Device Classification for Mac

You can classify Mac devices based on these criteria:

Go to Settings > Manage > Device Classification and select Mac on the New Device Classification dropdown list, and then follow these steps to classify your Mac device. Select options and enter the requested parameters.

1. Rule Name: Enter a name for this classification rule.

2. Device Classification: From the options displayed in the dropdown menu, choose the desired label you want to assign to this rule. You cannot assign more than one label to a rule.

3. Classification Criteria: Select an All or Any criteria match.

4. Encryption: To classify a device to be encrypted, choose one or both of these options:

   • FileVault

   • PGP

5. OPSWAT: Netskope can leverage OPSWAT capabilities (You need to install OPSWAT to use its capabilities) to identify the applications installed on the endpoint device and monitor them. To use an OPSWAT check, select one of the following from the Check Type dropdown menu and enter the Metaccess license key:

   • Full Compliance check: Netskope Client checks whether the MetaAccess agent is running to ensure that registry contains the latest compliance information.  Also, checks if the configured MetaAccess license on the WebUI matches the product license.

   • Basic Compliance check: Checks if the compliance policy check has a critical error. In case of an error, the basic compliance check fails.

6. Process: To classify a managed device based on the presence of any one or more processes, enter the executable file name.

7. File: To classify a device based on the presence of any one or more files, enter the path and file name.

8. AD Domain: To classify a device associated to any one or more domains, enter the domain name.

9. Certificate: To look for certificates on the device. This section also displays the existing certificates.

   Netskope Client uses certificate issuer (complete cert chain) that the administrator imports into the webUI, to verify the client certificate signed by the import certificate.

   Prepare a Device Classification Certificate Rule

   To upload a new certificate, click Select File, and then upload your certificate in Base-64 encoded .pem format.  If you have multiple signing certificates to upload, you need to create multiple device classification rules for each certificate. For example, to upload CA-Certificate-A and CA-Certificate-B, create separate device classification rules: DC-Cert-Rule-A with CA-Certificate-A and DC-Cert-Rule-B with CA-Certificate-B. The new certificate added in each rule do not replace the previously added certificates in other rules. However, if you choose to replace an existing certificate, the new certificate replaces the previous one within the same rule.

   Ensure that each PEM file begins with BEGIN CERTIFICATE and ends with END CERTIFICATE.

   A single PEM file can be a combination of the following:

   • Intermediate CA certificate

   • Root CA certificate

   It is important to add certificates in the correct sequence in the certificate chain starting with Intermediate CA that issued the client certificate followed by the Root CA.

   A correct PEM file is in the following format:

   Begins with 

   —–BEGIN CERTIFICATE—–

    Ends with:

   —–END CERTIFICATE—–

   Upload CA Certificates

   Refer to the following examples to understand which CA certificates you need to upload in the webUI.

   • Example 1: Client Cert is signed by Root CA

     • Upload Root CA .pem file

   • Example 2: Client Cert is signed by Intermediate CA

     • Upload a single .pem file which contains Intermediate and Root CA

     • Order of the certs in the file should be Intermediate CA followed by Root CA

   • Example 3: Client Cert is signed by Intermediate CA-2

     Intermediate CA-2 is signed by Intermediate CA-1

     Intermediate CA-1 is signed by Root CA

     • Upload a single .pem file which contains Int CA-2, Int CA-1 and Root CA

     • Order of the certs in the file should be Int CA-2, Int CA-1, Root CA

   Additional Certificate Check Options

   Check UPN: This check compares the current logged in UserPrincipalName with four fields present in the certificate: Subject CN, Subject Email, Subject Alternative RFC822, and Subject Alternative Principal Name. If any of these four fields match with the current login principal name, then the UPN Check is successful.

10. AV: To check the existence and status of an anti-virus product. The admin can select one or multiple AVs from the following predefined AV list:

    • CrowdStrike

    • SentinelOne

    • Carbon Black

    • Microsoft Defender

    • Custom

      

    Custom: The admin must manually enter the AV product name in the Custom AV Product Name field.

    

    After you select the AV name, Client enumerates the list of system extensions installed on the machine and matches the corresponding AVs in the enabled state.

11. OS: To check and classify device compliance for the detected OS version that matches or is above the version information configured by the administrator. The OS check rule for macOS consists of  Minimum OS Version.

    

    The admin can select one of the following predefined OS versions:

    • BigSur

    • Monterey

    • Ventura

    • Sonoma

    • Custom

    Custom: If you select Custom, provide the minimum OS version number in the following format: x.x.x.

    

    After you add the version details, Netskope Client fetches the active macOS version number and matches it with the configured rule.

12. When finished, click Save.

After creating a device classification rule, you can use it in a Real-time Protection policy.

1. To use this Device Classification in a Real-time Protection policy, click Policies > Real-time Protection in the Netskope UI. Select an existing policy or click New Policy and choose a policy type.

2. Proceed through the Users, Cloud Apps + Web, DLP/Threat Protection, and Select Activities sections.

3. For Additional Attributes, click Access Method and select either Client, Mobile Profile, or Reverse Proxy, and then click Save. Click Device Classification, and then select label from Custom Device Management and Managed or Unmanaged from Device Classification, based on the devices you just classified.

   • Managed means the device is managed; the device posture information sent by the Client matches at least one of the device classification checks configured for that Client’s OS.

   • Unmanaged means the device is unmanaged; the device posture information sent by the Client matches none of the device classification checks configured for that Client’s OS.

4. When finished, click Save and then Next.

5. Combine device classification with other policy elements, like using the Block Action for specified applications for activities like uploading files from managed or unmanaged devices. Finish creating or updating this policy to establish this device classification. Click Apply Changes for this policy.

6. After the policy has been created, perform the process for which the policy was created. Next go to Skope IT > Application Events and click the magnifying icon for an event to open the Application Event Details panel. In the User section you’ll see a Device Classification field, which shows one of these device classifications.