Zscaler Private Access Repeated Blocked Requests

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects repeated blocked access requests through Zscaler Private Access. ZPA brokers access to internal applications without exposing the network, so a user repeatedly blocked is probing for applications they are not entitled to reach — the zero trust equivalent of internal port scanning. Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED' | duration 1h | groupby user, srcip | select user, srcip, distinct_count(app) | having distinct_count_col1 > 5