defender updates, or Intune app packages (.intunewin), Microsoft

INTEGRATION GUIDEAutomating Noncompliant Device Enforcement with Netskope Cloud Exchange and Microsoft IntuneCloud Exchange × Microsoft IntuneThis guide shows how the Netskope Cloud Exchange Risk Exchange (CRE) module reads device compliance from Microsoft Intune, tags noncompliant devices in the Netskope tenant, and drives real-time enforcement. The result is a closed loop between your Mobile Device Management (MDM) system and Netskope, with no manual handoff between consoles.How the integration worksMicrosoft Intune continuously evaluates enrolled devices against its compliance policies. Cloud Exchange pulls that device data through the Microsoft Intune plugin, merges it with the matching Netskope device record, and, when a business rule matches, pushes a device tag back to the Netskope tenant. A Device Classification rule reads that tag, and a Real-time Protection policy acts on the classification.The stages below trace a single noncompliant Windows device end to end. 1 2

Here I would like to give a suggestion Single-word keyword matching on AI responses produces a high rate of false positives for educational cybersecurity content. A response that merely defines "phishing" or "botnet" is treated the same as one that provides malicious guidance. Support for multi-word expressions, intent-based matching, or response-aware context would significantly improve precision while preserving legitimate educational use. If anybody can help me with the same , please !! 

Under what categories should a Custom Cloud App fall under ? Does the categorization rely on the domains that we provide when defining the application?

Hi Team, Can you please help to allow login to Codex Enterprise application only and block rest? I tried using the Header insertion but it's not working.

Thoughts on FWaaS Policy  This article assesses some key considerations when constructing a policy for Netskope One Firewall-as-a-Service (FWaaS/Cloud Firewall). FWaaS secures traffic destined for public IP addresses on non-web ports. It should be assumed that the real-time policy table is split into policy groups to aid administrators with the correct placement of their policies. The focus here is the implications of positional placement of policies for Layer 3/4, and Layer 7. This article assumes that the tenant has been enabled for Service and Destination profiles (the equivalent on a legacy tenant would be Custom Firewall Apps). It also assumes that non-web application firewall is enabled for app detection at L7. Netskope evaluates policies using a top-down approach, hence the first policy that matches the traffic flow criteria will apply. Key Points The following are some of the policy objects that can act on traffic processed by firewall and therefore potentially change behaviour

Hello all!Customer’s internal domain ends is customer.net. We know that’s a public domain (.net), but it predates us, and we don’t think that migrating to customer.local or something like that is viable in the given time.We are deploying NPA and, so far so good. The issue is that their domain exists on the internet, and is not owned by the customer themselves. So, if a client resides outside of the premises, they can resolve internal names to a public IP address. And since that domain seems to have some sort of catch-all resolution, everything gets resolved.The security concerns are obvious: the owner of the public domain can learn all of their internal services hostnames and then deploy phishing sites, etc.We already have blocked that IP address, but we are trying to block DNS resolution all together. Although blocking other domains works, this one doesn’t, because it is defined in many private apps.What can we do to sucessfully block these requests?Thanks.

 1. Overview This article documents the procedure to resolve Docker Engine and Docker Compose version prerequisite failures encountered during Netskope Cloud Exchange (CE) setup or upgrade on Ubuntu 22.04.5 LTS. The root causes identified are:Docker Engine: Package pinned at an older version; the official Docker apt repository not yet configured or cache outdated. Docker Compose: A manually installed standalone binary at ~/.docker/cli-plugins/docker-compose (installed July 2025) was taking priority over the updated apt plugin, causing the CE setup script to read the wrong version.!!! Important Note: Make sure you have a backup of your Cloud Exchange instance or take a snapshot before starting the upgrade process.  2. Symptoms When running the CE setup script (sudo python3 ./setup), the prerequisite check outputs one or both of the following failures:  3. Environment OS: Ubuntu 22.04 Hypervisor: VMware4. Root Cause Analysis 4.1  Docker Engine — Outdated PackageDocker Engine was install

Hello the community.I need your help.I’ve opened a high-priority support ticket separately, but I’m looking for information on how DNS works (ping / nslookup).We’re having an issue with our business applications.I have an internal application published on our DNS. I don’t have any issues at work.But outside of work, when I ping it, I get the following response:C:\Users\THOMAJULIE>ping wug.XXX.frSending a ‘ping’ request to wug.XXX.fr [100.64.0.1]  > Normal comportmentC:\Users\THOMAJULIE>nslookup wug.XXX.frServer:  UnKnownAddress:  192.168.1.254Non-authoritative answer:Name:    wug.XXX.fr.transports.comAddresses:  2a01:7e01::f03c:95ff:feeb:9d4b          2a01:7e01::f03c:95ff:fe00:2692          2a01:7e01::2000:dff:fec1:5cdb          2a01:7e01::f03c:95ff:feed:783e          2a01:7e01::f03c:95ff:fe91:5d91          139.162.181.76          172.104.149.86          172.104.251.198          139.162.174.209          172.104.203.186Is this normal behavior?Can you tell me how ping/nslookup r

Background :We have Netskope SMTP DLP, Endpoint DLP, and Microsoft Exchange integrated with Netskope. Users are currently imported via Directory Importer (LDAP/AD) with a synchronization interval of 180 minutes.Use CaseWe are implementing a Leavers Email and Endpoint Monitoring Policy (Monitor/Allow mode only). When HR raises a MyAccess request, the user is automatically added to a dedicated LDAP group. The Netskope policy is configured against this group.The challenge is that policy enforcement is delayed until the next Directory Import sync, which can take up to 60 minutes. Our requirement is for the policy to become effective immediately after the user is added to the LDAP group.  Options ConsideredSCIM Provisioning: We considered using SCIM to provision the specific leavers group and apply policies based on SCIM group membership. However, our understanding is that users already imported through Directory Importer should not also be provisioned through SCIM, as this could create ide

The Netskope Cloud R139.0.0 documentation is here! New & updated articles are live on docs.netskope.com. The release notes are here: Netskope Release Notes Version 139.0.0.The key new or updated features are:Netskope Client Steering Support for FIPS-140-3 compliance requirements Ability to Delete Devices AI Command Center (AICC) AI Command Center - General Availability (GA) Submit your feedback via docs.netskope.com.

🔍 Summary:Thank you to everyone who attended our  webinar, “Unlocking value from recent Netskope releases”, held on 25th June 2026.The webinar covered a recap of key technical features from recent releases that you might have missed. We hope you found it insightful and valuable. During this session, we covered the below topics :  Anthropic Claude Controls: Granular visibility and delete remediation policies for enterprise AI usage. Analytics Upgrades: A tour of the redesigned Analytics and Reports Overview dashboard layout. ZTNA Enhancements: Context-driven private access using time-of-day schedules. Threat Prevention: Blocking zero-day payloads with new HTML Smuggling detection modules. 🎥 Webinar Recording:If you missed the session or would like to revisit the content, you can watch the recording below:Customer/Partner Recording 📝 Share Your Feedback:We’d love to hear your thoughts! Please take a minute to fill out our short survey:👉 Event Short Survey LinkYour feedback help

The latest updates, resources, and events – all in one place.Hi there,As part of our ongoing commitment to helping you get the most value out of your Netskope investment, we’re excited to bring you this month’s Netskope Highlights—your one-stop roundup of the latest product updates, expert content, and upcoming learning opportunities.🚀 Product Release UpdatesRelease 139 is here!Explore this month’s key features and enhancements to ensure you’re getting maximum value from your setup.📄 Release Notes - July 2026 ✅ Pro Tip: Check for features relevant to your current configurations.✅ Features not to miss out!This section highlights key innovations from the recent Netskope release that can significantly enhance your Adoption and Value Realization journey. Top Highlights:Enhanced Third-Party App Permission Visibility (SSPM)Keeping tabs on the third-party apps plugged into your SaaS environment just got easier: SSPM now shows when each app was discovered and verified, and gives you a clear

I have Slack configured via Next Gen API connector. I have DLP policies to identify specific data types being shared externally. After opening an incident I can clearly see the channel name identified. However, I have no way of whitelisting or filtering on them. We have a channel naming convention to identify false positives, but no way to filter them out besides manual review. What can be done? 

Dear Netskope Community Members, Thank you for joining our recent webinar on “Netskope One Product Updates - Reviewing the Last 3 Months of Releases” June 2026.Missed our recent deep dive? No worries! The recording for our three-month platform recap session is officially live.Catch up on the latest administrative tools designed to protect enterprise data, streamline reporting, and level up your zero-trust access strategy.🔗 Access the Recording: Click Here Highlights include: Anthropic Claude Controls: Granular visibility and delete remediation policies for enterprise AI usage. Analytics Upgrades: A tour of the redesigned Analytics and Reports Overview dashboard layout. ZTNA Enhancements: Context-driven private access using time-of-day schedules. Threat Prevention: Blocking zero-day payloads with new HTML Smuggling detection modules. Grab a coffee, watch the replay, and let us know what you think! 

Netskope Global Technical Success (GTS)Understanding “Patient Zero” Logging Behaviour and Policy MatchingObjective If you've already configured a Patient Zero Protection policy, you may have noticed something confusing in SkopeIT: the alert doesn't always say "Patient Zero," the Policy Name doesn't always match the policy you expect, and "Block" actions for held-but-benign files can seem to disappear from your filters. This article picks up where our existing Patient Zero articles leave off. Instead of covering policy setup again, it focuses on how to read and correlate Patient Zero logs, so you can confidently confirm whether your policy is doing its job during an investigation.If you haven't yet configured a Patient Zero Protection policy, start with Netskope Cloud Sandboxing – 'Patient Zero' Real-time Protection Policy and the Netskope Knowledge Portal guide for step-by-step configuration. This article assumes that groundwork is already in place. Prerequisite Netskope Advanced Threa