Skip to main content
  • EN

Solved

222 Topics
U
ullasNew Member
asked in DLP
Integration of Netskope with SentinelOne XDR

Hello Team, Good Day.I'm curious to know the setps or methods for integrating Sentinelone EDR and Netskope DLP solution for the Data analysis part.As a part of my study on Endpoint Security, I feel DLP also play a major role in protection of Data at Endpoints as same as EDR. Seeking guidance here for the integration.Thank you for the help. Regards & Thanks,

5412
Gary-Jenkins
Netskope Employee
9 months ago
M
munster
asked in Next Gen SWG
Block Zip File Contains Executable

HiHow to block download/upload binary files in zip?How many layer of zip the engine will unzip for scanning?thank

4635
ejang
Netskope Employee
9 months ago
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Next Gen SWG
agent installation

agent installationI want to install the agent on several machines that I cannot reach either by invitation or through GPO.Is there a way to give an installer to the support staff and they go machine by machine to install the netskope agent and then the end users enter and authenticate with their user? If, for example, I download from this route https://download-<;your-tenant-name>.goskope.com/dlr/win/get and the support staff installs it correctly?

9172
msouza
Netskope Employee
9 months ago
M
munster
asked in Next Gen SWG
Does Windows Steer Traffic after fresh bootup

HiFor a just booted up laptop and yet to login, can the agent steer web traffic to Netskope?   Or it has to login to steer web traffic?  Thank 

1374
Rohit_Bhaskar
Netskope Employee
10 months ago
D
DanielVdNew Member
asked in Next Gen SWG
Can netskope work without the cloud part?

Good morning,in order to understand how to administratively place the purchase of Netskope I am being asked to understand if Netskope can in any way function if the Netskope Client is unable to contact the gateway in the cloud or if, as I imagine it is, all traffic goes through the firewall.

831
zthompsoncr
Netskope Partner
10 months ago
W
WWWNew Member
asked in Private Access for ZTNA
best practice for the publisher implementation behind the FW

Where is the recommanded location (DMZ or Server zone) to implement the publisher in the firewall protected environment? All the port need to be opened to the back-end servers on the firewall?is the traffice flow is correct?End-users → tunnel  →  publisher -->(open all required ports on the FW ) → App servers

2382
W
10 months ago
T
TwoodsNew Member III
asked in CASB
SNI Checking at the Client Configuration level

I am looking for thoughts on if people have enabled the setting in the Client Configuration for Perform SNI (Server Name Indication) check ?    We are migrating VPN technologies and have noticed some traffic occurring outside of the Netskope tunnel when we do not expect it.  We believe this setting to be the reason as it indicates that the initial three-way handshake for traffic occurs outside the tunnel to retrieve the hostname.   Additionally we have several third-party applications that we use Source IP allowlisting with and believe that this may be causing issues with some of those as well.   This was enabled (I believe) during our initial configuration and now want to gather pros and cons of having it enabled/disabled?

7552
jforrest
Netskope Employee
10 months ago
M
munster
asked in Additional Discussions
Steering Configuration and Client Configuration

HiIn the Steering Configuration and Client Configuration, I can only select OU or AD User Group.Using OU or AD User Group are inflexibleExample for testing purpose, unable to select AD users from different AD user group for testing since there was no AD user group for these selective users. can’t just test for 1 user.  WIll have to create AD user group for for 1 user Select by device.  I may have multiple devices login using the same account.  I will want the test steering and client configuration for test devices.  My corp device will not take effect.Is it possible to select by individual AD user or by device?  thank

1132
M
10 months ago
R
Rakoon007New Member
asked in Next Gen SWG
Administration - Audit Logs: Not able to view comments/notes in the Audit log module

Hi,Not sure if there's already a similar question posted somewhere, In the Administration > Audit Log section:When clicking on the gear, the options to select are "User, Severity, Activity" .  There is no option to show comments/notes entered for a specific activity logged. Is there a way to add another column in the Audit Log that can show the comments that were entered when adding/modifying a policy/persona/rule?  It seems odd that while add/changing/modify/removing a rule/policy, you're prompted to add (which is optional) a comment/note before saving/applying a change to an activity performed but never can locate or view the comments in the Audit log.Are the comments details located in another section of Netskope? Are they retrievable?  if yes, will the notes/comments still be linked to the very activity event that was performed at the time when the comments were entered? orIf not, could this be a consideration as an additional enhancement in the next release/upgrade/patch to the

