---
title: Zscaler Internet Access web threat-flagged traffic allowed through
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Zscaler Internet Access web
  threat-flagged traffic allowed through
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Zscaler Internet Access web threat-flagged traffic allowed through
Classification:attackTactic:[TA0011-command-and-control](https://attack.mitre.org/tactics/TA0011)Technique:[T1071-application-layer-protocol](https://attack.mitre.org/techniques/T1071) 
## Goal{% #goal %}

Detects web traffic classified as a threat by Zscaler Internet Access (ZIA) that was permitted through rather than blocked. A signal fires when `@ocsf.severity_id` indicates Low, Medium, High, or Critical severity and `@ocsf.status_id` confirms the request was allowed.

## Strategy{% #strategy %}

This rule monitors Zscaler NSS web proxy logs for HTTP Activity events (`@ocsf.class_uid:4002`) when the ZIA threat engine assigned a non-informational severity (`@ocsf.severity_id` from `2` to `5`) but ultimately allowed the request (`@ocsf.status_id:1`). Allowed, threat-flagged traffic represents the highest-risk outcome in ZIA. The proxy identified a threat indicator, such as a malware download, command-and-control (C2) communication, phishing URL, or other malicious pattern, but did not enforce a block. The `@ocsf.message` field captures the specific threat reason from Zscaler, and signals are grouped by `@usr.id` to show exposure by user. Severity tiers map directly from ZIA's classification: `@ocsf.severity_id:5` is Critical, `4` is High, `3` is Medium, and `2` is Low.

## Triage and Response{% #triage-and-response %}

- Review `{{@ocsf.message}}` to identify the threat category that ZIA detected and determine why the traffic was allowed rather than blocked, such as a policy exception, misconfiguration, or expected behavior.
- Examine the destination URL and host associated with the flagged request to determine whether either matches known malicious infrastructure, C2 frameworks, or phishing domains.
- Identify whether `{{@usr.id}}` has a history of triggering threat detections or accessing high-risk categories, and determine if the activity was intentional or the result of a drive-by or redirect.
- Check for additional ZIA events from the same user around the same time to assess whether this is an isolated hit or part of a broader pattern of threat-flagged traffic being allowed.
- Determine whether the ZIA policy that permitted the traffic is intentional, for example, a security research allowlist, or represents a gap that should be remediated.