---
title: Zscaler Internet Access firewall threat match on network activity
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Zscaler Internet Access firewall threat
  match on network activity
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Zscaler Internet Access firewall threat match on network activity
Classification:attackTactic:[TA0011-command-and-control](https://attack.mitre.org/tactics/TA0011)Technique:[T1071-application-layer-protocol](https://attack.mitre.org/techniques/T1071) 
## Goal{% #goal %}

Detects when Zscaler Internet Access (ZIA) Firewall's threat engine identifies a threat on a network flow, regardless of whether the traffic was blocked or allowed through.

## Strategy{% #strategy %}

This rule monitors Zscaler firewall events normalized to the OCSF Network Activity class (`@ocsf.class_uid:4001`) where `@ocsf.severity_id` falls between `2` (Low) and `5` (Critical), excluding `1` (Informational). The `@ocsf.severity_id` field is populated from the ZIA `threatseverity` attribute by the OCSF normalization pipeline, meaning any match indicates the ZIA threat engine actively classified the flow as a threat. Both allowed and blocked outcomes are intentionally captured: a blocked flow confirms the threat was stopped, while an allowed flow indicates potentially malicious traffic reached its destination. The signal is attributed to the originating user via `@ocsf.src_endpoint.owner.name`, which maps from the `zscaler.login` field, enabling rapid user-centric investigation.

## Triage & Response{% #triage--response %}

- Examine the `{{@ocsf.src_endpoint.owner.name}}` user's recent firewall activity to determine whether this is an isolated event or part of a pattern of threat-classified flows.
- Review `@ocsf.status_id` on the triggering log to determine if the traffic was blocked or allowed — an allowed high- or critical-severity event warrants immediate escalation.
- Identify the destination IP and domain associated with the flow and check whether it is a known malicious indicator, C2 infrastructure, or an unexpected external endpoint.
- Check whether `{{@ocsf.src_endpoint.owner.name}}` recently received a phishing email, visited an untrusted site, or ran an unrecognized process that may have initiated the outbound connection.
- Determine whether other users in the organization triggered similar ZIA firewall threat events around the same time, which may indicate a campaign or widespread compromise.
- Review endpoint telemetry for the source host to identify processes initiating the network connection and assess whether the host shows signs of compromise.