Skip to main content

Cyware Threat Intelligence eXchange

Zscaler

Connector Category: Network Security

About Zscaler

Zscaler is a comprehensive network security and threat intelligence solution that is seamlessly integrated as an internal application in Intel Exchange (CTIX). This integration enables users to easily add URL objects of the Intel Exchange platform to the Zscaler allowlist and denylist. This empowers the threat intelligence teams to promptly take action against threats in real-time on the Zscaler application.

  • Allowlist: URLs of the allowlist are exempted from security scans, URL filtering, or both.

  • Denylist: URLs of the allowlist are blocked to protect traffic from fraud, unauthorized communication, and other malicious objects and scripts.

The Zscaler internal application in Intel Exchange supports the following actions:

Action Name

Description

Update Zscaler Denylist Url

This action updates the denylist of the Zscaler application with the URLs retrieved from Intel Exchange.

Update Zscaler Allowlist Url

This action updates the allowlist of the Zscaler application with the URLs retrieved from Intel Exchange.

Configure Zscaler as an Internal Application

Configure Zscaler as an internal application to update URLs to Zscaler allowlist and denylist as required.

Before you Start 

  • You must have the base URL, username, password, and API key of your Zscaler account.

  • You must have the view and update tool integration permissions in Intel Exchange.

Steps 

  1. Go to Administration > Integration Management > Tool Integrations > Internal Applications > Network Security.

  2. Search and select the Zscaler app.

  3. Click Add Instance and enter the following details:

    • Instance Name: Enter a unique instance name to identify. For example, prod_instance.

    • Base URL: Enter the base URL of your Zscaler instance. For example, https://admin.zscalerbeta.net/api/v1.

    • Username: Enter the username for your Zscaler account.

    • Password: Enter the password for your Zscaler account.

    • API Key: Enter the API key of your Zscaler account.

    • Verify SSL: Enable this option to verify the SSL certificate and secure the connection between the Intel Exchange and Zscaler servers. By default, Verify SSL is selected.

      Note

      We recommend you to enable Verify SSL. If you disable this option, Intel Exchange may configure an instance for an expired SSL certificate. This may not establish the connection properly and Intel Exchange will not be able to notify you in case of a broken or improper connection.

  4. Click Save.

The Zscaler instance is configured and you can view the actions provided by the Zscaler tool. You can configure multiple instances of this integration by clicking Manage > Add More.

Enable App Actions

After configuring the Zscaler application, enable the actions to update the allowlist and denylist on Zscaler.

To enable an action of the Zscaler internal application, follow these steps:

  1. Go to Administration > Integration Management > Tool Integrations > Internal Applications and select Network Security.

  2. Search and select Zscaler.

  3. On the upper-right corner, click the vertical ellipsis and click Manage.

  4. Click Manage Actions.

  5. Select the actions and turn on the toggles to enable.

  6. Click Save.

The actions are enabled and are now ready to use.

Create a Rule to Update URLs to Allowlist in Zscaler

Create a rule to upload specific URLs from Intel Exchange to the Zscaler application.

Before you Start 

You must have the View Rules, Create Rules, and Update Rules permissions.

Steps 

To create a rule to upload indicators to the Zscaler application, do the following:

  1. Go to Main Menu > Actions > Rules.

  2. Click New Rule.

  3. Enter a rule name within 100 characters and click Submit.

  4. In Source, select the sources and collections to retrieve URLs.

  5. In Condition, enter the following details:

    1. Intent Type: Select the intent type as Indicator.

    2. Rule Type: Select a rule type to apply specific conditions.

  6. In Actions, enter the following details:

    1. Actions: Select Update Zscaler Allowlist Url.

    2. Application: Select Zscaler Network Security.

    3. Account: Select a Zscaler instance you have configured.

    4. Operation: Select Add to add URLs to the allowlist. Select Remove to remove URLs from the allowlist.

  7. Set the global conditions from Additional Actions. For more information, see Additional Actions for Rules.

  8. Click Save.

The rule is created and the URLs will be updated to the Zscaler Allowlist based on the configured sources and conditions when you run the rule.

Create a Rule to Update URLs to Denylist in Zscaler

Create a rule to upload specific URLs from Intel Exchange to the Zscaler application.

Before you Start 

You must have the View Rules, Create Rules, and Update Rules permissions.

Steps 

To create a rule to upload indicators to the Zscaler application, do the following:

  1. Go to Main Menu > Actions > Rules.

  2. Click New Rule.

  3. Enter a rule name within 100 characters and click Submit.

  4. In Source, select the source and collection from which you want to upload indicators.

  5. In Condition, enter the following details:

    1. Intent Type: Select the intent type as Indicator.

    2. Rule Type: Select a rule type to apply specific conditions.

  6. In Actions, enter the following details:

    1. Actions: Select Update Zscaler Denylist Url.

    2. Application: Select Zscaler Network Security.

    3. Account: Select a Zscaler instance you have configured.

    4. Operation: Select Add to add URLs to the denylist. Select Remove to remove URLs from the denylist.

  7. Set the global conditions from Additional Actions. For more information, see Additional Actions for Rules.

  8. Click Save.

The rule is created and the URLs will be updated to the Zscaler Denylist based on the configured sources and conditions when you run the rule.