New Features And Enhancements In Release 107.0.0

NS Library Dashboards

Dashboards and Widgets created in the past 90 days will show under the New folder.

Overview Page Update

With this enhancement, the followings use cases are observed:

• The default dropdown selection is Security Leader if the default dashboard is not set in the Overview page insight dropdown under Advanced Analytics.
•  If Security Leader is not available in your tenant access, then you will have Top Cloud App Usage Insights by default unless any of the dropdown option is selected as default.

New Netskope Introspection v2 App For OneDrive & SharePoint

API Data Protection has introduced a new version of the Netskope Introspection v2 app (v2.0.0.3). With this new app, Netskope now requests reduced permission for the ‘Social’ scope. To learn more about the scope: Prerequisites To Configure Microsoft Office 365 OneDrive for API Data Protection (the table that lists the scopes). Existing customer can upgrade from v2.0.0.1 to v2.0.0.3 app. New customers will now need to install the v2.0.0.3 app.

To upgrade:

1. Remove the v2.0.0.1 app. To remove the app, follow the steps documented here. Though the article mentions v1 app, the steps to remove the v2.0.0.1 app are the same.
2. Install the v2.0.0.3 app. Follow the steps documented here. Though the article mentions v2.0.0.1 app, the steps to install the v2.0.0.3 app are the same.

New customers can directly download the v2.0.0.3 app from here and install the app. Follow the steps documented here.

New UI State Of Various Supported Features

In continuation to the deprecation of malware instance table in release 105.0.0, Netskope has rolled out a new UI table where the administrator can view the status of various supported features for each SaaS app. To view the status, navigate to Settings > Configure App Access > Classic > SaaS.

Rule Scenario Label

Advanced UEBA shows a key detection scenario label for every user with low User Confidence Index (UCI) score. This enables a SOC analyst to quickly isolate the highest risk scenario for the user that needs investigation. UBA anomalies for a user shows the corresponding detection scenarios as seen in Behavior Analytics policies.

GCP Storage Constraint Support

Enhanced the Google Cloud Storage app connector to support From Storage and To Storage constraints for the Copy activity. This allows enforcement for file/object movement through the Copy operation only to specified allowlists of storage buckets. Thus, preventing data exfiltration through Copy operations to unsanctioned buckets.

Multipart Upload Support

Added Multipart Upload to Adobe Creative Cloud application. With this support, even if the file is chunked into parts, the entire file content will be sent for inspection.

GCP App Connectors For API traffic

The new 140+ GCP app connectors covers API and CLI traffic to GCP services. Out of these 140+ connectors only 30 have been given a CCI score. The remaining GCP connectors are in the CCI research pipeline and will be given a score in subsequent realeases. For the existing GCP Cloud Storage app, both API/CLI and Browser traffic are now supported.

GCP Connectors with CCI Score

• GCP Key Management Service (KMS)
• GCP Resource Manager
• GCP Run Admin
• GCP TPU
• GCP Life Sciences
• GCP Identity and Access Management (IAM)
• GCP Kubernetes Engine
• GCP Service Directory
• GCP Spanner
• GCP Identity-Aware Proxy
• GCP Engine Admin
• GCP Storage
• GCP BigQuery
• GCP Apigee
• GCP Dialogflow
• GCP Datastore
• GCP Dataflow
• GCP Dataproc
• GCP Pub/Sub
• GCP Firestore
• GCP Deployment Manager V2
• GCP Datastream
• GCP Tag Manager
• GCP Compute Engine
• GCP VM Migration
• GCP Assured Workloads
• GCP Asset
• GCP Composer
• GCP DNS
• GCP Functions

To learn more details about individual connectors and associated activity coverage: Supported GCP Entities for Real-time Protection

Reverse Proxy as a Service for Appsheet

Added reverse proxy as a service (RaaS) to manage and control the usage of Appsheet application by un-managed devices. Admin can define policies to control control activities like share, create, and more.
Prerequisites: Google account should have been configured to Netskope SAML Proxy / Reverse Proxy. Reverse Proxy as a Service for AppSheet.

New Generative AI Connector Support With Activity Controls

Added the following four new App Connector for Apps with Generative AI capabilities:

• HeyGen
• Jasper 
• Notion AI (part of Notion) 
• Bing AI (part of Microsoft Bing)

Critical activities like Post, Upload and Download are covered with these connectors to monitor and prevent data exfiltration.

‘Share’ and ‘Preview’ Activities Support with ChatGPT Connector

CASB Real-time Protection now supports ‘Share’ and ‘Preview’ ChatGPT-based activities. The ‘share’ activity via ChatGPT allows users to easily share conversation and chats via social media, email, and other media. The ‘Preview’ activity is triggered when the shared link is viewed. With this enhancement an administrator can add granular controls for the usage and consumption of ChatGPT.