1336
R
10 months ago
M
munster
asked in Next Gen SWG
Uncategory Domains

Hi There are predefined list such as abortion, etc.  How can I block domain that has NOT been category yet? thankMunster

4384
N
10 months ago
M
mbradfordNew Member
asked in Next Gen SWG
All microsoft delivery optimization - regex....

We block the download of certain files, such as msi, and exe.  Microsoft delivery optimization uses random IPs within the URL to download these updates, and some IPs might not even be owned by Microsoft.  Below is an example of a download: 151.139.71.28/filestreamingservice/files/814b848b-a4e4-48f7-9dc0-b18b57f6c9f3?P1=1707275479&P2=404&P3=2&P4=XS3dTPEuizRfF1O1rjyxG4xt4%2f7vGGgU0h4OKnajgEDC0tollwGtN5fmEf1kuPFohFTDKuVPTCg9zrAoEck6sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.comWe would like to include a regex or some sort of wild card to allow these.  The URL always seems to include: delivery.mp.microsoft.com When we allow URLs, we add the URLs to a URL list, which is tied to category.  I see we can use regex, but I am not certain if the URL needs the hostname???  I am also not sure how the regex would look.  I opened a case with support, but they referenced me to regex101 website, but that was really it, so hoping the Netskope community might be able t

9262
N
10 months ago
B
bhennrelNew Member III
asked in Next Gen SWG
Why are we blocking DNS over HTTPS again?

I understand the underlying premise for Netskope's recommendation for blocking DNS over HTTPS, to mitigate exfiltration risk, etc. However, with the industry push to move to DOH, won't we need to allow DOH traffic at some point? Most of our users browsers are configured to try DOH first, and some of them seem to be running into issues if DOH is not available and falling back to traditional udp 53 fails. I also don't understand why Netskope says they don't support DOH traffic steering. (See https://docs.netskope.com/en/netskope-help/data-security/real-time-protection/best-practices-for-real-time-protection-policies/best-practices-for-utility-policies/#recommended-utility-policy-2-1) It would seem Netskope DOES support it since we ARE steering DOH traffic to Netskope, Netskope identifies the DOH traffic, and then blocks it with the Block DOH real time protection policy. So what does Netskope mean when they say "DNS over HTTPS is not a supported protocol for Netskope steering (C

24304
jforrest
Netskope Employee
11 months ago
A
Anonymous
asked in Next Gen SWG
Netskope DLP user coaching for sensitive data move to Whatsapp, Telegram Desktop Apps

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You

3692
Y
11 months ago
Indu
Netskope Partner
InduNetskope Partner
asked in DLP
DLP: PCI & PII tests failed on netskopesecuritycheck.com

Hi Team,We configured DLP for all categories with PCI and PII DLP. However, on netskopesecuritycheck.com, DLP PCI and PII block tests are failed. Has anyone had success with these tests? Can you please share the DLP policy configuration that has passed?  Thanks & Regards,Indu

1253
Indu
Netskope Partner
11 months ago
R
ruttrowgNew Member
asked in CASB
CASB 0365 policies needed

Hello group, I am new here, I did a search but did not find what I was looking for. Question: Any documentation on how to properly implement in the CASB section for Office 365? We want to eliminate or reduce the number of blocks we are seeing from attempts to update Office. It hits different sites out of the United States. (Policies, Real-time protection, CASB section) Thanks,

1072
R
11 months ago
H
hobyNew Member
asked in Next Gen SWG
Netskope SWG and Onenote

While we have the normal exceptions in place for MS 365 and the likes, we seem to have users including myself that can't get Microsoft Onenote to sync unless we disable the endpoint client. Has anyone seen this or have an idea on how to solve? Thanks! 

2215
qyost
11 months ago
S
Netskope Partner
Shraddha_TupeNetskope Partner
asked in Additional Discussions
Wrong gateway--bom1.goskope.com

Dear Team, For the Mac user's Netskope client installation, we are getting the wrong gateway on the user's client configuration as the "gateway-bom1.goskope.com". The traffic is not tunneling through the Netskope tenant but the client configuration is showing as an enable. We also have not received the logs in Skope-IT alerts for all Mac users. In nsdebuglog.log, found the error as "failed to open file for reading: /Library/Application Support/Netskope/STAgent/l4config.json, err:2" Kindly help us on this issues. 

