Zscaler AI Guard DLP Violations in GenAI Prompts/Responses

KQL Cowboy@KQLCowboy

•updated Aug 18, 2026•0•0•3

This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.