Netskope's API-enabled Protection supports multiple Instance Types for connecting to and managing supported SaaS applications. The three valid instance types are: Behavior Analytics, which enables user behavior monitoring within the SaaS platform; DLP Scan, which performs data loss prevention scans on stored content within the application; and Quarantine, which allows Netskope to isolate policy-violating files by moving them to a designated quarantine location. A Forensic instance type is used for storing copies of policy-violating files for investigation and is not one of the API instance configuration types. The API Data Protection label is a broader category descriptor, not an instance type used during the configuration of individual SaaS application integrations.

In Netskope's Advanced Analytics, merged reports combine data from two separate data sets using a join operation. However, visualizations within the platform are subject to a system-imposed rendering limit of
5,000 rows. When Report A contains 3,000 rows and Report B contains 6,000 rows, the merged output would theoretically contain up to 9,000 rows; however, only 5,000 rows will be displayed in the visualization. This is not a deduplication behavior or a viewing restriction but a hard system limit on how many rows a visualization tile can render at one time. Understanding this limit is critical when designing Advanced Analytics reports intended to surface large DLP incident data sets, as significant data may be silently truncated without a clearly visible warning to the administrator.

When configuring a DLP policy for AWS S3 bucket scanning through Netskope's API-enabled Protection, the available policy actions are determined by the capabilities supported for that specific API integration and data plane context. For AWS S3, the supported DLP policy actions are Alert and Quarantine. Alert generates an incident and notifies the security team without modifying the object, while Quarantine moves the policy- violating file to a designated quarantine location within the S3 environment. Block and User Notification are not supported actions within the API-enabled Protection workflow for S3 buckets, as these actions are designed for inline Real-time Protection policies where the user is actively interacting with content in real time, not for asynchronous API-based scans.

When using Explicit Proxy over Tunnel (EPoT) as the Netskope steering method, the Netskope Client establishes a tunnel to the Netskope cloud and forwards proxy traffic through it. If specific domains need to be excluded from this steering such as internal applications or trusted third-party services, the correct approach is to define exception domains directly in the PAC (Proxy Auto-Configuration) file. The PAC file logic can route traffic for excluded domains to DIRECT, bypassing the Netskope proxy, while all other traffic is directed through the EPoT tunnel. Steering exceptions in the Netskope tenant UI apply to client-based steering but do not control PAC file behavior. Real-time Protection bypass actions and SSL decryption policies operate after traffic has already been steered to Netskope and cannot intercept traffic before it enters the tunnel.

When IPsec tunnels are used to steer HTTPS traffic from end-user devices to Netskope, the Netskope platform performs SSL inspection as part of its inline proxy function. This requires that the Netskope root and intermediate SSL certificates be trusted by the endpoint devices connecting through the tunnel. When these certificates are not installed in the device's trusted certificate store, the SSL inspection process causes certificate errors, rendering the inspected applications non-functional. Installing the Netskope certificate chain on the affected devices resolves this issue by allowing the device to trust the Netskope-generated certificates presented during SSL decryption. This is a standard requirement for any transparent SSL proxy deployment and is explicitly documented in Netskope's certificate management guidance.