Fingerprint Groups

To create a Fingerprint Group:

1. Go to Policies > Profiles > DLP > Fingerprinting > Fingerprint Groups.

2. Click New Fingerprint Group.

   

3. Enter a Fingerprint Group Name.

4. Select between Text, Image, and Text and Image for Fingerprint Type. Files will be evaluated to the corresponding Fingerprint Type. The Fingerprint Type cannot be changed after creation.

5. Drag and drop files or folders to the box or Select Files or Folders to search for them in an Explorer window. When uploading an archive file (e.g.: .zip), if there is a mismatch in the Fingerprint Type and the files in the archive file, the offending files will be ignored and the remaining files will be accepted.

   

6. Click Save. Your Fingerprint Group will be in a Generating state until it is Complete. Once it is Complete, you can use it in the creation of a DLP Profile. You can click the Refresh icon to see if the Generating state moved to Complete.

Package Installation

Installing the TYOC package files is required for manipulating Fingerprint Groups. This page also contains the steps to perform hash generation.

Install the packages in this order:

1. keyview.ns
2. dlpcicontent.ns
3. dlpdata.ns
4. dplib.ns
5. dlptools.ns

sudo dpkg -i --force-overwrite package_file.deb

Hash Generation

The Fingerprint 2.0 API supports direct uploads of a pre-generated hash.
You can generate the hash on a virtual machine and then upload the hash instead of the real artifacts (original files or images) to Netskope.
The hash generation steps for Source files and Negative Hashes are the same.

If the hash file is greater than 10MB, split the JSON using line breaks into multipart JSON files.

A Python script for splitting the JSON is provided on the Support Portal..

Put all the files to be fingerprinted (or hash-extracted) in a folder, say, “/myFolder” or if you have a zip file, give the zip file name in place of the folder.

/opt/ns/bin/nsdlp/dlp-fingerprint20 -c classification_1 -f /myFolder/ -o ~/temp/fp/output/ -e ~/temp/fp/extract/ -

This will create an output file: ~/temp/fp/output/fingerprint20_211_1.json

For a list of detailed steps, see the User Guide on the Support Portal.

From the admin console, go to Settings > Tools > REST API v2.

Single File Upload Example

curl -X POST "https://your-tenant.goskope.com/api/v2/services/dlp/fingerprints/5590549391965102994/hashes" \
-H "Netskope-Api-Token: 38cxxxxxxxxxxeeef2f1" \
-H "x-netskope-user-email: user@example.com" \
-H "Content-Type: multipart/form-data" \
-F "upload=@/path/to/your/hashfile.json"

Method Upload Example

1. Upload First Chunk

   curl -X POST " " \https://your-tenant.goskope.com/api/v2/services/dlp/fingerprints/5590549391965102994/hashes?txid=1&ssid=12345&sessionend=false
   -H "Netskope-Api-Token: 38c9a700980fb009f9bb8a303eeef2f1" \
   -H "x-netskope-trid: 1234567890123456789" \ **to correlate the logs with client requests.
   -H "x-netskope-user-email: user@example.com" \
   -H "Content-Type: multipart/form-data" \
   -F "upload=@/path/to/hashfile_part1.json"

2. Upload Second Chunk

   curl -X POST " " \https://your-tenant.goskope.com/api/v2/services/dlp/fingerprints/5590549391965102994/hashes?txid=2&ssid=12345&sessionend=false
   -H "Netskope-Api-Token: 38c9a700980fb009f9bb8a303eeef2f1" \
   -H "x-netskope-trid: 1234567890123456789" \
   -H "x-netskope-user-email: user@example.com" \
   -H "Content-Type: multipart/form-data" \
   -F "upload=@/path/to/hashfile_part2.json"

3. Upload Third Chunk

   curl -X POST "https://your-tenant.goskope.com/api/v2/services/dlp/fingerprints/5590549391965102994/hashes?txid=3&ssid=12345&sessionend=true" \
   -H "Netskope-Api-Token: 38c9a700980fb009f9bb8a303eeef2f1" \
   -H "x-netskope-trid: 1234567890123456789" \
   -H "x-netskope-user-email: user@example.com" \
   Netskope | Copyright 2026, All rights reserved. /15 25
   -H "Content-Type: multipart/form-data" \
   -F "upload=@/path/to/hashfile_part3.json"

   Setting sessionend=true on the last upload triggers processing of all uploaded files in the session.

Uploading Negative Hashes

curl -X POST “https://your-tenant.goskope.com/api/v2/services/dlp/fingerprints/5590549391965102994/hashes?negative=true” \
-H “Netskope-Api-Token: 38c9a700980fb009f9bb8a303eeef2f1” \
-H “x-netskope-user-email: user@example.com” \
-H “Content-Type: multipart/form-data” \
-F “negative_hashes.json=@/path/to/negative_hashes.json”

You can edit your Fingerprint Group allowing you to change the Threshold or add/remove files to it.

To edit a Fingerprint Group:

1. Go to an existing Fingerprint Group and click … at the right and then click Edit.

2. If you wish to delete files, select the checkbox for the corresponding files and go to # Selected, click the dropdown, and click Delete.

   

3. If you wish to add files, click Upload Files and follow the same steps as above.

   Reupload & replace

   

You can also replace an existing file in the the fingerprint group by clicking … next to an existing file and clicking Reupload & replace.

From this window, you can drag & drop a file or click Select File and then click Upload to replace the existing file.

You can also click View Exclusion List to Upload files for the fingerprint groups’s exclusion list. Adding files to the exclusion list will provide a list of files that will be excluded from a fingerprint match. For a text-based file such as .docx/.pptx, an exact match would be exclude. For an image based file, the exact file and highly similar images (file format conversions or color > black-and-white) will be excluded.

You can delete a Fingerprint Group by navigating to the dots at the right and clicking Delete.

Clicking the Export button will allow you to export a .csv file containing a list of all the files included within the Fingerprint Group.

Errors may appear when uploading a duplicate file to a Fingerprint Group. You can get more granularity on the error by checking the Error Log.

To download the Error Log, navigate to the dots on a Fingerprint Group, click Edit, and then click Error Log to receive a .csv containing all the errors associated with the Fingerprint Group.

If you receive an error in the Exclusion List, the Error Log button will appear after clicking View Exclusion List.

Incidents associated with a Fingerprint Group show a list of Fingerprinting Group Violations.

For more information, see Incidents.

A tenant is allowed to create up to 100 fingerprint groups.

A tenant is allowed to upload up to 10K image files for fingerprinting.

A tenant is allowed to upload 1,000,000 total files for fingerprinting (this includes image based, text based and exclusion files).

Minimum accepted image size is 100×100 pixels.

Minimum text file size is 20 bytes (for better efficacy, Netskope does not encourage fingerprinting a short sentence).

WebUI upload file size limit is 8MB.

API directly upload file size limit is 16MB.

Offline fingerprint generation file size limit is 100MB.

When a fingerprint group or custom classifier is used in a DLP profile, WebUI won’t allow the deletion of FP-group/custom-classifier to be deleted. However, user could “accidentally” delete it using API directly. When this happens, DLP profile would refer to an “undefined” FP-group/custom-classifier and during inspection time, DLP would ignore such undefined FP-group/custom-classifier as if they don’t exist at all. User can remove such undefined rules. This loophole currently has not much negative impact on DLP scan but still should be avoided for data integrity.

This issue will be fixed in the upcoming release with Referential Integrity integration.