Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

556 Topics

A
AlfaBaneExplorer III
asked in Private Access for ZTNA

NPA: managing Periodic Reauthentication on mobile (iOS & Android) devices

For Private Access environments in which users also have mobile (iOS & Android) access to certain Private Apps, what’s the best way to avoid flooding users with daily Periodic Reauthentication on their computers as well as their phones? Maybe a better question would be “what is the expected user experience in terms of Periodic Reauthentication” for users leveraging Private Access on both their work computers and their phones?should users be prompted to reauth on both devices?  is it just whichever device prompts first?  is the expected behavior different for iOS & Andriod? Also, if the reauth period lapses or the prompt is missed or accidentally closed on the phone and private access disables, what is the best way to instruct end-users on restoring Private Access on their phones ? On computers, reauthentication is easily done via the client menu, but I’ve been unable to find any such option on the Netskope client/app on iOS   @sshiflett 

0
A
14 hours ago
G
Netskope Employee
gcut
published in Security Posture Management

SSPM (SaaS Security Posture Management) template based rulesNews

In the 114 release, we are excited to introduce a new type of content for Netskope SSPM: template-based rules. These rule templates are designed to assist deploying environment-specific detections for known threats, noteworthy anomalies and address misconfigurations. Using templates makes it easier to establish a more expedient and proactive defense strategy for your SaaS ecosystem.Each template is composed  with the same Netskope Governance Language (NGL) rule logic which is also used in the hundreds of built-in detections bundled within Netskope SSPM.  Kindly refer below steps Template based rules are predefined detection rules, which contain placeholders intended to be filled by the user. By simply populating the placeholders within the rule, users can effortlessly generate rules tailored to their specific business requirements and constraints. For example, you might want to ensure every user account in a SaaS application is registered with a company provided email-address? Or creat

240
G
Netskope Employee
1 day ago
ssumner
Netskope Employee
ssumnerNetskope Employee
asked in Private Access for ZTNA

VPN elimination and cost to operate [community survey]

Despite the shift to Zero Trust, VPNs are still essential… but at the same time work from home resulted in a permanent jump in VPN user experience issues: help desk tickets increased 4.9x since 2019. To learn more about the “why”, we’re taking a deep dive into the impact of VPNs to bring these insights to our community members.We’re running a global survey to quantify VPN usage, cost, and user impact, where participants will receive complete results within two weeks:No personal information is required to participate It takes less than three minutes to complete the surveyA global peer benchmarkParticipating will let you understand where your company stands vs. your peers re.:VPN use, performance and cost analysis Top apps consuming VPN bandwidth VoIP and remote assistance VPN dependencies VPN’s direct & indirect impact on the help desk Take the Survey  and help us illuminate this subject together. Thanks for your help! If you have any questions, please let me know.Scott

0
ssumner
Netskope Employee
2 days ago
W
wilsonExplorer III
asked in CASB

Error using ServiceNow Reporting with Netskope

When using Netskope on a Macintosh, an error occurs saving reports with the “Classic UI” that does not occur when using the most recent UI (Screenshot attached).  Disabling Netskope gets rid of the problem. There is anecdotal reports of someone having this same problem on a Windows/Edge combination. I haven’t gathered enough data to create a Case with Netksope, so I wanted to see if anyone else has seen this phenomena. A Google search reveals two mentions of this error, but both talk about browser security.  Both talk about Cross Site Forgery tokens. Sometimes When Updating Records Browser Shows: Security Warning: Your submission token does not match session token - Support and Troubleshooting (servicenow.com) "Your submission token does not match your session... - ServiceNow Community  

0
W
3 days ago
B
bntrotterNew Member
asked in DLP

Best Practices for using Netskope DLP for Generative AI Posts/Upload Activity

Are there any Best Practices for using Netskope DLP: to gain visibility into Generative AI site Posts  & Upload activity?

0
B
3 days ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA

NPA Periodic Re-authenication: pop-behind causing problems with the user experience

We are reevaluating the NPA Periodic Re-authentication. Previous user experiences were lacking. However, now that we have had support enable the “reauth at log-in/reboot”, things have improved dramatically. The primary downside that is keeping us from expanding this for testing is the pop-behind nature of the reauth prompt. Many users think they “are not being prompted” when in fact they are. Is there anything that can be done to force the prompt to either remain at the forefront until addressed or give the prompt a taskbar presence like applications/browsers/alerts do. Users that lock their device at the end of the day (in their given workspace) rather than logging out/shutting down, have no idea the reauth is open behind the of their apps/browsers at the start of the day due to the pop-behind nature of this prompt. If there is no current solution, is this on the roadmap to fix? If so, when?@sshiflett @rsurya 

