---
title: Zscaler Internet Access admin or role account deleted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Zscaler Internet Access admin or role
  account deleted
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Zscaler Internet Access admin or role account deleted
Classification:attackTactic:[TA0040-impact](https://attack.mitre.org/tactics/TA0040)Technique:[T1531-account-access-removal](https://attack.mitre.org/techniques/T1531) 
## Goal{% #goal %}

Detects successful deletion of admin user accounts or roles in Zscaler Internet Access (ZIA). Alerts when any administrator successfully deletes an existing account or role in the ZIA console.

## Strategy{% #strategy %}

This rule monitors ZIA audit logs for OCSF Account Change events (`@ocsf.class_uid` is `3001`) where the activity is a delete operation (`@ocsf.activity_id` is `6`) and the result is successful (`@ocsf.status_id` is `1`). Removing an admin account or role is a high-impact operation that can be used by an attacker to cover their tracks, remove a competing admin's access, or disable another responder's ability to intervene during an incident. Because any successful deletion warrants analyst review, the rule alerts on the first matching event per administrator within the 24-hour evaluation window (additional events by the same administrator within that window are grouped into the same signal). The administrator performing the deletion is captured in `@ocsf.actor.user.name` and the deleted entity in `@ocsf.user.name`.

## Triage and Response{% #triage-and-response %}

- Verify whether `{{@ocsf.actor.user.name}}` is authorized to delete admin accounts or roles in ZIA and whether this action was expected.
- Review the identity and role of the deleted account or role (`{{@ocsf.user.name}}`) to determine what level of access was removed and who it belonged to.
- Check recent activity from `{{@ocsf.actor.user.name}}` in ZIA audit logs to identify any other privileged actions taken around the same time, such as other account changes or policy modifications.
- Determine if a change management ticket or offboarding request exists that corresponds to this deletion.
- Confirm with the owner of the deleted account (if known) that the removal was expected, especially if it occurred outside a routine offboarding process.
- If the deleted account belonged to another administrator, verify that responder was not deliberately locked out during an active incident.