Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects web traffic classified as a threat by Zscaler Internet Access (ZIA) that was permitted through rather than blocked. A signal fires when @ocsf.severity_id indicates Low, Medium, High, or Critical severity and @ocsf.status_id confirms the request was allowed.

Strategy

This rule monitors Zscaler NSS web proxy logs for HTTP Activity events (@ocsf.class_uid:4002) when the ZIA threat engine assigned a non-informational severity (@ocsf.severity_id from 2 to 5) but ultimately allowed the request (@ocsf.status_id:1). Allowed, threat-flagged traffic represents the highest-risk outcome in ZIA. The proxy identified a threat indicator, such as a malware download, command-and-control (C2) communication, phishing URL, or other malicious pattern, but did not enforce a block. The @ocsf.message field captures the specific threat reason from Zscaler, and signals are grouped by @usr.id to show exposure by user. Severity tiers map directly from ZIA’s classification: @ocsf.severity_id:5 is Critical, 4 is High, 3 is Medium, and 2 is Low.

Triage and Response

• Review {{@ocsf.message}} to identify the threat category that ZIA detected and determine why the traffic was allowed rather than blocked, such as a policy exception, misconfiguration, or expected behavior.
• Examine the destination URL and host associated with the flagged request to determine whether either matches known malicious infrastructure, C2 frameworks, or phishing domains.
• Identify whether {{@usr.id}} has a history of triggering threat detections or accessing high-risk categories, and determine if the activity was intentional or the result of a drive-by or redirect.
• Check for additional ZIA events from the same user around the same time to assess whether this is an isolated hit or part of a broader pattern of threat-flagged traffic being allowed.
• Determine whether the ZIA policy that permitted the traffic is intentional, for example, a security research allowlist, or represents a gap that should be remediated.