Zscaler Private Access Threat Detected on Session

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a threat raised by Zscaler Private Access. Because ZPA mediates every connection to an internal application, a threat on a session means hostile activity reaching private applications from a device that already passed authentication — which points at the endpoint rather than the perimeter. Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=threat where sourcename='ZSCALER-SPA' and action='THREAT_DETECTED' | groupby user, srcip, threat