By default, Netskope's steering configuration includes pre-defined exceptions for certain application domains and cloud services to prevent disruption during initial deployments. One of these default exceptions includes a steering bypass for Microsoft's cloud storage domains, which effectively prevents OneDrive traffic from being inspected by Netskope. If Real-time Protection policies for OneDrive are not being enforced despite being correctly configured, the most likely cause is that a default steering exception is bypassing the traffic before it reaches the policy engine. Removing the default steering exception for these domains ensures that OneDrive traffic is properly tunneled to Netskope and subjected to policy evaluation. Disabling SSL rules or modifying certificate-pinned application settings would not resolve a fundamental steering bypass issue.

When investigating a specific malicious file hash received from a threat intelligence source, Netskope provides two complementary tools for identifying all instances of that hash within the organization's environment. Skope IT allows administrators to perform direct queries against event data using the file hash as a filter, returning all events where that hash was observed in network transactions across the monitored environment. Advanced Analytics provides a broader analytical view, enabling administrators to visualize trends, aggregate results by user or time period, and cross-reference hash occurrences with other contextual data points. Netskope Client logs are device-specific and not centrally queryable via the UI. SIEM-based queries depend on prior log export configuration and represent an indirect method rather than a native Netskope investigation tool.

The reason for the activity being NULL in this scenario is likely because a user accessed a static Web page. In Netskope's Advanced Analytics, when the activity is reported as NULL, it often indicates that there was no dynamic interaction or transaction to record, which is typical when a static web page is accessed1. Static web pages do not generate the kind of events or activities that are tracked by policies, hence they appear as NULL in the activity field.

When verifying that Google Drive traffic is being tunneled to Netskope using Chrome and the Netskope Client, you would expect to see log entries indicating that the traffic is being directed through Netskope's proxy. Specifically, Option A is correct as it shows the process "google drive" being tunneled tonsProxy. The log entry for Option A indicates that a TLS tunneling flow from a local address and process (Google Drive) is being directed to a host (play.googleapis.com) and then to Netskope's proxy (nsProxy).This is consistent with how Netskope tunnels specified traffic for security and policy enforcement1.
The expected log entries are based on the standard operation of Netskope Client and how it steers traffic to Netskope's cloud services, as detailed in Netskope's documentation1.