Zscaler ZIA - Phishing / Advanced Threat URL Access
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Splunk (SPL)
