New Features and Enhancements In Release 92.0.0

Uncover insights into risky user behavior with this new addition to the Netskope Library.

You can schedule a dashboard directly from the Netskope shared folder and automatically get updates that Netskope makes to improve that dashboard. If you do not want automatic updates, then copy the dashboard into your group or personal folders and schedule from there.

The new Action data field in the page events data collection allows you to report isolated events generated from RBI.

API Data Protection now can restrict access to internal users in the policy wizard for Microsoft Office 365 OneDrive and SharePoint applications. This new feature, when enabled, restricts file-sharing access to internal users only. The Internal Users option is available as part of the API Data Protection policy wizard under Action > Restrict Access > Restrict Access Level.

Netskope has added support for tombstone files uploaded in case of malware detection for applications other than Microsoft Office 365 OneDrive and SharePoint.

Slack has introduced granular permissions. To leverage the new permissions:

Netskope now supports API Data Protection for ServiceNow instances running within the GovCommunityCloud (GCC) environment. Customers can enforce data protection policies on attachments and fields for incident and problem record types within instances hosted in these environments.

Netskope has introduced a change in the way Microsoft Office 365 SharePoint Sites app site-level sharing permissions are computed. Exposure calculation of a file (during the initial listing and ongoing flow) will now use sharing information from the site to calculate overall exposure in addition to file level exposure.

To learn more: SharePoint App Site-level Sharing Permission Change Notification.

API Data Protection has lowered the permissions required for the Azure Web App for Microsoft Office 365 Outlook. Netskope has removed the Use Exchange Web Services with full access to all mailbox permission from the Azure web app for Outlook.

In this release, Netskope adds support for Unshare activity for the Lucidchart application, where you can unshare the document. You can configure policies in real-time based on Unshare activities.

With this release, Netskope extends support for more than 200 new application connectors for AWS with coverage across browser and CLI/API traffic.

Earlier, Create activity was detected while copying a file from a folder to another folder in the ShareFile application. From this release onwards, this navigation is detected as Copy which is a more accurate name for the action performed. You can configure policies in real-time based on Copy activities.

In this release, Netskope adds a Rename activity that enables you to configure policies in real-time.

Netskope now extends DLP support for Send email activities in ServiceNow Application. You can now apply DLP policies for the content followed by DLP inspection.

Earlier, Create/Edit activity was detected while submitting a survey response in ServiceNow. From this release onwards, this navigation is detected as Post which is a more accurate name for the action performed. You can configure policies in real-time based on Post activities.

Google provides a new feature to create Minutes of Meeting in the Google Calendar invite. Netskope adds coverage for the Google Doc created when you generate Minutes of Meeting using the Create activity.

With this release, Netskope extends new app connector support for the Whatsapp application as per the request to detect Upload and Download activities. This helps you to configure policies in real-time.

In this release, Netskope adds Move and Copy activity in the Google Cloud Storage application.

End of Life support UI changes for SpringCM, Jive, and Intralinks application with Reverse proxy.

This release includes support for several additional file types accessible through the DLP file filter and some of these involves:

The Netskope Adapter (NS Adapter) has been tested to ensure compatibility with the current cloud platform. Its version number has been updated to confirm this compatibility. No other changes have been made to the NS Adapter in this release.

In addition to the local tenant admin user accounts, the Netskope admins page now displays SSO user accounts after admin users successfully authenticate with IDPs. It allows tenant admin to manage the SSO user accounts in the management console.

Netskope Cloud Security Assessment (CSA) uses cross-account IAM Role (Netskope_Role) to access customer AWS environment. The inline policy netskope-csa attached to the Netskope_role is updated to add support for AWS WAF and SES. The new Inline policy after Release91.1.0 is as follows :

{
     "Version": "2012-10-17",
     "Statement": [
        {
        "Action": [
                    "s3:ListBucket",
                    "ses:ListIdentityPolicies",
                    "s3:GetBucketAcl",
                    "s3:GetBucketLocation",
                    "s3:ListAllMyBuckets",
                    "dynamodb:ListTagsOfResource",
                    "sqs:ListDeadLetterSourceQueues",
                    "sqs:GetQueueUrl",
                    "sqs:GetQueueAttributes",
                    "lambda:Get*",
                    "lambda:List*",
                    "cloudwatch:GetMetricStatistics",
                    "eks:ListFargateProfiles",
                    "ec2:GetEbsEncryptionByDefault",
                    "codebuild:BatchGetProjects",
                    "codebuild:ListSourceCredentials",
                    "wafv2:GetLoggingConfiguration",
                    "ses:GetAccount"
                ],
        "Resource": [
        "*"
                    ],
        "Effect": "Allow"
        },
        {
            "Action": [
                       "s3:GetObject",
                       "s3:GetObjectVersion"
                      ],
            "Resource": [
                         "arn:aws:s3:::elasticbeanstalk-*"
                        ],
            "Effect": "Allow"
        }
    ]
} 

In this release, Netskope introduces a tenant-level feature flag to restrict Netskope CSPM to only scan selected AWS regions.

