Brazil, Australia, Zurich, Yokohama
Integration
The Security Incident Response integration with Zscaler enables the Security Analysts to do the following:
- Perform a reputation lookup of observables against the global threat library maintained by Zscaler.
- Add or remove observables from the block list or allow list on Zscaler.
- Retrieve and review sandbox reports from Zscaler for an MD5 hash.
In addition, this integration also supports creating a security incident from Patient 0 alerts that are generated in Zscaler when a user downloads an unknown malicious file.
- Threat Lookup:
- The analyst will be able to trigger reputation lookups on URL/IP/Domain.
- Deny/Allow URLs/IPs/Domain:
- The analyst will be able to add URLs/IPs/Domain to the tenant-specific DenyList/AllowList or other URL categories.
- Supports periodic removal of entries from the list based on expiration value.
- Supports an approval workflow.
- Sandbox Report Lookup:
- The analyst will be able to look up the Sandbox report of the MD5 hash and store it against the incident.
- Create Security Incidents out of Patient 0 alerts:
- Support for the ingestion of patient 0 alerts and creating security incidents out of them.
Fixed: The Zscaler integration now supports OAuth 2.0 client-credentials authentication in addition to basic authentication with an API key. Select the authentication method that matches your Zscaler tenant, and switch between methods as needed. All existing integration capabilities work with either method.
Not applicable for this application version. For more information, please see
Application Runtime Policy
- Required plugins and products
- Dependencies
- Properties that need to be created or set to activate the content pack
- Affected business rules
- Affected script includes
- .jar files that need to be uploaded, if applicable