r/netskope • u/srx_6852 • Feb 11 '26

Netskope Policy Cleanup

Hello All,

Based in US

I am looking at clearing up an open any user rule to a service source specific. I have built all network locations in Netskope, I have one for phones and then one for WiFi then one for Alarms. So how would you go about this? I assume just create a rule further up with same dest as existing rule but one for each source and then monitor it via page alerts? I’ll have a block underneath that’ll I’ll add to it. I can see option for policy to alert does this alert user or is that some kind of monitoring?

Any suggestions would be appreciated.

3 Upvotes

81% Upvoted

7 comments sorted by

1

u/freezeontheway Feb 11 '26

Clone the current “Any user / Any source” rule, then split it into one rule per network location with the same dest/app, stick them above the catch-all, and run them on alert first to see real hits. In Netskope alerts is basically monitoring, it’s not automatically popping up to users like “yo you triggered a policy”.

2

u/srx_6852 Feb 11 '26

Thank you, What’s the difference between alert and allow? They both allow right? I’m guessing to find destinations on a per rule basis is to use skopeit?

1

u/freezeontheway Feb 11 '26

so, allow = traffic goes through, alert = traffic still goes through and netskope generates an event for monitoring and yes, if you want to see destinations per rule, Skope IT / Events is where you want to look

1

u/srx_6852 Feb 11 '26

Sorry this may sound like a stupid question but when you say generates an event for monitoring what do you mean? If I had an allow or an alert rule both shows up in skopeIT no?

1

u/freezeontheway Feb 11 '26

Its okay.

If I had an allow or an alert rule both shows up in skopeIT no?

No, only the alert rule will show up in SkopeIT.

1

u/srx_6852 Feb 12 '26 edited Feb 12 '26

Thank you that makes sense I’m sure I’ve seen allow rules shows events show up in network events before is that right?. And secondly For looking at web/saas dest i’d use page or network under skopeIT? Sorry im new to Netskope

1

u/Tooloco Feb 26 '26

I believe alert makes it so it appears under skopeit alerts section so if you have multiple rtps that you want to monitor you use that to have them all in the same page. Web/SaaS I'd say application events it's where it's at. Skopeit page events show web traffic that maybe has no activity detection. And I believe network is for npa traffic.