Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 333 Topics
  • 788 Replies
333 Topics
W
wilsonExplorer III
asked in Next Gen SWG
Help.salesforce.com AI bot

Yes, I am  going to create a case, but on the chance I can shortcut the process I thought I would ask here. Has anyone developed a solution for the AI chatbot at help.salesforce.com?We know we are going to have to SSL bypass, we just having figured out what URLs yet.  

51
V
Netskope Employee
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Mastering Zero Trust & SASE: Key Insights from Our 5-Part Series

Hello Community!We're thrilled to announce the completion of our comprehensive 5-part series designed to guide you through the intricate world of Zero Trust and maximizing your Netskope Security Service Edge (SSE) investment. This series has been crafted to provide you with actionable insights, strategic context, and a clear understanding of how Netskope empowers your security journey.In a landscape where "never trust, always verify" is paramount, understanding your traffic, applications, users, and data is critical. This series breaks down complex concepts into digestible, interlinked posts, offering value for new adopters and seasoned professionals alike. Why Read the Full Series? By exploring all five posts, you'll gain a holistic perspective on: Foundational Concepts: How Netskope steers traffic and the core role of its client. Deep Visibility: Unlocking granular context for informed security decisions. Strategic Adoption: A phased approach to implementing Zero Trust, consideri

240
jforrest
Netskope Employee
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Categorizing Applications: Risk Management through Trust Zones

Executive Summary: Trust Zones – Your Key to Zero Trust, Visibility, and GRC In today's dynamic threat landscape, securing your enterprise goes beyond simple "allow" or "block" decisions for applications. It demands nuanced, risk-adaptive controls. Trust Zones provide a structured framework to categorize applications based on their inherent risk, management oversight, and data criticality. This approach is fundamental to a mature Zero Trust strategy and critical for robust Governance, Risk, and Compliance (GRC).Netskope dramatically simplifies and empowers this process: Centralized Risk Intelligence: Our App Catalog (over 84,000 cloud apps!) provides deep risk insights and enables custom tagging, allowing you to align apps with your organizational Trust Zones. Dynamic Policy Enforcement: These App Tags feed directly into real-time policies, enabling dynamic, granular controls that adapt without constant policy change control. Unified Risk Orchestration: Risk Exchange integrates App

210
jforrest
Netskope Employee
M
Netskope Employee
mkoyfmanNetskope Employee
published in Next Gen SWG
Configuring CLI-based Tools and Development Frameworks to work with Netskope SSL Interception

If Netskope is deployed inline (for CASB or Web), some CLI tools will not work because they use certificate bundles distributed with those tools (i.e. Python distribution, for example), and they do not access system certificate store where Netskope client installs Netskope root CA. The guidance below will allow you to enable those tools to seamlessly work with Netskope SSL interception.In order for these tools to trust Netskope-signed certificates, they need to be configured to trust Netskope Certificate Authority (CA). This is typically accomplished by setting certain environment variables to point to Netskope CA to allow for smooth SSL operation.The variables need to be set to point to the following files that contain Netskope CA:On a Mac: /Library/Application Support/Netskope/STAgent/data/nscacert.pemOn Windows: %ProgramData%\Netskope\STAgent\data\nscacert.pemFor example to set REQUESTS_CA_BUNDLE variable on a Mac to point to the Netskope root CA, you can run this command:export REQ

1403911
M
J
jamesbanNew Member III
asked in Next Gen SWG
socks5 proxy support

Want to migrate from onprem proxy to NS proxy for SOCKS proxy use case. Can someone help with the key consideration before migration plan? 

122
J
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Implementing Zero Trust: The Inline Adoption Funnel

Implementing Zero Trust is a journey, not a single destination. The Netskope Zero Trust Inline Adoption Funnel provides a structured, progressive approach to gradually implementing Netskope's powerful security capabilities. This strategy is typically broken into the following key pillars or stages, building complexity and control as you gain confidence and visibility, while clearly defining roles and supporting compliance:Successful security programs, and the adoption of advanced models like Zero Trust, fundamentally rely on the harmonious interplay of people, process, and tooling. When one or more of these critical components is missing or misaligned – whether it's a lack of skilled personnel, undefined workflows, or unoptimized technology – the efficacy of your security initiatives, and thus the successful adoption of this vital Zero Trust model, will be severely hampered. This funnel, therefore, emphasizes the comprehensive engagement required across your organization.1. Threat Pill

340
jforrest
Netskope Employee
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
How-to: Block Facebook Videos While Allowing General Browsing

 Issue Description: A customer needs to selectively block videos from playing on Facebook while still allowing users to browse the Facebook platform. This requires a targeted approach to block specific Facebook video-related URLs and domains without completely blocking access to the entire Facebook platform. Environment: Netskope tenant with web filtering capabilities Resolution: 1. Create a URL list with the following entries:video.*\.fbcdn\.netwww.facebook.com/watchwww.facebook.com/videofb.watch 2. Create a custom category in Netskope to encapsulate the URL list:  - Navigate to the custom categories section in your Netskope tenant  - Create a new custom category  - Add the URL list created in step 1 to this category 3. Create a block policy or add to an existing AUP Custom Category:  - Navigate to the policies section in your Netskope tenant  - Create a new policy or edit an existing one  - Set the action to "Block"  - Apply the custom category created in step 2 as the target 4. Save

120
jforrest
Netskope Employee
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Achieving Granular Visibility with Netskope SASE - Building Context

Building on our discussions about traffic steering and the powerful Netskope Client, let's explore how to unlock the true potential of your Netskope SASE platform: achieving granular visibility.Deep visibility is built upon several layers of context, each with critical dependencies. Understanding these layers is key to extracting maximum value, enabling precise policy enforcement, and contributing directly to your organization's robust security and compliance posture. User, Group, and Organizational Unit (OU) Information: Value: This foundational context is paramount for establishing Identity-Centric Zero Trust. By knowing who is accessing resources, it enables explicit trust decisions, precise role-based access controls (RBAC), and granular auditing, aligning with the "never trust, always verify" principle. Compliance Reference: Essential for meeting NIST Cybersecurity Framework (CSF) Identify Function (ID.AM) - Access Management and ISO 27001 Annex A Control A.9 (Access Contro

330
jforrest
Netskope Employee
A
AlanNew Member
asked in Next Gen SWG
Compressed file inspection

Good morning!Can Netskope identify executable files or even other types within compressed files (zip), for example?

132
A
W
wilsonExplorer III
posted in Next Gen SWG
IDS examples?

Does anyone have a benign, false positive site that can be used for testing of the  IDS of Netskope?Failing that, a true positive that I can turned the IDS on for in the Dev tenant?I primarily want to see what it looks like in the logs so when I put it in monitor mode in production I know what I am looking for.

274
W
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
In-Depth: The Netskope Client - Your Primary Steering Mechanism

Building on our last post about Netskope's traffic steering, let's take a closer look at the Netskope Client. This is the most widely deployed mechanism for steering inline traffic, accounting for approximately 90% of such traffic from our customers. It's designed to overcome historic secure web gateway (SWG) pain points, especially the friction often experienced with traditional appliance-based proxies.The Netskope Client, as a cornerstone of our SASE platform, offers several key advantages for modern security and user experience: Zero Trust at the Endpoint: Implements a Zero Trust approach directly on the user's device. This eliminates the need for "hair-pinning" traffic when users are roaming outside the corporate network, ensuring consistent security. Simplified Certificate Management: Provides native certificate management capabilities, removing the operational challenges of maintaining in-house Public Key Infrastructure (PKI) when leveraging the Netskope certificate. Flexible

1110
jforrest
Netskope Employee
S
Netskope Employee
schongdarNetskope Employee
asked in Next Gen SWG
Facebook blocked but particular one facebook page should open

Dear Team,How I configure Facebook is completely blocked, but a particular Facebook page should open.I have already configured a custom URL, but it's not working

110
S
Netskope Employee
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
posted in Next Gen SWG
CDR Integration for Web File Downloads via Netskope – Anyone Implemented?

Hi everyone, I'm looking to consult with others who may have experience integrating CDR (Content Disarm and Reconstruction) solutions with Netskope, specifically for securing web file downloads. The goal is: When a user attempts to download a file from the internet through Netskope, The file is either blocked or redirected, Then automatically sent to a CDR engine (e.g., OPSWAT MetaDefender) for sanitization, And only afterward made available to the user in a safe version.  Has anyone implemented this kind of workflow?Any insights, architecture suggestions, or practical challenges would be greatly appreciated. Thanks in advance!

100
dinbarzily
Netskope Partner
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
SWG Fundamentals - Netskope Context & Where Do We Start?

Hello Community!Understanding Secure Web Gateway (SWG) fundamentals is key to leveraging Netskope effectively. We're kicking off a series to help you navigate Netskope's capabilities, starting with how traffic gets directed to the Netskope cloud.Netskope Traffic Steering MechanismsNetskope offers a comprehensive suite of methods to direct your network traffic into its cloud, ensuring robust security and visibility across your environment: Netskope Client: This is our primary and most widely used mechanism for steering traffic from endpoints, whether users are on-premises or roaming. It provides comprehensive control and visibility for both web and non-web traffic from managed devices, including Windows, macOS, iOS, Android, and Chromebooks. Enterprise Browser: A newer method specifically designed to steer traffic from unmanaged devices, primarily for HTTPS traffic. It extends Netskope's security controls, including DLP, to personal or non-corporate devices, enhancing visibility and d

900
jforrest
Netskope Employee
K
kpattersonAONew Member
asked in Next Gen SWG
How to Block Google AI Mode?

Hello Netskope Community, With the recent launch of Google’s AI mode in Google searches, I am looking for a way to block it using Netskope. I noticed that the URL pattern is different between the AI mode and the regular search results, however the wildcard matching cannot be used because of the way Netskope handles wildcards. I am not seeing an obvious way to use regex to match it, however if someone else does please let me know. I also explored matching the activity based on HTTP header and was unable to find a unique header field that I could match on (again if anyone knows different please let me know). My next plan of attack is to try making a custom CCI application using the Netskope App Activity recorder browser extension and block access to it, but I haven’t tried that yet. Does anyone have any other ideas?Thank you in advance. 

1193
K
C
ccreedNew Member
asked in Next Gen SWG
Netskope on Shared Systems Windows AVD

Hi all: has anyone gotten Netskope to work on an Azure Multisession Host machine with the following configurations. I ask because only documentation I see around this is for Citrix which is not my use case. also, in the Citrix documentation seems like it might be for their NPA only and not their inline SWG policies. Roaming Profiles fs logic bypassing steps are in place peruser configmode was used we use a Global Steering configuration for our org as we know from experience multiple steering configurations don’t work, and this was a vendor recommendationProblem we are seeing is these users are not pulling individual Client Configurations see to pull the client configuration of the last user that logged on. instead of the correct client configuration which we do not have many of but we do have use cases for this. reading peruser config mode statements it sounds like they should be able to pull different Client configurations anyone know if we maybe need to redirect the configuration fi

180
C
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Next Gen SWG
How-to Retrieve Group Membership from SAML Assertion?

Wonder if anyone enabled this feature and know how to configure.Description on docs.netskope.com is limited.https://docs.netskope.com/en/known-issues-in-release-123-0-0#retrieve-group-membership-from-saml-assertionRetrieve Group Membership from SAML AssertionNetskope has introduced the ability to leverage group information from SAML assertion responses to streamline policy enforcement and group management. Here are the key responsibilities: Auto populating SAML groups: Automatically populate group memberships based on “memberof” values in the SAML assertion response for group-based policy creation . Pre-defined SAML groups: Netskope Administrators can create SAML groups using “memberof” values from the SAML assertion response and configure policies in advance even before intercepting user traffic Friendly group name mapping: Netskope administrators can manually map SAML attribute values to user-friendly group names for simplified management and improved clarity in policy configurat

712
AllenWu
Netskope Partner
cubiaz55
cubiaz55New Member III
asked in Next Gen SWG
Netskope ASN For Okta Whitelisting

Looking to create an allow list for access to Okta when egressing from one of Netskope’s PoP’s and I came across ASN 55256, Netskope’s ASN. Okta allows you to use an ASN for allow listing purposes, however I am looking for some community feedback if others have used this ASN for this. Is it a good solution? things to be mindful of? etc.  Thanks! 

