New Features And Enhancements In Release 106.0.0

UEBA supports a setting for excluding applications for predefined and custom UEBA policies. This allows selection of specific applications to exclude from evaluation for predefined and custom UEBA policies.

The summary and event timeline detail is enhanced for several UEBA detections. This provides additional context for the detection to assist with forensic investigation and remediation.

A new alert allows setting the User Confidence Index (UCI) threshold value for all users. When the UCI for any user drops below the specified value configurable from Incidents > Behavior Analytics, a UEBA alert is triggered in Skope IT showing the UCI value in the alert details. To learn more: Behavior Analytics User Confidence Index

Added the following three new App Connector for Apps with Generative AI capabilities:

Critical activities like Post, Upload and Download are covered with these connectors to monitor and prevent data exfiltration.

Improved instance ID detections for upload and download API based operations made to Box application.

With auth proxy endpoint URL configuration on IDP side, endpoint URL is configured to point Netskope auth proxy URL instead of actual ACS URL. As no other changes are done as part of this configuration, the ACS URL can be maliciously modified to default MS URL and bypass Netskope rproxy control.

AuthProxy Authentication for Office Portal now supports optional resigning feature at each IDP with Netskope Tenant certificate, to enforce Netskope security check and prevent MITM attack.

The App Tag criteria for Real-time Protection was renamed to CCI App Tag. A similar change was made for Skope IT, where the Tag filter was renamed to CCI App Tag.

Added four new Cert pinned apps to the list, these are associated with Windows OS platform:

The following changes have been made to CCI App Type default tag mappings:

Updated the application category for Google Maps from Consumer to Technology.

GCP Apps are renamed as follows:

The Vulnerabilities & Exploits section in CCI Application Information page has been enhanced and renamed to Attack Surface Management. It will now highlight results of more than 50 passive vulnerability scans including OWASP Top 10 Vulnerabilities, in addition to information on recent breaches.

Updated Taxpayer ID Numbers (US; “ITIN”) Entity to support groups from ’50’ to ’65’ based on the current ITIN definition.

Updated UI tooltips for Unlikely Matches and Common-Sense Filters under the Entities tab of DLP.

The “Medical Conditions (English)” Entity has been completely overhauled in order to reduce false positives caused by matching medications. For example, “acetaminophen” and “Tylenol” and anatomical references (like, “pulmonary” and “jugular vein”) to improve detection of more natural ways of referring to common ailments.

In order to better delineate our predefined PHI and PII DLP Profiles, Medical-related Rules (PHI) were removed from the following PII Profiles:

Added more plurals terms support for driver licenses (for example, “driver licenses”), as well as specific terms “dls#”, “cdl#”, and “cdls#”.

Custom Entities (defined on the Entities page) that reference a single predefined Entity will now inherit the predefined Entity’s default validators and filters.

If the Entity Modifier feature is enabled, you will now also have the option to change or remove the inherited filters that are applied to their new custom Entity. Netskope recommends using the default filters that apply to the predefined entity.

You can now choose to obfuscate the matched content for custom entities created using the Entities tab in the UI.

The obfuscated content will be stored in the customer managed forensic folder and seen in the “Preview” and “Preview File” sections of an incident in the WebUI. Entity Obfuscation requires the Entity modifier feature to also be enabled on the tenant.

Customers using DPOP will not be able to leverage this functionality since forensics is not available as a feature on DPOP. Additionally, If the appliance is not updated to Release 106 and you select obfuscation for a DLP entity, any DLP scan that includes the profile associated with the mentioned entity will not yield any match results for all the profiles involved in the scan. Please ensure that the appliance version is upgraded to 106 before using this functionality.

Endpoint DLP events and alerts previously used both “MacOS” and “macOS” for the OS field. This has been made consistent and will always report “macOS”.

The application name for the Endpoint DLP application is changed to Netskope Endpoint DLP on macOS.

Endpoint DLP agent for macOS can now block Android phones in both Media Transfer Protocol (MTP) and Picture Transfer Protocol (PTP) modes.

