Zscaler ZIA

Source: Zscaler ZIA. Enterprise tier. This connector only responds. It collects no data. It blocks and unblocks domains and IP addresses by editing the blocklist in your ZIA tenant. It has not yet been tested against a live ZIA tenant; see Not yet tested against a live tenant.

API client

• Create an API client in ZIdentity (OneAPI). Copy the client ID and the client secret. The secret is shown once.
• The vanity domain is the one word before .zslogin.net in your ZIdentity address. For acme.zslogin.net it is acme.
• CICADA asks https://<vanity>.zslogin.net/oauth2/v1/token for a token, then sends every call to https://api.zsapi.net/zia/api/v1.

ZIA role

Give the API client a role with edit rights on advanced settings (the blocklist) and the right to activate changes. Nothing else is needed. The exact role names in the Zscaler console are not yet confirmed.

Test Connection signs in and reads the blocklist. It does not prove the edit and activate rights. Those are only proven by the first block.

The source form

Allow outbound HTTPS (443) from the appliance to <vanity>.zslogin.net and api.zsapi.net. See Network Requirements.

Block and unblock

The actions are Block Domain, Unblock Domain, Block IP and Unblock IP.

• Block adds the value to the tenant's advanced-settings blocklist and then activates the change. A domain is a hostname only: no scheme, path, port or wildcard. CICADA lowercases it and converts international names. An IP must be a public address.
• Already in the blocklist. If an admin added the value before CICADA did, CICADA records that and will never remove it.
• Unblock removes only values CICADA added in this investigation.
• Two investigations, one value. If another investigation's block already holds the value, this investigation also holds it and nothing changes in ZIA. The entry stays until the last investigation unblocks it. The earlier ones show Still blocked in ZIA for N other investigation(s).
• If CICADA cannot read its own block records, it changes nothing in ZIA.
• Activation pending. If ZIA does not report the change as active, the action shows activation pending. CICADA checks ZIA for about two minutes. If ZIA still reports the change as pending, the action shows Unconfirmed: activate pending changes in the ZIA console.
• If ZIA answers with a rate limit, CICADA waits for the time ZIA gives and retries, up to 3 times.

If you delete an investigation that still holds blocks, CICADA warns you and lists the blocked values. If you delete anyway, the values stay blocked in ZIA and CICADA can no longer unblock them. Remove them by hand in the ZIA console, or cancel and unblock them from Response Actions first.

If the licence lapses

The licence is checked each time the connector runs. When it lapses, new blocks are refused with a 403 error. Unblocks still run, so you can always undo a block CICADA made.

An unblock still uses the saved source, so its credentials must keep working. The source cannot be edited after the licence lapses, so rotate the client secret before the licence ends, not after.

Not yet tested against a live tenant

The request shapes follow Zscaler's official SDK. These are still to be confirmed on a real ZIA tenant:

• Whether example.com in the blocklist also covers subdomains, or whether .example.com is needed. CICADA sends the exact hostname.
• Whether the blocklist accepts IPv6 addresses.
• Whether activating also publishes other admins' pending changes.
• The exact role names.

Next

• Other sources
• Back to the onboarding overview