Zscaler ZTB excessive concurrent isolation session abuse
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
Microsoft Sentinel (KQL)
