A single Real-Time Policy using the pre-defined ‘Credit Card Number’ DLP profile against the broad ‘Cloud Storage’ application category is the most effective and manageable approach. It provides consistent, centralized control, leverages Netskope’s extensive app catalog, and avoids the administrative overhead of maintaining multiple app-specific policies.

A split-tunnel VPN configuration is a common culprit. When users connect via VPN, if their internet traffic is routed directly to the internet (split-tunnel) rather than through the corporate network and its security stack, it will bypass Netskope’s steering and inspection. The policy works off-VPN because traffic is steered correctly via the Netskope Client or Secure Web Gateway.

Policy order is critical in Netskope. The correct approach is to create two policies. The first policy should ‘Allow’ the activity for ‘Managed’ devices (using a Device Trust condition). The second policy should ‘Block’ the download for the DLP profile on ‘Unmanaged’ devices. The ‘Allow’ policy must be ordered above the ‘Block’ policy to take precedence for managed devices, ensuring they are not inadvertently blocked.

User bypass actions are recorded in the ‘Audit’ log, not the primary traffic or page view logs. The analyst should use Skope Insights to query the Audit log for the ‘Bypass Warning’ activity type, which captures when a user clicks ‘Continue to Site’ on a block page. This data can then be used to configure a proactive alert.

PAC File mode is specifically designed for seamless migration from legacy proxy solutions. It allows the existing PAC file infrastructure to remain in place while redirecting traffic to the local Netskope Client. This provides immediate visibility and the ability to test policies in ‘Monitor’ mode without changing the user’s network configuration, minimizing disruption before cutting over to Forward Proxy or Tunnel modes.

The Policy Match feature in Skope IT (or the New Skope UI) is the primary diagnostic tool. By examining a specific blocked session, you can see the exact application instance (e.g., drive.google.com/a/company.com vs. drive.google.com), the user, the data context, and which specific condition in the policy caused the match. This precise information is crucial for correcting the policy logic, such as refining the app instance target.

Tunnel Bypass rules in the Netskope Client configuration allow specific, trusted traffic to exit the device directly to the internet, bypassing the Netskope tunnel. Creating a bypass rule for the ‘Video Conferencing’ app category (which includes Zoom, Teams, Webex, etc.) is the standard method to optimize performance for real-time media while keeping all other web traffic secured by Netskope.

Files blocked or quarantined by Threat Protection or DLP policies are managed in the dedicated ‘Quarantine’ page (Policies > Quarantine). When a file is quarantined, the user receives a notification and can submit a release request. An administrator must then review the request in the Quarantine page and choose to approve (release) or deny it. This provides a controlled exception process.

Skope Insights is Netskope’s advanced analytics and reporting tool designed for complex, ad-hoc queries across historical log data. To build this report, you would use the query builder to join data from logs like ‘Page View’ (for user/geo info) and ‘Application’ (for transaction details), applying filters for region (EU), app category (Cloud Storage), activity (Upload), and file size (>100MB). Scheduled reports and dashboards are less flexible for such specific, one-time requirements.

A single Real-Time Policy using the pre-defined ‘Credit Card Number’ DLP profile against the broad ‘Cloud Storage’ application category is the most effective and manageable approach. It provides consistent, centralized control, leverages Netskope’s extensive app catalog, and avoids the administrative overhead of maintaining multiple app-specific policies.0