Zscaler ZIA Cloud Firewall - IPS Signature Match (Non-Web)
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Splunk (SPL)
