ZscalerZIdentity

This integration uses ZIdentity OAuth 2.0 client credentials to authenticate with Zscaler Internet Access (ZIA). It enables the management of denylists, allowlists, URL categories, IP destination groups, and users/groups, while also providing URL, IP, and domain classifications and sandbox reporting..

Configure Zscaler Internet Access via ZIdentity in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

zia-denylist-list

Gets a list of URLs and IPs that are in the denylist.

Base Command

zia-denylist-list

Input

Context Output

Command Example

!zia-denylist-list filter=url limit=10

Human Readable Output

Denylist

URL
malware.com
phishing.net

zia-denylist-update

Updates the list of URLs in the denylist.

Base Command

zia-denylist-update

Input

Context Output

There is no context output for this command.

Command Example

!zia-denylist-update url=malware.com,phishing.net action=ADD_TO_LIST

Human Readable Output

Denylist updated successfully.

zia-allowlist-list

Gets a list of URLs and IPs that are in the allowlist.

Base Command

zia-allowlist-list

Input

Context Output

Command Example

!zia-allowlist-list filter=url limit=10

Human Readable Output

Allowlist

URL
trusted.com
safe.net

zia-allowlist-update

Updates the list of URLs in the allowlist.

Base Command

zia-allowlist-update

Input

Context Output

There is no context output for this command.

Command Example

!zia-allowlist-update url=trusted.com action=ADD_TO_LIST

Human Readable Output

Allowlist updated successfully.

zia-category-list

Gets information about all or custom URL categories. By default, the response includes keywords. The lite option cannot be used in combination with other parameters.

Base Command

zia-category-list

Input

Context Output

Command Example

!zia-category-list custom_only=true

Context Example

{
    "ZIA": {
        "Category": [
            {
                "id": "CUSTOM_01",
                "configuredName": "My Custom Category",
                "superCategory": "USER_DEFINED",
                "keywords": ["example"],
                "urls": ["example.com"],
                "customCategory": true
            }
        ]
    }
}

Human Readable Output

URL Categories

ID	Configured Name	Super Category	Custom Category
CUSTOM_01	My Custom Category	USER_DEFINED	true

zia-category-update

Updates the URL category for the specified ID.

Base Command

zia-category-update

Input

Context Output

There is no context output for this command.

Command Example

!zia-category-update category_id=CUSTOM_01 url=pandora.com,spotify.com action=ADD_TO_LIST

Human Readable Output

Category CUSTOM_01 updated successfully.

zia-url-quota-get

Gets information on the number of unique URLs that are currently provisioned for your organization as well as how many URLs you can add before reaching that number.

Base Command

zia-url-quota-get

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "ZIA": {
        "UrlQuota": {
            "uniqueUrlsProvisioned": 25000,
            "remainingUrlsQuota": 24850
        }
    }
}

Human Readable Output

URL Quota

Unique URLs Provisioned	Remaining URLs Quota
25000	24850

zia-ip-destination-group-list

Gets a list of all IP destination groups or for the specified ID.

Base Command

zia-ip-destination-group-list

Input

Context Output

Command Example

!zia-ip-destination-group-list limit=5

Context Example

{
    "ZIA": {
        "IPDestinationGroup": [
            {
                "id": 1234,
                "name": "My IP Group",
                "type": "DSTN_IP",
                "addresses": ["8.8.8.8", "1.1.1.1"],
                "description": "DNS servers",
                "countries": [],
                "ipCategories": []
            }
        ]
    }
}

Human Readable Output

IP Destination Groups

ID	Name	Type	Addresses	Description
1234	My IP Group	DSTN_IP	8.8.8.8, 1.1.1.1	DNS servers

zia-ip-destination-group-update

Updates an existing IP destination group.

Base Command

zia-ip-destination-group-update

Input

Context Output

Command Example

!zia-ip-destination-group-update group_id=1234 address=9.9.9.9 action=ADD_TO_LIST

Human Readable Output

IP destination group 1234 updated successfully.

zia-ip-destination-group-add

Adds a new IP destination group.

Base Command

zia-ip-destination-group-add

Input

Context Output

Command Example

!zia-ip-destination-group-add group_name="New Group" group_type=DSTN_IP address=10.0.0.1

Context Example

{
    "ZIA": {
        "IPDestinationGroup": {
            "id": 5678,
            "name": "New Group",
            "type": "DSTN_IP",
            "addresses": ["10.0.0.1"],
            "description": "",
            "countries": [],
            "ipCategories": []
        }
    }
}

Human Readable Output

IP destination group created successfully with ID 5678.

zia-ip-destination-group-delete

Deletes the IP destination group for the specified ID.

Base Command

zia-ip-destination-group-delete

Input

Context Output

There is no context output for this command.

Command Example

!zia-ip-destination-group-delete group_id=5678

Human Readable Output

IP destination group 5678 deleted successfully.

zia-user-list

Gets a list of all users or the user information for the specified ID.

Base Command

zia-user-list

Input

Context Output

Command Example

!zia-user-list dept="Engineering" page_size=50

Context Example

{
    "ZIA": {
        "User": [
            {
                "id": 100,
                "name": "John Doe",
                "email": "john.doe@example.com",
                "comments": "Engineering team member"
            }
        ]
    }
}

Human Readable Output

Users

ID	Name	Email	Comments
100	John Doe	john.doe@example.com	Engineering team member

zia-user-update

Updates the user information for the specified ID.

Base Command

zia-user-update

Input

Context Output

Command Example

!zia-user-update user_id=100 comments="Updated comment"

Human Readable Output

User 100 updated successfully.

zia-groups-list

Gets a list of groups.

Base Command

zia-groups-list

Input

Context Output

Command Example

!zia-groups-list search="Engineering" sort_by=name sort_order=asc

Context Example

{
    "ZIA": {
        "Groups": [
            {
                "id": 200,
                "name": "Engineering",
                "idpId": 1,
                "comments": "Engineering department group",
                "isSystemDefined": false
            }
        ]
    }
}

Human Readable Output

Groups

ID	Name	IdP ID	Comments	System Defined
200	Engineering	1	Engineering department group	false

zia-departments-list

Gets a list of all departments or the department information for the specified ID.

Base Command

zia-departments-list

Input

Context Output

Command Example

!zia-departments-list search="Engineering"

Context Example

{
    "ZIA": {
        "Department": [
            {
                "id": 300,
                "name": "Engineering",
                "idpId": 1,
                "comments": "Engineering department",
                "deleted": false
            }
        ]
    }
}

Human Readable Output

Departments

ID	Name	IdP ID	Comments	Deleted
300	Engineering	1	Engineering department	false

zia-sandbox-report-get

Gets a full or summary detail report for an MD5 hash of a file that was analyzed by Sandbox.

Base Command

zia-sandbox-report-get

Input

Context Output

Command Example

!zia-sandbox-report-get md5=9de5069c5afe602b2ea0a04b66beb2c0 report_type=summary

Context Example

{
    "DBotScore": {
        "Indicator": "9de5069c5afe602b2ea0a04b66beb2c0",
        "Score": 3,
        "Type": "file",
        "Vendor": "Zscaler"
    },
    "File": {
        "MD5": "9de5069c5afe602b2ea0a04b66beb2c0",
        "FileType": "PE32",
        "Malicious": {
            "Vendor": "Zscaler",
            "Description": "Malware detected"
        }
    },
    "ZIA": {
        "SandboxReport": {
            "Summary": {
                "Status": "MALICIOUS",
                "Category": "Malware"
            }
        }
    }
}

Human Readable Output

Sandbox Report for 9de5069c5afe602b2ea0a04b66beb2c0

Status	Category	File Type	Score
MALICIOUS	Malware	PE32	3

zia-activate-changes

Activates the saved configuration changes.

Base Command

zia-activate-changes

Input

There are no input arguments for this command.

Context Output

Command Example

#### Context Example

```json
{
    "ZIA": {
        "ActivationStatus": {
            "status": "ACTIVE"
        }
    }
}

Human Readable Output

Activation Status

Status
ACTIVE

url

Retrieve Zscaler’s default classification for a given set of URLs.

Base Command

url

Input

Context Output

Command Example

!url url=facebook.com

Context Example

{
    "DBotScore": [
        {
            "Indicator": "facebook.com",
            "Score": 1,
            "Type": "url",
            "Vendor": "Zscaler",
            "Reliability": "C - Fairly reliable"
        }
    ],
    "URL": {
        "Address": "facebook.com",
        "Data": "facebook.com"
    },
    "ZIA": {
        "URL": {
            "Address": "facebook.com",
            "Data": "facebook.com",
            "urlClassifications": "SOCIAL_NETWORKING",
            "urlClassificationsWithSecurityAlert": []
        }
    }
}

Human Readable Output

Zscaler URL Lookup

URL	Classifications	Security Alert Classifications
facebook.com	SOCIAL_NETWORKING

ip

Retrieve the classification for each of the specified IP addresses.

Base Command

ip

Input

Context Output

Command Example

!ip ip=8.8.8.8

Context Example

{
    "DBotScore": [
        {
            "Indicator": "8.8.8.8",
            "Score": 1,
            "Type": "ip",
            "Vendor": "Zscaler",
            "Reliability": "C - Fairly reliable"
        }
    ],
    "IP": {
        "Address": "8.8.8.8"
    },
    "ZIA": {
        "IP": {
            "Address": "8.8.8.8",
            "Classifications": "WEB_SEARCH",
            "ClassificationsWithSecurityAlert": []
        }
    }
}

Human Readable Output

Zscaler IP Lookup

IP	Classifications	Security Alert Classifications
8.8.8.8	WEB_SEARCH

domain

Retrieve Zscaler’s default classification for a given set of domains.

Base Command

domain

Input

Context Output

Command Example

!domain domain=google.com

Context Example

{
    "DBotScore": [
        {
            "Indicator": "google.com",
            "Score": 1,
            "Type": "domain",
            "Vendor": "Zscaler",
            "Reliability": "C - Fairly reliable"
        }
    ],
    "Domain": {
        "Name": "google.com"
    },
    "ZIA": {
        "Domain": {
            "Data": "google.com",
            "Address": "google.com",
            "Classifications": "WEB_SEARCH",
            "ClassificationsWithSecurityAlert": []
        }
    }
}

Human Readable Output

Zscaler Domain Lookup

Domain	Classifications	Security Alert Classifications
google.com	WEB_SEARCH