Skip to main content

Whitelisting Arsen in Netskope

Allow-listing Arsen prevents Netskope from blocking or inspecting the links and pages of Arsen simulations, which skews campaign results.

1 - Objectives

  • Recognize when Netskope interferes with campaigns

  • Exempt the Arsen domains in the relevant Netskope areas

  • Test the configuration

2 - Prerequisites

  • Administrator access to the Netskope console.

  • The list of active Arsen phishing domains.

  • The menus below follow the Netskope documentation and may vary by tenant version. If a setting is missing, contact Netskope support or your security administrator.

3 - Typical symptom

The simulation landing page is blocked or inspected by Netskope, or a click is recorded without any realistic user interaction.
​

Netskope acts on users' web traffic (client or proxy), not on email reception. It is therefore the Arsen domains you need to exempt, not the sending IP addresses.
​
Depending on the modules enabled, confirm with the customer which module is involved.
​

4 - Export the full list of Arsen domains

  1. Open Arsen phishing domains.

  2. Click export.

  3. Add every active domain to the URL list in section 6.

5 - Netskope areas to check

A single exemption is often not enough. Check each area.

Area

Netskope menu

What to enter

Custom URL list

Policies > Web > URL Lists

Arsen domains

Steering exception

Settings > Cloud Security Platform > Steering Configuration > Exceptions

Arsen URL list

Real-time Protection policies

Policies > Real-time Protection

Arsen URL list as an exclusion

SSL decryption

Policies > SSL Decryption

Arsen URL list (Do Not Decrypt)

6 - Create a custom URL list

URL lists apply to Real-time Protection policies, SSL decryption policies and steering exceptions. A wildcard domain (*.example.com) covers the root domain and all its subdomains.

  1. Open Policies > Web > URL Lists.

  2. Click New URL List and name the list, for example Arsen_Phishing_Domains.

  3. In URL & IP Address, enter each active Arsen domain as *.domain.com.

  4. Click Save URL List, then Apply Changes.

7 - Create a steering exception

Use this if the URL list alone is not enough. Traffic to these domains is then no longer sent to Netskope.

  1. Open Settings > Cloud Security Platform > Steering Configuration.

  2. Select the applicable steering configuration (for example the default tenant configuration).

  3. Open the Exceptions tab, then click New Exception.

  4. Add the Arsen URL list (domain-based exception).

  5. Click Save, then Apply Changes. The Netskope client picks up the configuration at its next check-in, roughly every 15 minutes.

8 - Check Real-time Protection policies

A policy can block or inspect Arsen domains based on their category (for example phishing or uncategorized).

  1. Open Policies > Real-time Protection and find the Web Access policies that apply to the affected users.

  2. If a policy targets a category that covers the Arsen domains, add the Arsen URL list to the URL list (Excluded) field of the custom category used.

  3. Click Save, then Apply Changes.

9 - Avoid SSL inspection of Arsen domains

If the goal is only to avoid SSL decryption, Netskope recommends a Do Not Decrypt policy rather than a steering exception.

  1. Open Policies > SSL Decryption and click Add Policy.

  2. Select the Arsen URL list as the criterion, with the Do Not Decrypt action.

  3. Click Save, then Apply Changes.

10 - Test your configuration

  1. Create a campaign for 1 or 2 internal test users.

  2. Send the campaign and click the link from a workstation protected by Netskope.

  3. Check that the landing page displays without a block page.

  4. In Arsen, check that no click is recorded before the user acts.

11 - If automatic clicks persist

  1. Check that the exact phishing domain of the campaign is in the URL list, and that Apply Changes was confirmed.

  2. Wait about 15 minutes for the Netskope client to pick up the new configuration, then test again.

  3. Check the other security layers, for example Microsoft Safe Links and the Advanced Delivery Policy.

  4. Note the source IP and user agent of the clicks in Arsen: a Netskope or Microsoft IP identifies the tool responsible.

12 - What to share with Arsen support if the problem continues

  • The Netskope modules in use (client, proxy, others).

  • The name of the affected campaign and test recipient.

  • The exact phishing domain used in the campaign.

  • Screenshots of the URL list, steering exceptions and policies configured.

  • The Netskope events related to the Arsen domain.

  • Confirmation of whether the page was blocked.

Related Articles
Did this answer your question?