90
cubiaz55
M
mdecampsNew Member
asked in Next Gen SWG
How to disable Netskope Agent remotely ?

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

2166
A
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Mastering RBAC V3: Secure API Access with Service Accounts and IP Allowlisting

Introduction to RBAC V3 and Service Account allowlistingWith release 125, General Availability (GA) was announced for two key features: Endpoint-specific allowlisting: This feature enhances security by allowing IP allowlists to be configured at a more granular, endpoint-specific level. Enhanced RBAC V3 authorization service: A new version of the Role-Based Access Control service.https://docs.netskope.com/en/netskope-release-note-version-125-0-0#general-availability-of-endpoints-specific-allowlisting The RBAC V3 service is not enabled by default in tenants upon release. It is being rolled out progressively.A significant change accompanying the introduction of RBAC V3 is the deprecation of the previous Rest API V2 token provisioning workflow. Previous Method: Historically, API tokens were provisioned through the user interface by navigating to Tools -> Rest API V2. Impact of RBAC V3 Enablement: Once RBAC V3 functionality is activated on a tenant, the aforementioned Rest API V2 tok

1810
jforrest
Netskope Employee
K
KrugerNew Member III
asked in Next Gen SWG
All allowed web traffic

Hello, I am trying to figure out the best way to query/view all allowed web traffic for a user or users.  I found this posted:--By default, we do not log allowed traffic. If traffic is blocked, it is logged, and you can view that traffic under Skope-IT  alerts. If you wish to log allowed web traffic, you do not need to create a new policy; simply change the action of the existing policy to 'alert' to log all traffic matching that specific policy-- But when we enabled alerting it shows a lot of activities for the allowed traffic but not all of the typical browsing traffic. Is this viewable in the Tennant? ie: if someone just goes to a typical website and clicks around.. It does not seem to just log that browse action.  Thanks

483
K
C
chrisjohnsonfroneriNew Member
posted in Next Gen SWG
All microsoft delivery optimization - regex.... - Update

This is just in reference to this thread that I found very helpful but am unable to add a comment.All microsoft delivery optimization - regex.... | CommunityJust in case people find it helpful, I found that the regex wasn’t capturing everything and had to add a few of my own.\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/filestreamingservice\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/filestreamingservice\/\/files\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*.intunewin.bin\b(?:\d{1,3}\.){3}\d{1,3}\b\/.*\/ctldl.windowsupdate.com\/msdownload\/update\/v3\/static\/trustedr\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/pr\/.*\/Office\/Data\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b\/d\/msdownload\/.*\b(?:\d{1,3}\.){3}\d{1,3}\b.*\/msdownload\/.* I found that the following examples were being blocked:70.156.87.153/c/msdownload/update/software/updt/2025/03/windows11.0-kb5054980-x64-ndp481_d8ca7b3b24823cc8480dbe3cf3355ae0ca0c311e.cab?cacheHostOrigin=2.au.download.windowsupdate.com177.128.21

350
C
D
DarrylHNew Member
asked in Next Gen SWG
SWG & Microsoft Safelinks causing SSL_Mismatch

Hi all,Has anyone had any issues with using the Netskope proxy and Microsoft Safelinks?We currently use Microsoft safelinks to protect clicks within the Microsoft suite.It is sporadic, but if a user clicks a link within an email, (typically marketing emails) Netskope correctly blocks access due to a SSL mismatch.if we use the safelink decoder to get the actual URL,  we can get to the website without any issues.its two popular products, so i’m assuming others have this same issue, any ideas? We don’t want to bypass the SSL Host Mismatch error. thanks  

981
N
H
Netskope Partner
hshimizuNetskope Partner
asked in Next Gen SWG
The function of setting specific condiftion onto SAML authentication bypass

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in

582
H
Netskope Partner
W
wilsonExplorer III
asked in Next Gen SWG
Looking for the documentation regarding servers/client

Verbally, Netskope indicates that installation of client on servers because the client is dependent on login for policy. I am looking for that documented.   Has anyone seen that?  

582
V
Netskope Employee

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings