Product Forums

Netskope Client iOS and Android Apps  Hello community, how is everything going ? As always, thanks for the collaboration and good vibes.I have some issues with a couple of apps. 1.-Whatsapp App:Whatsapp App from IOS and Android, I performed the installation of the client, profile, etc all good all operating correctly for both IOS and Android. By Netskope Whatsapp is not an app qualified as certificate pinning at least not by default or suggested to add.The issue arises in the case of sending images, chats and messages, links all OK in both cases IOS and Android, the problem arises with sending files and images, when you try does not allow it. There is no blocking or impediment at the level of policies, permissive policies are generated to the APP and URLs, but the issue remained the same. Reviewing the domains in the CCI I noticed the domains whatsapp.com and whatsapp.net. When generating an exception at Steering

In order to ensure the correct functioning of the Azure Virtual Desktop or Windows 365 machine when deploying the Netskope Agent on it we have to take care of some Steering Exceptions: MANDATORY: Destination Location Steering Exceptions for Azure Virtual Desktop RDGateways IPs (Remote Desktop Gateways service tags related IPs) OPTIONAL: Destination Location Steering Exceptions for Azure Virtual Desktop Monitoring IPs (Azure Monitor service tags related IPs) OPTIONAL: Application/Process (Certificate Pinned Application) Steering Exceptions for Azure Virtual Desktop agents running on the Virtual Desktop Destination Location Steering Exceptions Microsoft provides a Json fil

Ping Identity’s PingOne platform provides the ability to define a SAML-compatible application that can be used for granting access to the Netskope Admin Console. This guide will walk you through the steps for creating a custom application to meet this use case.   Ping does not provide a pre-built application for SAML SSO - a custom application is required Ping One does not support SCIM for User and Group provisioning - you will need Ping Federate with the SCIM SaaS Provisioner integration.   Instructions Follow the below steps to create the custom SAML int

Hello everyone, My organization currently uses MIP to manually apply labels to Office files. We are looking to start using Netskope API Data Protection to automatically apply labels to files in SharePoint that contain sensitive data but I have a couple challenges I am not sure how to handle.  1. Microsoft Information Protection by default will not override any manual labels applied or override any label with a higher priority. We would like to keep this capability when using Netskope to apply labels but I cannot find any way to accomplish this.  2. We would like to build automated workflows to notify users when a file they own has had it's label upgraded because it contains sensitive data. This works great the first time the label is applied but a DLP alert will occur every single time the file is edited even if the file already has the upgraded label. I think a potential solution to challenge 1 wo

Netskope Next Gen SWG helps organizations take back control over user->cloud activity that firewalls either miss or can't understand.  Cloud Firewall complements Next Gen SWG to address the non-web apps. Check out our new video to explain what a Cloud Firewall does, and let me know if you have any questions   https://community.netskope.com/t5/Video-Library/Introduction-to-Netskope-Cloud-Firewall/ba-p/4829  

Our Real-time protection policies are simple - block high risk websites, allow enterprise websites and alert uploads and downloads of social media. No NPA. We have multiple issues with traffic passing through Netskope SSL decryption. Few issues we noticied so far (be it any browser - firefox, chrome, edge or tor)- websites (with SSL decryption) are intermittently not loaded (one day they work fine, next day they won't and the cycle repeats again)- websites (with SSL decryption) are extremely slow- downloading objects like 200MB files takes high times (minutes to hours)- few websites have their dynamic buttons disabled or not becoming live- there are instances the websites failed won't show in debug logs, application & page events & alerts. Clearly killed by Netskope client, but not logged or sent to cloud. The websites works as soon as

I'm looking for a way to block file uploads using Telegram web. As Netskope is unable to detect "Uploads", it is not able to block uploads.  I tried blocking "Downloads" as this was an activity registered, when I tested, it failed.

netskope 102 is not getting uninstalled from the machine nor with the cleaner.

Just to check how Netskope is categorizing the URL's Malicious? just want to understand backend Technology and the process around it. Are you using any third-party Intelligence  or own AI/ML technologies.

Has anybody else observed latency and loading issues with Google Docs for Mac/Chrome users who are accessing them via the Netskope Client via the SWG? We're seeing sporadic behavior where documents shared with users will take 3-7 minutes to load, comments will fail to post, and sometimes pages just age out. This is not isolated to a specific region or POP, but disabling the Netskope client immediately resolves the issue.  It's become enough of a problem that we are considering putting in an ssl decryption or steering exception for Google Docs. This behavior will manifest for several hours, go away, and then reappear. Just curious if anyone else has seen it and/or has any suggestions on any potential fixes. 

Multi-user in non-AD environments - Users in Google and Okta Hello, good afternoon, I hope all is well. I have the following question. In an environment where you have users with Okta and others from Gmail, for user accounts, how would you do in environments where you do not have Active Directory for multi-user workstations ? I mean example: We have approx 30 workstations shared, by 3 or 4 people, where different people login to that workstation in different work shifts, with different local account on those workstations.So these machines use local accounts but I need to differentiate the access privileges of each of those 4 people/accounts to different access level for Netskope policies. How do I use multi-user or Multi-User Mode in this kind of environment? Is it possible to do it IDP-like with Okta accounts as with Google Workspace accounts ? 