Create Draft DLP Enhancement for Gmail

Enhanced the Google Gmail App with the ability to perform DLP for the ‘create draft’ activity when more than 100 bytes of data is added/pasted into email. This feature prevents data exfiltration through drafting of sensitive information.

Connected App Risk Assessment Catalogue

A new Catalogue for Connected App risk assessment  in CCI provides insights into risks associated with a connected/OAuth apps available through Google Workspace and Microsoft App Source marketplace.

In this initial release 500 connected apps are added and more apps would be added in upcoming releases.

Global Risk Weight Customisation

A new functionality to bulk customise CCI attribute weightage across all categories has been introduced. This can be accessed on the CCI page by clicking on the Global Risk Weight setting.

Mexico Bank Account Number Entity Support

Added a new DLP Entity (“Deposit Account Numbers (MX)”) to detect Mexican bank account numbers (CLABE), and a companion Entity to detect relevant terms (“Bank Account Terms (MX)”).

Support For New And Emerging IBAN Countries

Added support for detecting International Bank Account Numbers (IBANs) for 18 new countries:

• Angola
• Burundi
• Congo (Brazzaville)
• Cameroon
• Cabo Verde
• Djibouti
• Gabon
• Honduras
• Libya
• Madagascar
• Mongolia
• Mozambique
• Niger
• Nicaragua
• Russia
• Sudan
• Somalia
• Togo.

Additionally, existing IBAN Entities for Azerbaijan and El Salvador were enhanced to detect case-insensitive IBANs.

Support For India PAN

Additional entities have been introduced to further the support of taxIDs in India, including :

• Taxpayer ID Numbers (IN; “PAN”)
•   Corporate Tax ID Numbers (IN; “PAN”)
•   Corporate Tax ID Numbers (IN; “STRN”)

Clientless WebSockets

Netskope Private Access (NPA) now supports websocket based HTTP connections over Browser Access. Websockets capability to enables access to applications like Apache Guacamole, RDP, and Azure Remote Desktop Service.

Publisher Auto-upgrade Feature Flag

Publisher auto-update feature is now available for all the customers to use. 

To learn more: Configure Publisher Auto-Updates

SSL Policy

Transaction Event fills ‘x-ssl-policy-name’ and ‘x-policy-name’ separately when SSL policy hits access control realtime policy.

Policy-Based Dedicate Egress Validation 

The following changes are part of this enhancement:

• Validations that prevent the deletion of a Network Location Profile when it exists in a customized Dedicated Egress IP profile.
• Validations that prevent the deletion of a custom category Web profile when it exists in a customized Dedicated Egress IP profile.
• The prevention of saving a customized Dedicated Egress IP profile when the user group in it was deleted, similar to the behavior on the SSL Decryption Profiles page.

Policy-Based Dedicated Egress IP UI Panel

This change enables customers who have the flag turned on to set a more detailed Dedicated Egress IP policy with the following specifications:

• user
• user groups
• organizational units
• source locations
• destination locations
• domains
• apps
• app suites
• categories

Tenant Exception List For Domain Fronting Feature

Added new Generic List and Domain Fronting Profile REST APIs that comply with the Netskope REST API v2 standard. These provide wildcard domain or full-domain match to domain fronting protection.

Support Remediation Action In GitHub

Next Generation API Data Protection now supports Restrict Access to Internal Collaborators remediation action in GitHub. This action restricts the access of the file to users within the organization and domains as defined under Settings > Administration > Internal Domains.

You can navigate to Policies > API Data Protection . Click the Next Gen tab, then New Policy. Under Object, select the GitHub app. Under Profiles & Actions, click the Action drop-down menu, then select Restrict Access > Restrict Access to Internal Collaborators.

For a consolidated list of supported features, see Next Generation API Data Protection Feature Matrix per Cloud App.

Google Badged Label Support

Netskope now supports Google’s badged label, a content classification feature. With this new capability, Netskope can read through the badged labels in Google Drive and apply a policy action. For example, if a document matches a badged label value which is deemed sensitive, an alert action can be taken. To learn more: Create a Next Generation API Data Protection Policy

For Netskope to read Google badge labels, you should grant additional OAuth scopes. They are:

• https://www.googleapis.com/auth/drive.labels
• https://www.googleapis.com/auth/drive.admin.labels

Once you add the above OAuth scopes, regrant the Google Drive app in the Netskope tenant. To learn more: Grant Scopes to the Netskope Service Account

PCI-DSS v4.0 Support For Microsoft 365

Next Generation SaaS Security Posture Management (SSPM) now supports the latest version of PCI-DSS v4.0 for Microsoft 365.

Visibility Into Zoom And ServiceNow Users

Next Generation SSPM now provides visibility into the following app users:

• ServiceNow
• Zoom

Enhanced Reporting

Next Generation SSPM now supports options to customize reports to skip passed findings and to generate reports at a per App suite basis.

To learn more: View Security Posture Findings

Introduction To Risk Level & Score of Connected Apps

With this new feature, you can now see the details like permission, scope, risk score, etc. of the connected apps that are configured using `OAuth`. Navigate to API-enabled Protection > Security Posture (Next Gen) > Inventory, then click the Resource tab. Click one of the resource name, the Resource Details panel opens. A new Risk & Permissions section is introduced in the side panel.

To learn more: View Security Posture Inventory

Gmail Print Feature

RBI has introduced support for the print feature in the Gmail web app. Users browsing in isolation can now leverage the print feature in the Gmail web app. Prior to this enhancement users were presented with a reconnection warning.

Extended RBI License

Extended RBI is a new license that expands RBI support for new risk scenarios such as browsing of unmanaged web categories and cloud apps.

Extended RBI is a new license that expands the RBI offering to support new risk scenarios in addition to the current ‘Targeted RBI’ license: additional web categories and unmanaged cloud apps (i.e. cloud apps not managed by IT or integrated with corporate IdP).

Netskope customers use Extended RBI to protect corporate users’ browsing activity and their browser when these users browse unmanaged websites and web apps (for example, personal webmail, social, chat and IM) 

Extended RBI entitles customers to isolate up to 25% web traffic processed by NG-SWG, considering the above description and limited to 1.5GB isolated traffic per user per month.

To learn more about Extended RBI in Netskope Knowledge Portal: Extended RBI

Bogon IP category

In steering configuration, for Source Locations and Destination Locations exceptions, you can now configure to include Bogon Networks by searching “Bogon” in the search bar when adding these exceptions.

To learn more: Adding Exceptions.

Unique Device ID

Introduced a new device indexing to ensure that a single device record contains only a single user information in the Device Status page of the Tenant Dashboard. This simplifies the device view on the Device Status page and also makes Details page easily accessible for each entry in case of multi-user environment.

To learn more, see Unique Device ID.

Client Configuration User Interface Navigation Update

The placeholder for Client Configuration is moved out from the Devices page on the user interface(UI) and now is accessed from Settings > Security Cloud Platform > Netskope Client > Client Configuration.

IPsec/GRE CSV Import

The IPSec and GRE CSV import functionality now supports additional fields, earlier this feature only supported mandatory fields. You can now create IPSec and GRE sites with all required and optional fields.

To learn more: Importing IPSec Sites from a CSV File and Importing GRE Sites from a CSV File.

Flexible Dynamic Steering

Enhanced the following in this release:

• On-Prem detection enhancement support multiple IPs for DNS detection and multiple HTTP hosts detection. 
• For the steering traffic mode, you can switch traffic mode between On-Prem, Off-Prem and the new mode None. When the traffic mode is None, the client will establish a tunnel but will not steer traffic. Exceptions will not be processed as they are only applicable for steered traffic.
• For the steering exception rules:
  • Firewall app exceptions contains separate sets of rules between On-Prem and Off-Prem in All steering traffic mode. 
  • Category exceptions contains set of rules between On-Prem and Off-Prem in Web or All mode.
  • If the packet matches configured exceptions and needs to be bypassed, you can select new exception bypass options to bypass locally on the client device, or bypass by tunnelling on backend.

To learn more, see Dynamic Steering.

UI Navigation Change Notification

There is a change in the UI navigation path. The Settings > API-enabled Protection navigation has changed to Settings > Configure App Access. Earlier, the API-enabled Protection page had two sub-categories – SaaS & IaaS. With the new change, the Configure App Access page is now categorized based on Next Gen & Classic. Detailed changes are below:

 Multiple IdP Support

Netskope enabled multiple SAML IdPs support by default, which allows you to authenticate with various IdP providers in the forward proxy deployment.

SSO For Multiple IdP Support

Netskope now supports Single sing-on (SSO) from multiple identity providers to access Netskope management console.

Admin Local User Account Activation And Verification

When creating a new tenant admin local account or resetting the password for an admin local account, Netskope sends an email to the admin account for email address verification.

SkopeIT

Data Source Selector Feature

Deprecated the Data Source feature in Settings > General > Data Source due to duplication in existing feature functionality.

Creating a Cloud App Definition: Improved the content and structure on how to create Cloud app definitions.