Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 185 Topics
  • 456 Replies
185 Topics
S
scoleman
posted in Next Gen SWG
Determine communication between domains and application without decrypting the traffic

If you find yourself in a situation where you are not using the client and need to know exactly what to bypass in SSL Decryption policy or Steering Exceptions, you can use the following to quickly determine what domains you need to focus on.   Netskope relies on private keys in order to determiner the URLs for any HTTP traffic that has been encrypted using TLS.  If you don't have the private keys, you can query the SNI from the certificate exchange for the domains being called.   To do this, simply capture a successful application session using Wireshark then run the following command against the PCAP to pull the domains from the SNI in the certificate exchanges.   tshark -r ~/file.pcapng -T fields -e tls.handshake.extensions_server_name | sed ‘/^$/d’   This will produce a list separate from the below example: a88.oms.opinsights.azure.com dc.services.visualstudio.com management.azure.com login.microsoftonline.com batchexplorer.azuree

00
R
kvarshney
Netskope Employee
kvarshneyNetskope Employee
posted in Next Gen SWG
New to Netskope and wondering what SASE is?

SASE means Secure Access Service Edge, a term crafted by Gartner. SASE architecture delivers both “WAN capabilities” and “security” as a “cloud service” directly to the source (users, devices, IoT, etc.) without backhauling to enterprise data centers.   It is a fact that the Internet was not designed by keeping security in mind, as in the beginning it was not meant for business. Later, Internet security started with the Firewall when businesses started connecting to the internet. Firewall blocks outsider access to the business network while allowing returning traffic when employees access public services (websites). As the internet grew, firewalls were enhanced with URL-filtering based on URL-categorization to block website access based on content categories such as business, gambling, education, and violence. Firewalls were further enhanced with App-Control and Data-Loss-Prevention (DLP) capabilities as employees, as well as businesses, started using cloud apps from the enterpris

00
mferguson
R
rfletcher
asked in Next Gen SWG
SWG Login - How to Log In to the Powershell Interactive login's

Has anyone had any issues with interactive login's executed via powershell when behind the Netskope SWG?For example: when connecting to exchange online or any kind of Microsoft service via powershell you are typically prompted with a O365 login prompt but when behind SWG we get "New-ExoPSSession : An error occurred while sending the request.." I found 2 work arounds 1) disabling the Netskope client and 2) custom app in the steering configuration to bypass login.microsoft.com when connecting via powershell.exe. I'm wondering if anyone else had experienced this or could think of another work around.

00
R
juergen
juergen
posted in Next Gen SWG
SkopeIT query bar: How find a query field name

The SkopeIT query bar is powerful tool to show filtered data. Sometimes it is a bit challenging to find the name of a field to be used in a query. E.g. we recently introduced a new SkopeIT field called "Netskope Pop". This field tells you, where the traffic was enforced. The get field name for a query just mouse over the field in the detailed event view (see screenshot). Then you can use it in a query like this: "netskope_pop like FRA1".

00
R
M
mbrockney
posted in Next Gen SWG
Use Cases For Remote Browser Isolation (RBI)

In case you weren't aware, Netskope has been supporting RBI for several months now.  With RBI, risky web pages are rendered in a remote browser and only the pixels (not the potentially malicious code) are sent down to the user's browser.  I've deployed this recently with a few of my customers and great use cases have surfaced.  RBI automatically prevents downloads/uploads from risky sites.  This allows users to browse sites but prevents potentially malicious downloads.  The second use case comes into play when Uncategorized websites are sent to RBI.  You may have a newly registered domain for an app like yourcompany.altlassian.com.  If you are blocking the Uncategorized category, users will most likely open up support tickets and the site will need to be whitelisted.  With RBI, users will still be able to see those sites as they will be safely rendered in the remote browser session.  One customer mentioned that this will greatly reduce their

00
M
S
scoleman
asked in Next Gen SWG
Is Netskope intercepting my browser traffic?

Question: How can I tell if my traffic is being intercepted by Netskope from a browser?

00
R
rcanzanese
rcanzanese
posted in Next Gen SWG
Netskope Cloud and Threat Report Infographic - February 2021

The February 2021 Cloud And Threat Report highlights 5 themes we saw in 2021 for our NG-SWG customers:   The majority of malware is delivered via cloud apps Malicious Office documents continue to be used to deliver malware Nearly half of all cloud apps in use in the enterprise have a poor CCI rating 83% of users upload data to personal apps on managed devices Cloud phishing continues to increase, using cloud-hosted baits and targeting cloud credentials Along with the report, we have published a series of blog posts that contain additional details from the report.    If you want to find out more about what is happening in your environment, you can use Advanced Analytics.  The following screenshot shows the malware, phishing, and CCI breakdown for apps within a specific enterprise environment.  This particular environment sees more cloud malware and less cloud phishing than the report shows.  How do you stack up?     https://resources.netskope.c

00
rcanzanese
S
scoleman
asked in Next Gen SWG
Size of SWG incremental updates

What is the file size (appx) of the incremental SWG domain category updates?

00
T
S
scoleman
asked in Next Gen SWG
Adding and Removing Domains from Categories

Question: How often does Netskope add or remove domains from their categories?

00
B
S
scoleman
asked in Next Gen SWG
Clarification of "Native" tag in SkopeIT

Question: What does "Native" indicate in the "Browser" field in Skope IT?

00
D

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
View All

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings