Zscaler Private Access Connector Availability Anomaly
Detects clusters of unreachable-service and no-connector-available events. Where these concentrate on one application they suggest the connector serving it has been disrupted — which, during an intrusion, denies access to the application while the outage is treated as an infrastructure problem rather than a security one. Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=zpa-connector where sourcename='ZSCALER-SPA' and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE') | duration 15m | groupby app, reason | select app, reason, count(*) as cnt | having cnt > 15
Sigma
