API-enabled Protection traffic is sent to the Netskope Data Plane . The Netskope Data Plane is responsible for processing and inspecting data in real-time, applying security policies, and ensuring that the traffic conforms to organizational policies.

Netskope Data Plane : This component handles the inline inspection and enforcement of security policies, including API-enabled protection. It ensures that all traffic is securely processed and monitored according to the defined policies.

References :

Netskope architecture documentation describing the roles of different components.

Detailed guides on how API-enabled protection integrates with the Netskope Data Plane for real-time traffic inspection.

=================

Administrators can subscribe to service notifications, including incidents and planned maintenance, through the following Netskope sites:

https://notify.netskope.com : This site provides notifications about incidents and maintenance updates. Administrators can subscribe to receive email alerts whenever there are updates involving specific services or planned maintenance.

https://trust.netskope.com : This site offers detailed information about Netskope ' s operational status, including any incidents, planned maintenance, and security updates. Administrators can subscribe to receive notifications and stay informed about the service status.

References :

Netskope documentation and support articles on subscribing to service notifications and updates.

Netskope ' s service notification and operational status sites providing subscription options for alerts and updates.

The NPA (Netskope Private Access) Troubleshooter Tool provides the following status indicators when run:

Steering configuration : This indicates whether the traffic is being correctly steered through the Netskope infrastructure according to the defined policies.

Publisher connectivity : This status shows whether the Netskope Publisher is correctly connected and able to communicate with the Netskope cloud. It ensures that the Publisher, which acts as a gateway, is functioning correctly.

Reachability of the private app : This status verifies if the private application is reachable from the Netskope infrastructure, ensuring that users can access the necessary internal resources.

These indicators help administrators troubleshoot and ensure that the NPA setup is working correctly, providing secure and reliable access to private applications.

References :

Netskope documentation on using the NPA Troubleshooter Tool and the status indicators it provides.

Best practices for troubleshooting NPA connectivity and performance issues.

=================

A limitation of using a legacy proxy compared to Netskope’s solution is that to enforce policies, traffic needs to traverse back through a customer’s on-premises security stack. This creates latency, bandwidth, and scalability issues for remote users and cloud applications. Netskope’s solution, on the other hand, leverages a cloud-native architecture that provides high-performance and scalable inspection of traffic from any location and device. References: [Netskope Architecture Overview]

Add the specific IP addresses on the IP Allow List (A): To restrict access to the Netskope Admin UI to specific IP addresses, administrators need to add these IP addresses to the IP Allow List. This ensures that only connections from these specified IP addresses are allowed access to the Admin UI. This configuration is crucial for enhancing security by limiting access to trusted IP addresses only.

Enable and set the User Notification Template to display the custom message (D): To display a custom message to admin users after they have authenticated, administrators need to enable and configure the User Notification Template. This template allows the customization of messages that are shown to users, including after login. This feature is useful for displaying privacy notices, welcome messages, or other important information to users upon successful authentication.

These steps are verified based on the configuration options available within the Netskope Admin UI settings. For more detailed steps and configuration, you can refer to the respective sections in the Netskope documentation.

The parameter shown in the exhibit (File Profile) is crucial in policies where file type, size, and other attributes need to be specified. Here are two use cases where this parameter is required:

When you create a policy to prevent file transfer between a sanctioned Google Drive and personal Google Drive:

Explanation: In this use case, the File Profile is used to define the types of files that are not allowed to be transferred between different Google Drive instances. By specifying the file types in the policy, administrators can ensure that sensitive corporate data is not transferred to personal accounts.

Implementation: Create a new File Profile with the desired file types and apply this profile in the policy that governs the data transfer rules between sanctioned and personal Google Drive instances.

When you create a policy to prevent binary files larger than 5 MB that are shared publicly on a sanctioned OneDrive:

Explanation: This use case involves creating a policy that restricts the sharing of large binary files (e.g., executable files) on publicly accessible folders in OneDrive. The File Profile parameter allows defining the file size and type criteria.