2662
S
Netskope Partner
1 year ago
cameronstephens
cameronstephensNew Member
asked in Security Posture Management
Can an Azure AD App Assign Specific Console Admin Roles?

Hi, I have the customer's Azure AD configured to allow admin access to the Netskope console via group membership, but all users who login have the tenant admin role by default. I know I can go in and change their individual roles manually but is there a way to create a new enterprise application that assigns the Security Admin role (or any other) by default instead? If so, can you please advise on the required config? Thanks.

983
qyost
1 year ago
kamranba
Netskope Partner
kamranbaNetskope Partner
asked in Additional Discussions
Cloud Firewall - Creating rules with Source TCP/UDP Ports?

Has anyone come across the need to specify source ports for firewall rules in Netskope Cloud Firewall?Just wondering as MS Teams has a bunch of source ports required for real-time media traffic i.e. 50000-50059 (destinations being dynamic in-nature as well as destination ports being in the dynamic range too) Doesn't seem like you can specify source ports in Netskope Cloud firewall (as yet)? I wonder if there's an enhancement request for this 

691
S
Netskope Employee
1 year ago
J
jschueleNew Member III
asked in CASB
Github API Data Protection Whitelist

I have a DLP policy looking for specific data objects in Github using a regex, but it is triggering on known test data. Any ideas on how I can configure the DLP policy to ignore my spreadsheet of known test objects? For instance create an incident for ABC123, but ignore ABC111. Thx

1264
S
Netskope Employee
1 year ago
M
mdmeow12123New Member III
asked in Next Gen SWG
Offline Agent Reporting

Is there a way to setup a report or alert to capture devices that have not reported traffic in x number of days?It turns out that after an audit, we have quite a few agents where Netskope is installed but not steering any data to the our tenant.  We believe that in these cases the agents subsystems are not fully functioning. The users are not allowed to disable the agents. Thank you. 

1234
M
1 year ago
M
MichaelKoherNew Member III
asked in Discussions
API OneDrive Reports

I am attempting to build an AA report from my OneDrive API connector, but I am finding it is working off alerts vs the API data. What I am trying to build is a report showing employees have used their OneDrive to share with external users the name of the file/folder, type, and size. I can get that data if it falls in the 90-day data window we have with AA, but I can't pull from the raw API over the life of the file/folder. I would just use the API Export, but it leaves off the shared with many times, so I was hoping AA would solve that.  Is that because AA is limited to only alerts within the subscription of data like 30/90 days?  Thank you  

591
jforrest
Netskope Employee
1 year ago
Natedog0024
Natedog0024New Member
asked in CASB
HTTP Header Profiles and comma separation

Hello, Has anyone had issues using comma separation in the referrer field of an HTTP request header? I attempted to use more than one URL comma separating them in the same field per NetSkope documentation, but it broke the URL that was already there and didn't work for the new one. I tried different variations with no luck. I had to create a new header profile for one url..  Any one else?

2189
M
1 year ago
S
steff94New Member III
asked in Next Gen SWG
DNS Policy - Only whitelisted FQDNs or Domain-Wildcards

Hello all,I wanted to ask if there is any way to configure Netskope to block all DNS revolving of public DNS namens by default?We want to manually specify a list of FQDNs or Domain-Wildcards to be allowed to resolve (ie. *.teams.microsoft.com or dns.msftncsi.com). We saw the option to Blackliste a FQDN or Domain-Wildcard in the DNS profile but there seems no option to block ALL except of ... Best regardsStefan

2091
S
Netskope Employee
1 year ago
qyost
qyostExplorer III
asked in Dashboard Gallery
Advanced Analytics - Persistent Customization

I hope I'm overlooking something basic again, but...I would really love to see a way that some properties could be defined once and reused across multiple reports.   Not just at the widget level.   I'm thinking more granular.   I would love to just define a custom extraction once and have it available in the Custom section for every future explore of the same logtype.    Similarly, I would love to define "my domains" (or any other relatively static value) as a variable and have it available for every future report. This would be especially useful for the Netskope Library.   Many of the default reports all have the same "copy this report, edit that, and save a new version" guidance; but often what is being edited is the same 2 -3 sets of data.   If these were able to reference a common variable, there would be no need to reverse engineer the reports every time a new version is released.  

622
qyost
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings