Devices

Devices

The Devices page focuses on monitoring the Client’s status of all the devices in your tenant. You can export your entire device list to CSV file. To open the Devices page, go to Settings > Security Cloud Platform > Netskope Client > Devices.

Enable and Disable Device(s)

To enable or disable the Netskope client, or collect logs from a device, click the checkbox next to the hostname and click Enable or Disable. These buttons remain grayed out until you select a hostname.

Logs can only be collected from individual devices, but you can enable and disable the Netskope Client on multiple devices at one time.

Search Functionality

You can use the Search functionality to look for a specific device added in the tenant. To search for a device, enter the username in the search field. The search is not case-sensitive and you can get search results that are Like ~ or Equal = to the text entered in the text box.

Devices_Search_LikeEqual_104.png

Filters

The Devices page displays information based on the selected filter.

Default Filter

You can click FILTERS above the Search text box to select the default filter. The filters are either created by you or shared with you. The following are the default filters:

  • All Devices: Displays all devices within your tenant where the Netskope client is installed.
  • New Devices: Displays all devices with Netskope Client added within the last 24 hours. You can change the filter to search using options from the Last Event Time dropdown menu. For example, Last 7 days, Last 30 days, and so on.
  • Anonymous Devices: Displays devices where the the user has not logged after installing the Netskope client.
  • Disabled Devices: Displays devices where the Netskope client is disabled. Devices can end up in this state when an admin has taken through the admin console, or when an end user (if allowed) has client from the device.
  • Uninstalled Devices: Displays devices where the Netskope Client is uninstalled.
  • Installation Failure: Displays devices where the Netskope Client installation failed.
Devices_DefaultFilters_104.png

Custom Filter

To use custom filters, click +Add Filter and select a filter.  Enter text in the search field to display devices on the Devices webUI.

The following table refers to the filters that you can use to refine your search results:

Filter OptionDescription
Client Install TimeThe time taken to install the client in a device.
Client VersionYou can view devices tagged to a specific version.
Client StatusFilter devices according to the current client status.
Internet Security StatusDisplay devices with respect to the internet security status such as Enabled, Disabled, Errored, Fail Closed, and Backed Off.
Private Apps Access StatusDisplay devices with respect to the private app access status such as Enabled, Disabled, and Errored.
Endpoint DLP StatusDisplay devices with respect to the private app access status such as Enabled, Disabled, and Paused.
Last EventDisplay those devices where the client last event posted was installed, enabled, or disabled by the admin or user.
Last Event ActorDisplays those devices where the events are created by user, admin, or system.
Last Event ServiceDisplays devices where the event service is either Internet Security or Private Apps Access.
User SourceDisplays devices where the users are sourced from AD or local.
User GroupDisplays devices where the users added in that device is also a part of the listed user groups.
User OUDisplays devices based on the organizational units.
Show Pre-logon UsersDisplays devices where the Pre-logon users options are added or not.
Device ClassificationDisplays devices according to their status like managed, unmanaged, unknown, not configured.
Device OS PlatformDisplays devices according to the operating system.

Client Configuration

You can configure system-wide settings using the Client Configuration dialog box.  Click Client Configurations displayed at the top right corner of the Devices page to open Client Configuration. To learn more, view Client Configuration.

Device Information

The following lists the various components to display the Device information on this page:

Devices_DeviceInformation_104.png
  • Hostname

    Note

    For Android and iOS devices, the device serial number is displayed as NA.

  • Device Classification
  • OS platform
  • Make
  • Model
  • Unique Device ID
  • Management ID
  • Serial Number
  • User (displays user email address)
  • User GroupOU
  • Client Installation Time
  • Client Version
  • Client Status
  • Internet Security Status
  • Private Apps Access Status
  • Endpoint DLP Status
  • Last Event Service
  • Last Event
  • Last Event Actor
  • Last Event Time

Important

For Netskope Clients with version older than 104.0.0, the webUI does not display the following statuses and the respective columns appear blank:

  • Client Status
  • Serial Number
  • Last Event Service

Additional Information

  • To display additional information such as Make, Model, Last Event Actor on the Devices webUI,  click Devices_DeviceInformation_Settings_104.png  displayed on the devices list table and select options according to your requirement.
  • If the device includes more than one user:
    • The Users column displays the total number of users.
    • The Internet Security Status, Private Apps Access Status columns displays Multiple Statuses and Last Event displays Multiple Events.
      Devices_MultipleUSers_104.png
    • Click the hostname to select the user from the list of users added to that device.
  • Click the checkbox in the Hostname column to select all deployed devices. You can select only up to 10,000 devices at a time. If there are more than 10,000 devices, make your selection in batches.

Note

For iOS devices, the hostname, model, version, and check-in are not shown, and only devices that are installed using MDM managed devices with the VPN profile with the Email listed.

View Device Details

To view the details of an individual device, select the hostname or click the ellipsis() and select View Details to open the device details page.

After you click View Details, it navigates to another page that displays device, and Client information. To view event history, group membership, or organization unit information, click the appropriate tab.

  • Device: Displays various user and device information such as:

    • User: The email address of the enrolled user.

    • Device: Displays the device information such as model and operating system of the selected device.

    • Device Classification: Displays whether the device is managed or  unmanaged.

    • MAC address: Displays MAC addresses of the physical network interfaces that the device currently uses. This list can contain more than one MAC address. Only tenants with Client version 112.0.0 or above can see this option on the webUI.

    • Client Version: The version of the Netskope Client that is associated with the selected device.

    • Unique Device ID: Displays the Unique Device ID associated with the selected device.

    • Serial Number: Displays the serial number of the selected device.

    • Steering Configuration: Displays the Steering Configuration configured for the user. Only tenants with Client version 112.0.0 or above can see this option on the webUI.

    For tenants with Netskope Client version prior to version 112.0.0, Steering Configuration and MAC Address fields display empty fields.
  • Services: Displays the Client services available for the selected hostname and the associated status available.

    If Endpoint DLP is enabled, you can pause or resume the service from the detail view. The default pause time is 30 minutes.

    DevicesEDLPPause.png

  • Event History: Displays various events that are posted by the Client  For example, Tunnel Up, Tunnel Down, Client uninstallation failure, Network Change, and so on. For more details, view Client Status. At the same time, the Event column also displays the reason as to why a specific event occurred for specific events. For example, tunnel down can occur due to the change in traffic mode or user deprovisioned.

    • Tunnel Down Event Details: The following event details are displayed on the webUI whenever the tunnel is down in the following scenarios:

       The following events are applicable across all devices supported by Netskope Client.
      EventEvent Details
      Tunnel Down
      • Traffic mode changed

      • Interop proxy changed

      • User Deprovisioned

      • On-Prem Status Changed

      • Tunnel Protocol Changed

      • Re-configured User

      Tunnel Down Due to Error

      • Detected Dead Peer

      • Ping timeout

      • Missing Gateway Configuration

      • Failed Tunnel Establishment Due to Network Error

      • Tunnel Down Due to SSL Error


    • Client Upgrade or Uninstallation Failure: To know more about the events displayed in the event of a Client or Uninstallation failure in a Windows device, view Netskope Client for Windows.

  • Group Membership: Displays the group information from the DC.

  • Organization Unit: Displays the OU that the user belongs to.

Device Count

The total number of devices count is calculated using:

  • Device entry count (by Unique Device ID and User)
  • Unique device count (by Unique Device ID)

In the following screenshot, for example, the Devices page consists of 22 Device and the User pairing and out of that there are 13 Unique Device ID.

Using another example to elaborate this scenario:

  • User A and User B are accessing Device 1.
  • User C is accessing Device 2 and Device 3. 

The Devices page displays the total number of devices count as follows: 4 Devices+User Entries (3 Devices). In this example, the Devices page consists of:

  • Four entries of Device and User pairing (Device 1and User A, Device 1 and User B, Device 2 and User C, and Device 3 and User C).
  • Three Devices(Device 1, Device 2, and Device 3).
  • Three Unique Device IDs( One Unique Device ID for devices assigned to Device 1, and two different IDs for Device 2 and Device 3).

Unique Device Identifier

Netskope Client creates Unique Device Identifier at the time of enrollment. Prior to the version 105.0.0, the Unique Device ID was created based on the hostname and few other parameters. As the hostname is no longer maintained unique in the organizations, with 105.0.0, Netskope Client is enhanced to use the hardware parameters such as Windows GUID for creating Unique Device ID.

Previously, whenever there were devices with the same hostname, it shared the same Unique Device ID. From version 105.0.0, different Unique Device IDs are assigned to each device and no two devices share the same ID. With the new Unique Device ID, whenever the administrator tries to query based on the Client Data, the value for nsdeviceuid  in the response returned by the host differs from the value displayed with the old Device ID.

Note

This feature will be enabled in a phased manner by Netskope that would take a couple of months. No action required by the user for this roll-out.

For example, in the following screenshot:

  • Only one user(Andy) is tagged to DESKTOP-RPR6OU.
  • Two users(Cathy and Bob) are tagged to  Windows10-Desktop.
  • Three users(Dan, Ed, and are tagged to Windows11-Image0303.

In this example, devices with the same hostname share the same unique device ID.

The Netskope Client now identifies devices based on the hardware parameters such as GUID and separate entries are displayed for each user and device on the Devices webUI. The devices now display different unique device identifiers even if they share the same hostname. 

With the new approach, Cathy and Bob will have separate entries for their devices with different unique device identifiers on the webUI. Similarly, Dan, Ed, and Frank will have separate entries for their devices with different unique device IDs.

Manage Client

The admin can control the user access to enable or disable the Client. The admin can select one of the following options:

  • Enable Traffic Steering – The admin enables Client for the selected device and restricts the user from disabling the Client.
  • Disable Traffic Steering – The admin disables Client for the selected device and restricts the user from enabling the Client.

Hide Devices

Use this functionality to hide those devices that no longer generate events or remain inactive for a specific number of days configured on the Devices page. You can hide old devices that do not generate any events due to reasons such as user removal and so on for the configured number of days. This does not affect older versions of Netskope Client as they might still be generating events.

To hide a device(s):

  1. Click the settings icon on the Devices webUI.

  2. This displays another window Preferences where you can enable the Hide functionality and add the number of days.

  3. Toggle the Hide devices option to enable this functionality.

  4. In the text box, enter the number of days to filter the devices that no longer generate any events.

  5. Click Save.

Export Device Information

To export the contents in the Device UI to a CSV file, select the hostnames and click Export. The details displayed in the exported file depends on the options that you choose on the Export webUI. When there are multiple users added to a device and you choose Unique Devices in the Type field on the Export webUI, the CSV will only display the total number of users added to that device. To view each username added to a device, choose the option Devices and Users in the Type field.

Devices_Export_104.png

Client Status

The following table lists the various Client statuses: Internet Service, Private Apps service, and Endpoint DLP according to their meaning. The status of a Client is:

  • Enabled: When any of the services are enabled.

  • Disabled: When all services are disabled.

You can also query client status via the  Get Client Data REST API.

Internet Security Service Status

EventActorStatusMeaning
InstalledSystemDisabledVia email invitation, distribution tool (i.e. SCCM, Altiris, JAMF etc)
Tunnel UpSystemEnabled‘Auto’ enabled just after install, upgrade or later
Tunnel DownSystemDisableddisabled – default startup state of client i.e. after installation/upgrade/restart
Tunnel down due to secure forwarderSystemDisabled‘Auto’ disabled due to Netskope Secure Forwarder found
Tunnel down due to GRESystemDisabled‘Auto’ Disabled due to GRE
Tunnel down due to IPSecSystemDisabled‘Auto’ Disabled due to IPSec
Tunnel down due to Data Plane on-premisesSystemDisabled‘Auto’ Disabled due to on-premises DP
Tunnel down due to config errorSystemDisabled‘Auto’ disabled due to config errors/missing config
Tunnel down due to error in Modern Standby modeSystem DisabledAuto’ disabled due to device in modern standby mode (AOAC)
Tunnel down due to errorSystemDisabled‘Auto’ disabled due to (any other) error
Change in networkSystemDisabled‘Auto’ disabled due to change in network
System shutdownSystemDisabled‘Auto’ disabled due to system restart/ power down
System powerupSystemDisabled/Enabled‘Auto’ Tunnel status will be as per actual status
Enrollment Token ErrorSystemErroredDisplayed when an invalid enrollment authentication token is used
EnrolledUserDisabled
Once the user enroll using IdP mode through the Netskope Client webUI.
User DisabledUserDisabledUser disabled the client from the system tray
User EnabledUserEnabledUser enabled the client from the system tray
Admin DisabledAdminDisabledTenant admin disabled the client from the system tray
Admin Disabled
(This event is available only for tenants with Dynamic Steering)
AdminBacked OffTenant admin disabled the Client from the webUI.
Whenever the admin selects None steering option, the Netskope Client disables only traffic steering and sends “Admin Disabled” event to the Device info.
Admin EnabledAdminEnabledTenant admin enabled the client from the webUI
InstalledSystemDisabledVia email invitation, distribution tool (i.e. SCCM, Altiris, JAMF etc)
UninstalledSystemUninstalledUninstalled by end user, admin, SCCM admin etc
Installation FailureSystemDisabledInstallation failed
Uninstallation FailureSystemDisabledDisabled  Failed to uninstall the Client
Upgrade SuccessSystemDisabledClient upgraded successfully
Upgrade FailureSystemDisabledClient failed to upgrade
Rollback SuccessSystemEnabledRolled back to client version ‘x’
Rollback FailureSystemEnabledFailed to rollback to client version ‘x’
Device Posture ChangeSystemManagedWhenever the Client is in compliance with the device classification rules configured for an OS platform, the Managed status is displayed in the Device Posture Change event.
Device Posture ChangeSystemUnmanagedWhenever the Client is not in compliance with the device classification rules configured for an OS platform, the Unmanaged status is displayed in the Device Posture Change event.
Device Posture ChangeSystemUnknownThe Client sends Unknown status before the Client downloads the device classification rules.
CA Installation ChangeSystemDisabled/EnabledCA rotation is detected and new CAs are installed to the system store.
When the CA rotation is detected (the new downloaded CA is different from the existing CA and the subject name is the same), Netskope Client  posts the “CA Installation Change” event for cert rotation monitoring.
CA Installation FailureSystemEnabledCA installation failed. This event is posted when the first attempt fails. Consecutive installation failures are not posted onto the webUI until the CA installation succeeds. Once the CA installation succeeds, it resets the status.
CA Installation SuccessSystemEnabledSuccessful CA installation after the failed CA installation attempts. No CA Installation Success event is posted on the webUI when there are no failed attempts.
– The CA Installation Change event is available only for Windows, macOS, and Linux. For Mobile applications(iOS, Android, and ChromeOS), use MDM to install the new CAs before cert rotation. You can download Netskope Root CA and Tenant Intermediate CA from the tenant UI Signing CA section.
– If the CA rotation is detected and CA installation in the system store fails, the Netskope Client falls back to the older CA and user cert.

Private Access Apps Status

EventActorStatusMeaning
DisabledSystemDisabledNPA is not available for the customer. NPA status code is 0.
DisabledSystemDisabledNPA is available for the tenant but tunnel is not yet established. It should be transient state. NPA status code is 0.
DisabledSystemDisabledNPA is available, but not enabled from the tenant UI. NPA status code is 0.
EnabledSystemEnabledNPA tunnel is connected. NPA status code is 2.
DisabledSystemDisabledUser disables the NPA Client. NPA status code is 0.
DisabledSystemDisabledAdmin disables the NPA Client from the tenant UI. NPA status code is 0.
ErroredSystemDisabledNPA tunnel is disconnected due to error. NPA status code is 11.

Endpoint DLP Status

If Endpoint DLP is enabled, you can click View Details to see Endpoint DLP Service Details.

The Services section on the Devices page.

There are two Endpoint DLP statuses:

  • Config Status: The configuration state for the endpoint, which comes from the Client configurations applying to the endpoint. It displays Enabled or Disabled indicating if the endpoint should have Endpoint DLP enabled or not based on the Client configurations.

  • Service Status: The reported status of the Endpoint DLP software on the endpoint. This is the same status displayed in the Services table above, which is reported by epdlp.exe (Windows) on the endpoint. You can see one of the following states:

    • Enabled: The service is running, communicating correctly, and working properly.

    • Disabled: The service is not running.

    • Paused: The service is paused by clicking Pause Service. This action lasts for 30 minutes.

    • Device Control Error/Device Control Disabled: The driver for USB Device Control is unable to load correctly. This status might appear for machines that are turned off.

    • System Reboot Required: The endpoint needs a reboot so the USB device control functions properly. This occurs when the system has a non-resettable USB controller and an Endpoint DLP upgrade occurs. The new driver can’t be loaded until the reboot occurs.

The Endpoint DLP Services Details pane.
Share this Doc

Devices

Or copy link

In this topic ...