Implementation: Define a File Profile that specifies binary files and sets a size limit (e.g., 5 MB). Apply this profile in the policy to prevent such files from being shared publicly.

References:

REST API v2 Overview - Netskope Knowledge Portal

Using the REST API v2 dataexport Iterator Endpoints - Netskope Knowledge Portal

Using the REST API v2 UCI Impact Endpoints - Netskope Knowledge Portal

netskopesdk · PyPI

Netskope Rest APIv2(OAS 3.1) - Postman Collection

Netskope’s Private Access Solution is a service that allows users to securely access private applications without exposing them to the internet or using VPNs. It provides protection for private applications by encrypting the traffic, enforcing granular policies, and preventing data exfiltration. It also provides access to private applications by creating a secure tunnel between the user’s device and the application’s server, regardless of their location or network. It does not act as a cloud-based firewall, as it does not filter or block traffic based on ports or protocols. It does not require on-premises hardware, as it is a cloud-native solution that leverages Netskope’s global network of points of presence (POPs). References: [Netskope Private Access] .

When an administrator suspects that a DLP rule is generating false positives, the Forensic feature within the Netskope tenant allows for reviewing the data that was matched by the DLP rule. This feature provides detailed logs and insights into why a specific piece of data was flagged, enabling the administrator to analyze and adjust the rule as needed.

To access and use the Forensic feature:

Navigate to the Forensic section in the Netskope UI.

Review the detailed logs and matched data to understand the context and reason behind each match.

Adjust the DLP rules if necessary to reduce false positives and improve accuracy.

References:

Netskope REST API Overview ​​.

Netskope SDK Documentation ​​.

In this scenario, there are three probable causes for the issue of users not being able to access external websites from their browsers after attempting to steer traffic to Netskope using GRE tunnels. One cause is that the configured GRE peer in the Netskope platform is incorrect, which means that the Netskope POP that is supposed to receive the GRE traffic from the customer’s network is not matching the IP address of the customer’s router that is sending the GRE traffic. This will result in a failure to establish a GRE tunnel between the customer and Netskope. Another cause is that the corporate firewall might be blocking GRE traffic, which means that the firewall rules are not allowing the GRE protocol (IP protocol number 47) or the UDP port 4789 (for VXLAN encapsulation) to pass through. This will result in a failure to send or receive GRE packets between the customer and Netskope. A third cause is that the route map was applied to the wrong router interface, which means that the configuration that specifies which traffic should be steered to Netskope using GRE tunnels was not applied to the correct interface on the customer’s router. This will result in a failure to steer the desired traffic to Netskope. The pre-shared key for the GRE tunnel is incorrect is not a probable cause for this issue, as GRE tunnels do not use pre-shared keys for authentication or encryption. Netskope does support GRE tunnels, so this is not a cause for this issue either. References: [Netskope Secure Forwarder],  Netskope Security Cloud Operation & Administration (NSCO & A) - Classroom Course , Module 3: Steering Configuration, Lesson 3: Secure Forwarder.

Deploying a Netskope Virtual Appliance (NPA) can serve multiple purposes within an organization ' s security infrastructure. Two key uses are:

To use as a log parser to discover in-use cloud applications:

The Netskope Virtual Appliance can be deployed to parse logs from various sources, including firewalls, proxies, and other network devices. By analyzing these logs, the appliance can discover and identify cloud applications that are being used within the network. This provides visibility into shadow IT and helps in managing and securing cloud application usage.

To use as an endpoint for Netskope Private Access (NPA):

The virtual appliance can act as an endpoint for Netskope Private Access, enabling secure access to private applications hosted in data centers or public clouds. It facilitates the establishment of secure, direct connections between users and the applications they need to access, without exposing the applications to the public internet.

References:

Netskope Knowledge Portal: Deploying Virtual Appliances

Netskope Private Access Overview