Synchronize users from Google Apps/Workspace and Okta for user/group provisioning and Admin Console SSO Hello good afternoon, thank you for your support, for your collaboration and for your valuable time.Is it possible to synchronize users/groups from Google Apps/Workspace accounts ? in order to provision user/groups for policy management ? Can I synchronize users from Okta and users from Google Apps/Workspace at the same time?Is it possible to use SSO for the use of Google Apps/Workspace user credentials for the Tenant Admin Console? Thanks for your time, good vibes and your collaboration. I remain attentive Best regards

Hi team, I have a doubt whenever i tried to understand i get stucked and got confused in that.Correct me as per my understanding.The sanctioned application are those who only manages by our organization like o365, Gsuite salesforce who having a Admin privileges.Unsanctioned apps are those who not control by our organization like zippyshare anydesk pinterest facebook whatsapp etc.Also i get confused over managed and unmanaged application is that the managed apps are sanctioned apps and unmanaged are unsanctioned apps.For example Sanctioned apps are those who used by dialy bases on organiztion like some org used Gsuite and chatgpt again gsuite i sanctioned and chatgpt is unmanaged apps but the used both one for mailing and other is for info learning. on the second scenerio same org the unsantioned apps are o365 coz they are using gsuite on org. Please help me with this confusion with user example.

Migrated Content

Browsers with Zero-Day Vulnerabilities ? What am I talking about you might think -   Well, it happened with Chrome recently -  for the third time this year - CVE-2023-3079  released earlier this month affects Google Chrome prior to 114.0.5735.110 by allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)    Sounds serious? Oh you bet - a CVSS Base Score: 8.8 HIGH is not something I'd want to ignore - NIST metrics below indicating a low level attack complexity is all you need to know here to ensure your fleet gets updated ASAP.

Hi There,  What is the recommended deployment method for Citrix XenApp / vApps where multiple users log onto the same server concurrently. (Multiple users sharing same IP)

Hello, New to Netskope.  I was able to find the v1 API documentation https://docs.netskope.com/en/netskope-platform-rest-apis.html as well as the v2 API documentation https://<tenant>.goskope.com/apidocs/?include_beta_routes=0 We're looking to utilize the versatility of the v2 permission based token.  I didn't see the v1 API endpoints available in the v2 API documentationexample: https://docs.netskope.com/en/manage-quarantine-files.html for v1 wasn't in the v2Is there additional documentation that I'm missing?  or is there a roadmap/timeline to when the v1 endpoints will be available in v2? Thank you for your time and insight into this. 

I am creating a DLP rule where I place the Post activity and the Block activity but it does not perform the action that is allowed, on the contrary if I select Teams there it does block the same policy.

Context: You have some users uploading sensitive data to Github. These smart users are avoiding detection by using non-text formats e.g. XLSX or docx. How to get alerted for binary commits on Github?   Solution: Netskope next-gen Github API can detect and alert when a binary file is committed to Github. Create a very simple DLP rule that detects keywords for "Binary files". Call that into a profile and a Github ongoing policy. That's all that is needed.   Here are the required screenshots showing how to create a DLP rule using custom entity with case insensitive keyword.    

As the AI wars heat up, Google is stepping up its game against OpenAI with the release of Bard. Google originally (early 2023) made it difficult for the average user to play around with Bard by introducing an invitation based system resulting in waitlists, again this was earlier this year when ChatGPT rocketed into the mainstream consciousness, but as it stands today, most, if not all Google account holders can access, play around, I mean, leverage Google Bard.   What are the risks involved for enterprises ? The reality is that it's not any different than the risk of using an unsanctioned app. I mean data exfiltration capabilities, privacy issues et al, makes Google Bard a veritable minefield for every security organization.   Google explicitly advertises Bard as way to make life simpler for software devs. This is the biggest risk I see for most enterprises whe

Hello!I´m preparing test environment to make support for Customer with Workspace One and Android Device.The applications installs OK! But the certificates is not present in the work "container". In personal conteiner, I installed the certificates manually from Settings (upload CA) and works fine with the browser  access (Tested with Deny Category, notifications show me this block)But in the work profile, this settings is not working.Does anybody knows how to install certificates with MDM WorkspaceOne in the work space? (container Work space) Thank you very much!

Hi, we are stumbled upon a use case where when a user is presented with justification reason box for "Policy Violation" they are required to input the reason and this should generate an email notification to our dropbox that will generate a ticket in our ticketing system (connectwise)  However, even though we configured the ticket orchestrator on cloud exchange we are able to get the "alerts" with the help of plugins notifier, netskope ITSM CTO's. This set up is not creating any tickets as you can see from the screenshot attached.  We are looking for a way for the users when they justify the reason to use blocked page, this should generate an email notification to our dropbox. We have tried adding the email to the individual policy email notifications but this does not provide us with user justification reasons.

Hi Team, Greeting  We are having a customer requirement regarding an Private application/Custom Application which SaaS based application. Like HRMS so I need to know the R-proxy part as the we can able to done reverse proxy in NG-SWG as client want a visibility to there pvt app/custom app for unmanaged user accessing the Application. I got confused a little bit here. Does R proxy able to support the custom or pvt apps or just support the known business' usage application in R proxy like 0365 Gsuite. Salesforce etc. Can i do reverse proxy integration with Custom apps and Pvt app we approaching the NPA CASB but due to some commercial they want to try it on NGSWG. 

Context: Next Gen APIs and Retro Scans   If you haven't noticed yet Netskope is adding more and more apps to the Next Gen API Platform. One of the greatest advantage it comes with is - Decoupling of your ongoing scan policies from retro scans. New way to do retro scan is to create a Retro Scan Policy Group. Now you can add multiple API-Enabled Protection policies to a single retro scan policy set and scan entire group with click of a button. Definitely a better way to do the retro scans.   Retro scans are now separate from ongoing policies. In the classic version you need to select an existing policy and start Retro Scan for the respective supported SaaS app. This decoupling makes sipping through SkopeIT alerts more effective. You can start retro scans in set of policies instead of individually scanning API-Enabled Protection policies one by one.   Just keep in mind that you nee

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You