In this release, Netskope CSPM adds all predefined checks present under the Foundational Security Best Practices standard of AWS Config. You can find the predefined rules under Netskope AWS Best Practices Profile. Netskope extends support for the following 15 new AWS services:

You can now set up granular data loss prevention (DLP) policies using the UI to focus scans on critical parts of the cloud infrastructure. Granular policy control includes container-level attributes like bucket name, tags, region, and access. You can also build policies using object-level attributes like name, key, content type, extension, and so on.

The list of supported Request Headers for HTTP Header Policies now includes Origin (used for controlling CORS requests). For more information: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin.

For users that are unknown or not authenticated due to any reason, admins can create a policy specifically for unknown users in real-time policies and extend the threat and DLP protection to those unknown users.

The UI has improvements for easier navigation of Private Applications and Publisher configuration.

NPA Browser Access now provides an admin with the ability to terminate a user’s active session.

This improvement addresses an issue that prevented Browser Access users from successfully authenticating against Azure AD in certain scenarios.

Enhanced the behavior of the Print user action control in isolated pages. You cannot use the local browser Print function to print isolated pages content. Print preview will show a blank page and a warning message stating that printing has been disabled since printing is blocked in the global configuration for all isolated pages. Before this enhancement, you could use your local browser print function to print a screenshot of the isolated page rendered content, which leads to confusion.

Enhanced the admin UI for the RBI policy creation template (Policies > Real-Time Protection > New Policy > RBI). Destination unrecommended categories selected in an isolation policy will be identified with an orange box and warning icon. This enhancement can help you identify unrecommended categories when you add them to the isolation policy.

Before this enhancement, while creating RBI policies, you received a warning message if you add unrecommended destination categories. But these categories were not identified explicitly. As a workaround, remove unrecommended categories action was used to remove them from the policy.

In this release, two new template library Reports and 30 new report widgets tied to them are available:

Enhanced filtering of Page Events in Skope IT allows customers to filter events using the isolate action with a simple query (action eq ‘isolate’). Before this change, it was not possible to filter Page Events by action.

This enhancement allows you to identify the pages sent to Netskope RBI for web isolation by typing the filter: action eq ‘isolate’. This isolate filter is not present in the + Add Filter menu.

When adding IPSec tunnels, you now can select or deselect rekey and reauthentication in the Advanced Settings. These options are enabled by default, and Netskope recommends using the default settings. Netskope provided the advanced settings to bring up IPSec tunnel with Versa devices.

To learn more: IPSec.

The Compromised Credentials pages are enhanced with the following improvements:

The Compromised credentials detail now displays an elaborated breach description about the breach if available.

This update adds additional filters to the Client Traffic Exploit Prevention (CTEP) signature overrides. Now you can use signature references example CVE and CVSS scores to filter signatures.

To learn more: Creating a Signature Override.

This update enhances the signature override option on the Alert Details page for CTEP. Now the signature id is pre-populated when you select signature override action.

In this release, Netskope enhances the signature overrides setting. You can now scroll through the entire list of CTEP signatures using a scroll bar.

CrowdStrike integration API changed to a newer API offering called IOC Manager that provides several new features including the ability to set the severity of generated detections and block hashes. Also, allows you to identify the IOCs sourced from Netskope (seen as Netskope_CSPlugin_v3) on the CrowdStrike Falcon UI. The change does not modify the configuration steps in Netskope UI and the policies set up for remediation actions in Netskope.

The API update requires creating new API scopes on the CrowdStrike Falcon Admin UI.

To learn more: Integrating CrowdStrike for EDR.

A patient zero event occurs when a user downloads a file that’s not detected by signature-based analysis (e.g., Netskope AV engine) in Standard Threat Protection; however, Netskope scans and determines the file is malicious through behavior-based analysis (e.g., Cloud Sandbox) or advanced heuristics analysis in Advanced Threat Protection. Netskope then triggers a malware alert for patient zero users to accelerate remediation actions for your organization.

You can also integrate with endpoint detection and response (EDR) vendors via Netskope Cloud Exchange (CE) to detect and isolate the downloaded file on an endpoint.

To learn more: Viewing Patient Zero Events.

There are several enhancements to the Malware page (Incidents > Malware) and Alerts page (Skope IT > Events > Alerts) for faster correlation.

On the Malware page, the Timestamp (GMT) column was renamed to Last Detection Time (GMT).

On the Malware Details page:

On the File Details page, you can copy the MD5 and SHA256 hashes to your clipboard and use them for filtering alerts and incidents.

On the Skope IT Alerts page, you can:

To learn more: About Malware.

Retrohunt API provides an API that allows you to query detections by hash (md5,sha256) if the file has been seen (whether malicious or benign) in traffic within the Netskope tenant. Additionally, a report can be retrieved for the detections and verdicts by the different engines.

The nine default rule-based UBA policies allow a user or user group-based exclusion. Specific users or user groups are excluded from the UBA policy using a new exception field in the additional criteria for each UBA policy. Excluded users/user groups cannot trigger UBA alerts for that policy.

In addition to documenting all new and improved features, here is the list of articles with key documentation updates: