For a new Netskope tenant provisioned, to create a secure tenant configuration, you should

consider changing the following default settings:

B . Change Untrusted Root Certificate to Block: This setting will ensure that any traffic coming from

an untrusted root certificate is blocked, which is a critical security measure to prevent man-in-the-

middle attacks and other types of cyber threats1.

D . Change “Disallow concurrent logins by an Admin” to Enabled: This setting will prevent multiple

concurrent logins by the same admin account, which is an important security control to mitigate the

risk of unauthorized access. If an admin’s credentials are compromised, this setting will help limit the

potential damage by ensuring that only one session can be active at a time1.

These changes are part of the recommended security hardening guidelines for Netskope tenants to

enhance the overall security posture of the tenant environment.

Reference: The recommendations for changing default settings for a secure tenant configuration are

based on Netskope’s security hardening guidelines, which provide detailed instructions on how to

enhance the security of Netskope products and components deployed in customer environments1.

To retain the original dashboard without automatic updates due to improvements made by

Netskope, you can download the desired dashboard and then import it from a file into your Group or

Personal folder.

This approach ensures that you have a static version of the dashboard that won’t be affected by

future changes or enhancements. Reference:

The answer is based on general knowledge of dashboard management and customization within

Netskope.

The reported issue of slow website and SaaS application access for users in the San Francisco branch

office, despite being connected to a Netskope data plane in New York, can be attributed to the

geographical distance between the user location and the data plane. The Netskope Security Cloud

operates through a distributed network of data planes strategically placed in various regions. When

users connect to a data plane that is geographically distant, it can result in latency due to longer

network traversal times. In this case, the closest Netskope data plane to San Francisco might be

unavailable or experiencing high load, leading to performance issues. To address this, consider

optimizing data plane selection based on proximity to the user location or investigating any data

plane availability or performance issues.

Reference:

Netskope Cloud Security

Netskope Resources

Netskope Documentation

To extract events and alerts from the Netskope Security Cloud platform and integrate them with a

SIEM (Security Information and Event Management) solution, you can utilize the following supported

methods:

Cloud Log Shipper (CLS):

The Cloud Log Shipper is designed to forward Netskope logs to external systems, including SIEMs.

It allows you to export logs in real-time or batch mode to a destination of your choice.

By configuring CLS, you can ensure that Netskope events and alerts are sent to your SIEM for further

analysis and correlation.

Reference: Netskope Documentation on Cloud Log Shipper

REST API:

The Netskope Security Cloud provides a comprehensive REST API that allows you to

programmatically retrieve data, including events and alerts.

You can use the REST API to query specific logs, incidents, or other relevant information from

Netskope.

By integrating with the REST API, you can extract data and push it to your SIEM solution.

Reference: Netskope REST API Documentation

Reference:

Netskope Cloud Security

Netskope Resources

Netskope Documentation

These methods ensure seamless data flow between Netskope and your SIEM, enabling effective

security monitoring and incident response.

For devices not owned by the organization, using an explicit proxy along with the Netskope Client is

the best approach to steer traffic for inspection. This method allows for granular control over the

traffic, ensuring that only the traffic destined for the company’s instance of Microsoft 365 is

inspected by Netskope. The explicit proxy configuration can be applied regardless of whether the

users are on-premises or off-premises, providing a consistent steering mechanism for all users.

Reference: The steering configuration for non-owned devices and the use of explicit proxy in

conjunction with the Netskope Client are detailed in the Netskope Knowledge Portal. The portal

provides guidelines on how to set up steering configurations to direct traffic from end users to the

Netskope Cloud for real-time analysis, which is applicable for both managed and unmanaged

devices1