Zscaler ZPA - Repeated Private Application Access Denied (Policy Probing)
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Microsoft Sentinel (KQL)