3
N
3 days ago
J
jasonbeebeNew Member
asked in Private Access for ZTNA

Active Directory and DNS with Multiple Regions

My organization has two main regions (USA and India).  I currently have ADDS/DNS servers in both regions.  I have two private apps configured for ADDS.  One of them is directing traffic to the India ADDS servers using the local NPAs, the other is doing the same for USA.I have a prelogin user that has access to both private apps.I also have a DNS private app defined (*._http.domain.local, *._kkdcp.domain.local, etc) but it only uses the USA publishers.With this configuration, our USA users are working fine with very little lag on computer startup and login.  Our India users, however, are experiencing very long startup and login times.My question is, what is the proper way of configuring AD and DNS access for clients when the organization is multi-regional and you want the client to always access the closest ADDS/DNS servers?Some solutions I am considering are:Divide each region’s users into separate groups and give them only access to their local ADDS server.  This however does not solv

2
J
3 days ago
monika
Netskope Partner
monikaNetskope Partner
asked in DLP

Device classification

When a user tries to download any files from his/her BYOD using organization's email platform, the download should be blocked.?? How can we achieve  this in Netskope please provide me the steps..

1
ejang
Netskope Employee
4 days ago
M
munster
asked in Netskope Cloud Exchange (CE)

CE Admin Privilege

HiI have deployed CE 5.0.1.  When ssh to CE, I can’t seem to “sudo su root”.  Likewise, can’t sudo reboot or shutdown.Anyway to perform reboot or shutdown beside asking esxi team to do it?thank

3
ejang
Netskope Employee
6 days ago
A
Anonymous
asked in DLP

Netskope Email DLP with Mimecast

Dear All   I tried to setup Netskope Email DLP with Mimecast, however it seems like the message has not successfully deliver to mimecast MTA. 1. Configured SMTP settings (Domain, Tenant ID, Next Hop FQDN which is mimecast smart host, port)2. Configured exchange flow connector to route message to Netskope smart host3. Configured real time policy with action add X header: block when sensitive data is detect4. Setup content examination definitions and policy from Mimecast when receive X header: block 5. Test sending outbound email with sensitive info on the content. Tested sending another email without any sensitive info. (Both email had failed to deliver to recipient)6. Checked on SKope IT > Alerts > noticed that Email DLP policy has triggered with email consisted of sensitive info.7. Checked on Mimecast message tracking, however did't receive any message (for both sensitive and without sensitive message) Is there any steps that I miss out? Thank

4
S
Netskope Employee
7 days ago
T
TKO3SonsNew Member III
asked in DLP

DLP documentation out of date for Entities

I need to modify the default DLP profile for profanity as we have a user with a last name that matches the profanity profile. I raised a helpdesk ticket to follow the steps mentioned in https://docs.netskope.com/en/netskope-help/data-security/data-loss-prevention/dlp-entity/ to copy the Entity. However, I noticed that in the later releases of Netskope, the Entity tab was renamed to "Dictionary" and is different from the old Entity. Can anyone guide me on how to copy and modify the default profanity profile?

1
S
Netskope Employee
7 days ago
J
juliocondeNew Member
asked in Private Access for ZTNA

IDE IntelliJ(Java and spring) Error NPA resolve name

Hello Community,My developers use the IntelliJ IDE to develop, as our environment is 100% cloud, we use NPA to access the development environments. We use spring as a framework for our applications.My error is the following for some endpoints I simply cannot connect using IntelliJ and spring. If I do a curl or telnet I can access the endpoint normally, only IntelliJ and spring can't. I have openVPN as redundancy and I don't get this error.Has anyone had a similar problem?Below is a simpler application that I can replicate the errorpackage ConnectivityTest;import org.springframework.http.ResponseEntity;import org.springframework.http.client.reactive.ClientHttpConnector;import org.springframework.http.client.reactive.ReactorClientHttpConnector;import org.springframework.web.reactive.function.client.ExchangeStrategies;import org.springframework.web.reactive.function.client.WebClient;import reactor.netty.http.client.HttpClient;public class ConnectivityTest { public static <Objerespon

1
S
Netskope Employee
7 days ago
M
munster
asked in Next Gen SWG

Captive Notification and Timeout

Hi I have questions about Captive  usageNotification - Can it be customized with our own words?   Timeout 10min -  If failed to pass captive after 10min, the traffic is blocked.   How can I re-enable again captive login?  Do I close and open the browser to have the captive login?  Do I have to reboot?  etc….  Thank

