Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when Zscaler Internet Access (ZIA) Firewall’s threat engine identifies a threat on a network flow, regardless of whether the traffic was blocked or allowed through.

Strategy

This rule monitors Zscaler firewall events normalized to the OCSF Network Activity class (@ocsf.class_uid:4001) where @ocsf.severity_id falls between 2 (Low) and 5 (Critical), excluding 1 (Informational). The @ocsf.severity_id field is populated from the ZIA threatseverity attribute by the OCSF normalization pipeline, meaning any match indicates the ZIA threat engine actively classified the flow as a threat. Both allowed and blocked outcomes are intentionally captured: a blocked flow confirms the threat was stopped, while an allowed flow indicates potentially malicious traffic reached its destination. The signal is attributed to the originating user via @ocsf.src_endpoint.owner.name, which maps from the zscaler.login field, enabling rapid user-centric investigation.

Triage & Response

• Examine the {{@ocsf.src_endpoint.owner.name}} user’s recent firewall activity to determine whether this is an isolated event or part of a pattern of threat-classified flows.
• Review @ocsf.status_id on the triggering log to determine if the traffic was blocked or allowed — an allowed high- or critical-severity event warrants immediate escalation.
• Identify the destination IP and domain associated with the flow and check whether it is a known malicious indicator, C2 infrastructure, or an unexpected external endpoint.
• Check whether {{@ocsf.src_endpoint.owner.name}} recently received a phishing email, visited an untrusted site, or ran an unrecognized process that may have initiated the outbound connection.
• Determine whether other users in the organization triggered similar ZIA firewall threat events around the same time, which may indicate a campaign or widespread compromise.
• Review endpoint telemetry for the source host to identify processes initiating the network connection and assess whether the host shows signs of compromise.