This is the most direct and clear method. Netskope’s DLP policy engine allows you to use the ‘Device’ condition (which can check for managed status via the Client, or other attributes like device type) to create distinct policy instances. This separates the logic cleanly, making the policy intent easy to understand and maintain, as opposed to burying exceptions within a single rule.

Netskope evaluates policies from top to bottom in the Skope IT (or NPA) policy list, and the first matching rule is applied. If a general ‘Allow’ rule (e.g., for all web traffic) is placed above the specific block rule, the traffic will be allowed before the block rule is ever evaluated. This is a common configuration error. Verifying and correcting the policy order is the critical first step.

Tunnel Mode (with Steer to Client) is designed for always-on, resilient remote user protection. In this mode, the client creates a secure tunnel (often using GRE or IPsec) directly to a Netskope POP. The ‘Steer to Client’ configuration ensures that all device traffic, regardless of the network, is routed through this tunnel. It handles network switches and reconnections more seamlessly than Forward Proxy Mode, which relies on PAC files or explicit proxy settings that can be bypassed or fail.

The Analytics page is Netskope’s primary investigative and forensics tool. It allows you to build granular queries across all logged events. You can filter by user, activity type (e.g., ‘upload’), destination (e.g., ‘Cloud Storage’ category or specific apps), content (using DLP profiles like ‘Credit Card Numbers’), and a custom time range. This provides a comprehensive, searchable view of all relevant events, which is more direct than hoping the incident was caught by a specific alert policy.

A DLP Profile threshold rule is specifically designed for this scenario. You would first create a DLP profile that detects source code (e.g., via file extension like .java, .py, or content matching). Then, within the policy, you would apply a threshold condition (e.g., ‘Count’ > ’10’ files) over a defined time window (e.g., ‘5’ minutes). This allows the policy to ignore small, legitimate downloads but alert or block on activity that suggests a mass download.

Netskope’s SSL Decryption rules are highly granular. You can create a rule to decrypt traffic for the main application domain (e.g., ‘app.example.com’) and then add specific URL path-based exceptions (e.g., ‘app.example.com/legal/*’) with the action ‘Do Not Decrypt’. This ensures the bulk of traffic is inspected for threats while complying with privacy requirements for sensitive sections of the site.

For Netskope to use Azure AD (or any IdP) group memberships in policies, the user identity context must be passed during authentication. This is achieved by configuring User Mapping, typically via SCIM or a SAML integration that is set up to send the necessary group attributes (like ‘memberOf’) from Azure AD to Netskope. Without this step, Netskope only sees the username, not their group affiliations, making group-based policies impossible.

Netskope’s Cloud Malware Detection for apps like Google Drive, Microsoft 365, etc., often leverages API integrations (when configured). These integrations allow Netskope to query the cloud service’s own security state or file reputation. In this case, it’s likely that Google’s internal scanners identified the file in the personal Drive as malicious, and Netskope, via its API connection, retrieved this verdict and generated the incident, all without requiring inline SSL decryption of the download traffic.

Data residency in Netskope is governed by: 1) The tenant’s default Geofence setting, which determines the primary region for data processing and storage. 2) The steering configuration (e.g., a specific PAC file or Tunnel gateway address) provided to the EU users, which must point them to Netskope POPs within the EU geofence. Configuring both ensures traffic is steered to and processed in the correct geographical region.

This is the most direct and clear method. Netskope’s DLP policy engine allows you to use the ‘Device’ condition (which can check for managed status via the Client, or other attributes like device type) to create distinct policy instances. This separates the logic cleanly, making the policy intent easy to understand and maintain, as opposed to burying exceptions within a single rule.0