Zscaler#
README
Zscaler#
General requirements#
You will need to have an active Zscaler ZIA subscription to be able to utilize this analyzer. For reference, you may use this supporting documentation in case of issues with the API: Getting started with ZIA API.
ZscalerZIA_URLLookup configuration#
The analyzer supports two authentication modes, set via auth_type.
OneAPI (recommended, auth_type: oneapi)
- In the ZIdentity Admin Portal, create an API Client and assign it the ZIA API role.
- Please make sure you have a correct role matching your needs, you may need to create a ZIA API role (see https://help.zscaler.com/zia/adding-api-roles for help) with, at the very least, view-only for URL Categories.
- Configure in Cortex:
zia_vanity_domain: only the short label before.zslogin.net. If your org's login page iscompanyname.zslogin.net, this value iscompanyname— notcompanyname.zslogin.netand not the full URL.zia_client_id/zia_client_secret: from the API Client created above.zia_cloud: leave blank for standard/production tenants.
If you get 401 invalid_client please, make sure to review step 2.
Legacy (auth_type: legacy)
Requires zia_username, zia_password, zia_api_key, and zia_cloud (your ZIA cloud name, it may be zscaler, zscalerone, zscalertwo).
Zscaler#
Author: Simon Lavigne, Mikael Keri
License: AGPL-V3
Version: 1.3
Supported observables types:
- ip
- domain
- url
- fqdn
Registration required: True
Subscription required: True
Free subscription: False
Third party service: https://www.zscaler.com/
Description#
Check Zscaler category for a domain, fqdn, IP address or FQDN. This analyzer requires a paid subscription to Zscaler ZIA
Configuration#
| username | Zscaler username |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| password | Zscaler password |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| api_key | API key |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| base_uri | The base URL of your Zscaler subscription. Example: https://zsapi.zscalertwo.net |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | True |
| malicious_categories | List of Zscaler categories to be considered as malicious |
|---|---|
| Default value if not configured | ['PHISHING', 'MALWARE_SITE', 'BOTNET', 'SPYWARE_OR_ADWARE', 'ADSPYWARE_SITES', 'ADWARE_OR_SPYWARE', 'CRYPTOMINING', 'WEB_SPAM', 'MALICIOUS_TLD'] |
| Type of the configuration item | string |
| The configuration item can contain multiple values | True |
| Is required | True |
| suspicious_categories | List of Zscaler categories to be considered as suspicious |
|---|---|
| Default value if not configured | ['SHAREWARE_DOWNLOAD', 'REMOTE_ACCESS', 'MISCELLANEOUS_OR_UNKNOWN', 'NEWLY_REG_DOMAINS', 'OTHER_ILLEGAL_OR_QUESTIONABLE', 'COPYRIGHT_INFRINGEMENT', 'GAMBLING', 'COMPUTER_HACKING', 'ANONYMIZER', 'MISCELLANEOUS_OR_UNKNOWN', 'DNS_OVER_HTTPS', 'ENCR_WEB_CONTENT'] |
| Type of the configuration item | string |
| The configuration item can contain multiple values | True |
| Is required | True |
Templates samples for TheHive#
ZscalerZIA_URLLookup#
Author: Fabien Bloume, StrangeBee
License: AGPL-V3
Version: 1.0
Supported observables types:
- domain
- fqdn
- url
- ip
Registration required: True
Subscription required: True
Free subscription: False
Third party service: https://www.zscaler.com/products/zscaler-internet-access
Description#
Query Zscaler Internet Access for URL categorization and security classification. Supports OneAPI OAuth2 and legacy authentication.
Configuration#
| auth_type | Authentication type: 'oneapi' for ZIdentity OAuth2 (default) or 'legacy' for legacy API credentials |
|---|---|
| Default value if not configured | oneapi |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_vanity_domain | [OneAPI only] Zscaler ZIdentity vanity domain for your organization (eg, 'acme' from acme.zslogin.net) |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_client_id | [OneAPI only] Zscaler OneAPI OAuth Client ID created in ZIdentity Admin Portal |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_client_secret | [OneAPI only] Zscaler OneAPI OAuth Client Secret from ZIdentity Admin Portal |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_username | [Legacy only] ZIA API admin email address |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_password | [Legacy only] ZIA API admin password |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_api_key | [Legacy only] ZIA API key (obfuscated API key) |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| zia_cloud | Cloud environment name. Required for legacy auth (eg, 'zscaler', 'zscalerone', 'zscalertwo'). Optional for OneAPI (use for beta/alpha environments). |
|---|---|
| Default value if not configured | N/A |
| Type of the configuration item | string |
| The configuration item can contain multiple values | False |
| Is required | False |
| malicious_categories | List of Zscaler categories to be considered as malicious |
|---|---|
| Default value if not configured | ['PHISHING', 'MALWARE_SITE', 'BOTNET', 'SPYWARE_OR_ADWARE', 'ADSPYWARE_SITES', 'ADWARE_OR_SPYWARE', 'CRYPTOMINING', 'WEB_SPAM', 'MALICIOUS_TLD', 'MALICIOUS_SITES', 'COMMAND_AND_CONTROL'] |
| Type of the configuration item | string |
| The configuration item can contain multiple values | True |
| Is required | False |
| suspicious_categories | List of Zscaler categories to be considered as suspicious |
|---|---|
| Default value if not configured | ['SHAREWARE_DOWNLOAD', 'REMOTE_ACCESS', 'MISCELLANEOUS_OR_UNKNOWN', 'NEWLY_REG_DOMAINS', 'OTHER_ILLEGAL_OR_QUESTIONABLE', 'COPYRIGHT_INFRINGEMENT', 'GAMBLING', 'COMPUTER_HACKING', 'ANONYMIZER', 'DNS_OVER_HTTPS', 'ENCR_WEB_CONTENT', 'PROXY_AVOIDANCE', 'SUSPICIOUS'] |
| Type of the configuration item | string |
| The configuration item can contain multiple values | True |
| Is required | False |
Templates samples for TheHive#
No template samples to display.