---
title: Zscaler Internet Access admin or role account created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Zscaler Internet Access admin or role
  account created
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Zscaler Internet Access admin or role account created
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1136-create-account](https://attack.mitre.org/techniques/T1136) 
## Goal{% #goal %}

Detects successful creation of admin user accounts or roles in Zscaler Internet Access (ZIA). Alerts when any administrator successfully creates a new account or role in the ZIA console.

## Strategy{% #strategy %}

This rule monitors ZIA audit logs for OCSF Account Change events (`@ocsf.class_uid` is `3001`) where the activity is a create operation (`@ocsf.activity_id` is `1`) and the result is successful (`@ocsf.status_id` is `1`). Admin account and role creation are high-privilege operations within ZIA that grant access to network security controls and policy management. Because any successful creation warrants analyst review, the rule alerts on the first matching event per administrator within the 24-hour evaluation window (additional events by the same administrator within that window are grouped into the same signal). The creating administrator is captured in `@ocsf.actor.user.name` and the created entity in `@ocsf.user.name`.

## Triage and Response{% #triage-and-response %}

- Verify whether `{{@ocsf.actor.user.name}}` is authorized to create new admin accounts or roles in ZIA and whether this action was expected.
- Review the identity and role of the newly created account or role (`{{@ocsf.user.name}}`) to determine the level of privilege granted.
- Check recent activity from `{{@ocsf.actor.user.name}}` in ZIA audit logs to identify any other privileged actions taken around the same time.
- Determine if a change management ticket or onboarding request exists that corresponds to this account creation.
- Examine whether the created account has been used since creation and from which IP addresses or locations.