The Endpoint DLP agent now requires TLS1.3 to communicate with datacenter APIs.

Classic API Data Protection supports manual remediation. The same support is now extended to Next Generation API Data Protection. An administrator can manually take a remediation action on an incident from the Incidents > DLP page. The available actions are:

You can navigate to the Incidents > DLP page, click an incident, under Actions > API Data Protection (Next Gen), choose the remediation actions.

Starting this release, Next Generation SSPM shows a summary of 3rd-party connected apps on the Next Generation SSPM Overview page. Connected app is mechanism to link a 3rd-party application to a SaaS application platform using OAuth for authorization. For example Box for Salesforce is a connected app that allows integration between Salesforce and Box.

To view the 3rd-party connected apps, navigate to API-enabled Protection > SECURITY POSTURE (NEXT GEN) > Overview, then view the Applications widget. Clicking the donut chart takes you to the Inventory > Resources page to list the 3rd-party connected apps. To learn more: View Security Posture Overview

Starting this release, Next Generation SSPM now supports categorizing SSPM rules and findings on MITRE ATT&CK for SaaS and security domains.

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally recognized framework and knowledge base that helps organizations understand and categorize the tactics, techniques, and procedures (TTPs) used by cyber adversaries during various stages of a cyberattack.

In the context of Security Operations (SecOps), there are several well-known domains or categories that are commonly addressed to ensure a comprehensive security posture. These domains cover various aspects of security operations and help organizations in managing and responding to security incidents effectively.

To accommodate these new rules and findings, Next Generation SSPM has introduced new categories under the security posture policy wizard:

In addition, you can create a custom rule and include them as part of the above new categories.

To learn more: Next Generation SaaS Security Posture Management Policy Wizard

This feature provides customers the ability to use their on-premises hosted HSM/key manager to sign the certificate for TLS decryption of real-time traffic in Netskope Cloud.

To learn more: Certificates

Transaction Events Format 2 and Format 3 are now GA and available for all tenants.

A total of 86 new fields have been added to the following topics:

To learn more: Transaction Event Fields

When admins login to the Web UI, a new banner about upgrading policies to the new file type feature and the expected migration timeline is visible. The file type feature provides more granular file type options to choose from and applies true file type detection.

To learn more: File Type Detection

We can now disable longest prefix match in NG-SWG when matching incoming URLs against URL lists. As a result, the incoming URL will match against all URL lists with a positive match criteria. This is different from the current behavior of matching with the URL list with the longest prefix match.

Extended RBI is an upcoming RBI new licensing, that expands RBI support for new risk scenarios: browsing of unsanctioned cloud apps.

Extended RBI is a new license that expands the RBI offering to cover additional risk scenarios in addition to the current ‘Targeted RBI’ scope: i.e., additional web categories and unsanctioned cloud apps which do not require isolation of all web traffic (full isolation).

Extended RBI will protect the browsing activity and browser for corporate users accessing unsanctioned cloud apps and websites.

To learn more: Extended RBI (BETA DOCUMENTATION)

Updated the default value for the enableAOACSupport feature flag from disabled to enabled. No impact for the existing tenants with the feature flag enabled.

To learn more: Netskope Client Deployment Options.

New 500Mbps tunnel bandwidth support added under maximum bandwidth selection in the IPSec configuration page.

To learn more: IPSec and Creating an IPSec Site.

Based on Microsoft’s latest Terms of Service, Netskope can no longer support OneDrive as a forensic destination. Due to this, Netskope will not support this feature in any new commercial or federal Netskope DC. Fine prints:

As an alternative, Netskope recommends to use a public cloud storage (like Azure Blob, AWS S3, or GCP Cloud Storage) as a forensic destination over a SaaS storage app. To learn more: Forensics.

Deprecating support for Google Plus (Google Currents) app connector as the corresponding app has been deprecated by Google. To learn more: Learn about the switch from Google Currents to spaces in Google Chat