0
M
8 days ago
C
CuriousExplorer II
asked in Private Access for ZTNA

VPN and NPA Not Happy Together

Hi Everyone, Have an issue where remote NS clients have the following environment and in this order:1. IPv4 and IPv6 addresses assigned (eg. from home wifi or mobile hotspot)- The IPv6 address assigned (global internet address starts with 2001:xxx)2. NPA Tunnel is established3. Connect to corporate VPN service4. Clients are then unable to access applications via the VPN NPA applications continue to operate successfully but the NS client service appears to interfere with the VPN tunnel. Stop the NS client service and there is no issue with the VPN. Disable IPv6 and the VPN and NPA work successfully, this is not recommended by Microsoft so not really a desirable option. Have tried to configure clients to 'Prefer IPv4 over IPv6' this was looking promising but not producing reliable results. Issue still appears to randomly occur, still testing this. Anyone else experience this issue?

5
E
9 days ago
I
Netskope Partner
InduNetskope Partner
asked in Next Gen SWG

Netskope client SSL decryption issues

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as we mention in SSL BYPASS. Same sites with SSL bypass- websites (with SSL bypass) are loading every time without intermittent issues- w

5
B
9 days ago
B
BrianNew Member
asked in CASB

create a Policy for non-citrix servers

Hey Community,I need to create a new client configuration for a Netskope client that disable the auto update for the on-prem device and the Netskope client in Citrix environment needs to be on for the same device. How could i do or fix this problem?

0
B
10 days ago
A
ajitNew Member
asked in Private Access for ZTNA

how to enable two-way communication through ztna

how to enable two-way communication through ztna

1
ejang
Netskope Employee
12 days ago
eliot
eliotNew Member III
posted in Security Posture Management

Watch the new SSPM demo video! Featuring new apps, upgraded UI, and 3rd party OAuth app security

Hey everyone!   Check out our new demo video to learn why SaaS Security Posture Management (SSPM) is a key component of CASB that is providing much needed visibility and risk assessment of all the resources hidden in your SaaS environments.     This demo features: New SaaS apps. Microsoft SharePoint, MS Exchange, MS Defender, Azure AD, Google Workspace, Confluence, and Jira. We now support 14 total SaaS apps. Industry-leading security configuration monitoring. 500+ predefined rules and 12 best practice and industry compliance policies. 3rd party OAuth app security. Continuous real-time visibility and dynamic, customer-specific risk assessment of marketplace and custom 3rd party apps.   Please reach out if you have any questions or would like more information about how SSPM + CASB work together to provide you comprehensive data protection for your SaaS apps. Happy to chat anytime!   Thanks! Eliot   -- Sr. Director, Cloud Security Product Manage

2
B
14 days ago
X
xstuartbarrettxNew Member III
asked in Next Gen SWG

Bulk URL Lookups

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

3
X
14 days ago
M
munster
asked in Next Gen SWG

Only can access from local country IP

HiIn some countries, gov website can only access from local country IPs.  Any IP assign outside of the country will deny access.As we are using 163.116.x.x, user resides in that country was unable to access too.  How can we remediate this use case?thank

9
S
Netskope Employee
15 days ago
M
mdantonaExplorer
posted in Private Access for ZTNA

Troubleshooting Chrome on macOS with NPA

hello community!   We are seeing a problem with Google Chrome on macOS where Chrome is not passing traffic to a private app via the Netskope Client. We are able to reach the Private app using other browsers installed on the same system without issue. We can even hit the private app using curl at the terminal and it's working fine with NPA. We have tried clearing browser cache and using incognito on Chrome with no success. Anyone have experience with this issue?

6
J
16 days ago
K
KrugerNew Member
asked in Next Gen SWG

FTP (TCP 21) Controls

with an inline solution that is steering all traffic to the swg. Is there any controls that can be put in place of FTP(TCP 21)traffic? DLP? Malware? etc..

1
ejang
Netskope Employee
16 days ago
V
vedNew Member
asked in DLP

OCR DLP Detection

 Hello everyone! I hope you're all doing well. I'm currently exploring how to set up an OCR DLP detection policy on Netskope for our organization's security needs. Could anyone provide guidance or step-by-step instructions on configuring such a policy? Any insights, tips, or best practices would be greatly appreciated. Thanks in advance for your help!

1
ejang
Netskope Employee
16 days ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA

Delete AD Groups or OU

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

1
ejang
Netskope Employee
16 days ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Private Access for ZTNA

Netskope Private Access: "Life of a Packet"

Introduction Netskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Ne

2
tloeber1
Netskope Partner
17 days ago

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
Show all badges
Terms & ConditionsCookie settings