For teams that already run ZscalerIndependent, not affiliated with Zscaler

Skip the Zscaler
console training. Run tested runbooks
from Slack.

Zscaler has a lot of consoles and runbooks to learn. Zmate turns the jobs your team does most into ready-made Slack commands, so whoever is on call can contain a user, block a site or check a link in seconds.

#security-ops
Today
AS
alex.sharma11:02 PM
/zmate lockdown compromised@corp.io
Z
ZmateApp11:02 PM
Lock down compromised@corp.io? This will change:
  • Block this user's private app access (ZPA)
  • Block this user's internet access (ZIA)
  • Nobody else is affected
Approve: /zmate confirm <MFA code>expires in 5:00
AS
alex.sharma11:02 PM
/zmate confirm 482913
Z
ZmateApp11:02 PM
Lockdown complete: compromised@corp.io
  • Private app access blocked
  • Internet access blocked
  • Everyone else keeps working
● LOCKDOWN ACTIVE
🧾 @alex.sharma confirmed: lockdown of compromised@corp.io
  • No AI. Your Zscaler data never goes to an AI model.
  • Nothing changes until an admin approves it, with MFA on the big moves.
  • Nothing to host. Connected to your Slack in under ten minutes.
  • Under 10 secondsto contain a compromised user, timed end to end
  • 60+ ready-made commandsfor everyday Zscaler jobs, no scripting
  • 7 Zscaler productsfrom one Slack channel
  • No AI, anywhereyour data never goes to a model

It's 11 PM and a credential is compromised. Who on call knows the ZPA console?

Zscaler is powerful, and there's a lot to learn: separate consoles for internet access, private apps, devices and user experience, each with its own order of operations. Most teams have one or two people who really know it. Zmate gives everyone else the runbook.

Without Zmate
  1. Wake up the person who knows the ZPA console
  2. Find the user and build a block rule
  3. Move it above every allow rule
  4. Switch to ZIA and block the user there too
  5. Activate, then check both actually applied
15 to 25 minutes, if the right person picks up.
With Zmate
  1. Anyone on call types /zmate lockdown user@corp.io
  2. They read exactly what will change
  3. An admin approves with a code from their phone
<10sfrom command to contained user, timed end to end in testing. The channel keeps the record. How to get Zscaler incident response down to seconds →

Runbooks for the Zscaler jobs your team does every week.

Built, tested and ready on day one for Zscaler incident response, policy changes and reporting. No console training, no internal wiki page to keep up to date, no scripts to maintain.

Contain

For the engineer on call when something goes wrong.

  • Lock down a compromised user

    Cut off private apps and the internet for one person while everyone else keeps working. Undo it with one command.

    /zmate lockdownHow to contain a compromised user →

  • Isolate a suspect user

    Keep them working inside browser isolation while you investigate, instead of cutting them off.

    /zmate isolate

  • Block a site or an IP

    Live for everyone the moment it's approved, with a one-command undo.

    /zmate url-block · /zmate firewall blockHow to block a URL in Zscaler →

  • Unlock a user's laptop

    Get the one-time code to log out of Zscaler or turn a service off, without the Client Connector portal.

    /zmate otpClient Connector one-time passwords →

Investigate

For analysts and Zscaler admins answering "is this safe?" and "why is this blocked?"

  • Check a suspicious link

    A verdict with its reasons, a scan of the page in an isolated browser, and one-click block, allow or isolate.

    /zmate investigate-urlHandling uncategorized URLs →

  • Find out why a site is blocked

    How Zscaler classifies it, which of your categories hold it and which rules decide it, in order.

    /zmate why · /zmate lookupWhy is Zscaler blocking this site? →Zscaler Site Review: check and change a URL's category →

  • Fix a slow app for one person

    App score, worst-affected users, active alerts and Zscaler's own ZDX root cause findings, in one reply.

    /zmate triage · /zmate analyze

  • See one user end to end

    Devices, groups, private app access and experience for one person, or an offboarding checklist when they leave.

    /zmate user · /zmate offboard

Report

For security leads and CISOs who want the picture without a dashboard.

  • Security posture on demand

    Incidents, attack surface, shadow IT and certificate expiry in one board-ready summary.

    /zmate report

  • Threat and attack surface trends

    7 or 14-day incident trends, open findings and lookalike domains impersonating you.

    /zmate threat-trends · /zmate attack-surface

  • A morning briefing in the channel

    New alerts and findings posted as they appear, plus a daily digest at the hour you pick.

    automatic

  • Shadow IT and traffic at a glance

    Risky SaaS apps, firewall activity by location and where your web traffic goes.

    /zmate shadow-it-report
Browse all 60+ commands by Zscaler product
ZIA - Internet Access · 35+ commands
$
url-block / url-unblockBlock or unblock any URL for everyone, live as soon as you confirm
$
firewall block / unblockCloud firewall rules scoped to any IP, optionally with TCP/UDP port restrictions - confirm before create
$
why <url>Which of your URL categories hold a URL, how Zscaler classifies it, and the rules that decide it, in order
$
shadow-it / shadow-it-reportDiscover unsanctioned SaaS apps, block by category, and get an executive CASB risk summary
$
dlp / ssl-rules / file-type-rulesReview all web DLP rules, SSL inspection policies, and file type control rules in one command
$
ip-source-group / ip-dest-groupCreate and delete IP source and destination groups - IP addresses, FQDNs or domains
$
rule-label create / deleteManage ZIA rule labels used to tag and organize policy rules across all ZIA policy types
$
auth-exempt list / add / removeManage authentication exemption URLs - add trusted destinations to bypass ZIA auth without portal access
$
sandbox / sandbox-statsList sandbox policy rules and review submission statistics - top blocked file hashes and categories
$
network-services / time-intervalsBrowse all ZIA network service definitions and time-based policy intervals for schedule-aware rules
ZPA - Private Access · 20+ commands
$
lockdown / unlock <email>Instant containment of one user across private apps and the internet. Nobody else affected. Fully reversible. MFA-protected - requires authenticator code at confirm time.
$
isolate / de-isolate <email>Move any user into Cloud Browser Isolation - they keep working, without unmonitored exfil paths
$
segment enable / disableEnable or disable any named app segment instantly - no portal navigation, change reflected immediately
$
segment-group create / deleteFull lifecycle for ZPA segment groups - create by name, delete by name, confirm-gated
$
connector enable / disableEnable or disable any named app connector - useful for drain-and-replace maintenance workflows
$
access-rules / forwarding-rulesReview all ZPA access policy rules and forwarding rules - full rule listing with conditions and actions
$
timeout-rules / app-protectionReview ZPA timeout policies and app protection (inline WAF) rules for all configured applications
$
pra-creds / pra-cred deleteList all PRA credentials and delete by ID - essential for offboarding and credential rotation workflows
$
provisioning-keys / deleteReview ZPA provisioning keys and retire the ones you no longer need
$
segments / connectors / server-groupsFull inventory of all ZPA app segments, connectors, server groups, segment groups, and certificates
ZDX - Digital Experience · 12 commands
$
triage <app>Automated incident brief: current score, score trend, worst-affected users, and active alerts - one response, no dashboard required
$
analyze <email> <app>Zscaler's own ZDX root cause analysis for a user and app - findings and contributing factors, straight to Slack
$
deeptrace <email> <app>Start a full ZDX deep trace for a user and app - no device or probe lookups needed
$
deeptrace-status <device> <trace>Full trace results: DNS resolution, TCP handshake, TTFB, cloud path hop latency, device health metrics, top processes
$
zdx-user <email>Per-user experience breakdown across all ZDX applications - score, trend, and alert status per app
$
alert-history [--days N]Historical ZDX alert timeline for any lookback window - essential for post-incident review and reporting
$
experience / alertsReal-time application scores across all ZDX-monitored apps, and current active alert list
$
zdx-devices / softwareFull ZDX device inventory and software listing - device health, version tracking, and enrollment status
ZCC - Client Connector · 4 commands
$
devicesFull inventory of all enrolled ZCC devices - OS, version, enrollment status, and assigned user across the entire org
$
zcc-policiesList all ZCC forwarding profiles - review which profiles are active and what traffic they govern
$
otp <email> logout / zia-offOne-time password for the user's device to log out or turn ZIA, ZPA or ZDX off, without opening the Client Connector portal. Shown only to you; the channel gets a note without the code
$
user <email> - ZCC sectionThe /zmate user command includes ZCC device enrollment for the specified user - correlated with ZID and ZPA data
ZID - Zscaler Identity · 4 commands
$
zid user <email>Full identity profile: display name, login, domain, IdP source, status, and complete group membership list with privileged group flagging
$
zid group <name>Group detail: description, full member listing - useful for verifying group scope before policy changes
$
user <email> - identity sectionThe /zmate user command includes the full ZID identity section - groups, domain, IdP - alongside ZCC, ZPA, ZDX, and ZIA data
$
offboard <email>Offboard checklist: ZCC devices, ZID group memberships with privileged group warnings, active ZPA lockdown and isolation controls
ZINS - Insights & Analytics · 8 commands
$
incidents [severity]Live cyber incident feed with severity filter - active threats by type, location and impact across your organization
$
threat-trends [--days 7|14]7 or 14-day incident trend line with daily breakdown, top threat categories by volume, and trend direction vs prior period
$
shadow-it-reportCASB analytics: total app count, high-risk app count, top 10 apps by transaction volume - exec-ready shadow IT exposure summary
$
firewall-summaryFirewall posture analytics: traffic breakdown by action (allow/block/bypass) and by location - identify policy gaps by site
$
web-trafficWeb traffic geography: top 10 countries by volume - surface anomalous egress patterns and geographic risk distribution
$
report - ZINS sectionThe /zmate report command includes the full ZINS 7-day incident summary and top threat categories as part of the posture snapshot
ZEASM - External Attack Surface · 3 commands (license required)
$
findings [severity]External attack surface findings filtered by severity - critical, high, medium, or low. Asset, description, and risk context per finding.
$
lookalike-domainsPhishing and lookalike domains actively impersonating your organization - catch brand abuse before users are targeted
$
attack-surfaceExecutive-facing snapshot: findings by severity, open count, lookalike domain count - one command, shareable output
$
Alert poller (background)New ZDX alerts and ZEASM findings are posted to your Zmate channel automatically - no polling, no setup

A user hit an uncategorized site. Decide in one click, not one ticket.

Zmate tells you whether the site looks safe and why, then turns the answer into a button. Nothing changes until you confirm.

  1. Investigate

    Reputation, brand impersonation and your own lookalike domains, turned into a verdict that shows its reasons.

  2. Scan the page

    Loads the site once in an isolated browser that can't reach your network, flags login forms and redirects, and sends you a screenshot.

  3. Block, allow, or isolate

    Allow it, allow it only through browser isolation, or block it. Live once you confirm.

  4. Keep exceptions tidy

    Every allowed site is re-checked daily, so you know when Zscaler has caught up and the exception can go.

No AI. No surprises. Nothing changes until an admin says yes.

Security teams have enough to review. Zmate is built so the answer to "where does our data go?" is short.

  • 0 AI models

    No AI, anywhere in Zmate

    Zmate doesn't use AI. Your Zscaler data, your users and your commands are never sent to an AI model, ours or anyone else's. Every runbook does the same thing every time, so there's no AI risk review to get through.

  • Admins approve every change

    Only the people you make Zmate admins can change anything. Each change shows exactly what will happen before it runs, and the biggest ones need a code from the admin's phone.

  • Your data stays yours

    Zmate doesn't keep a copy of your Zscaler data. Answers stay in your Slack. Prefer it inside your own environment? The Enterprise Runner runs Zmate there, managed by us.

  • Everything on the record

    The channel shows who approved what, and when. Each change also appears in Zscaler's own admin audit log, and detailed replies go only to the person who asked.

What the channel sees: the request, exactly what it will change, and who approved it.

Start free. Upgrade when you want to make changes.

Starter

Free

Read-only, for as long as you like.

  • Every question across your Zscaler products: rules, users, devices, alerts
  • Suspicious link checks and isolated page scans
  • ZDX triage, posture reports and trends
  • New alerts and findings posted to your channel

Pro

Talk to us

Everything in Starter, plus every change, each approved before it runs.

  • Lock down, isolate and restore users
  • Block, allow and isolate sites and IPs
  • Client Connector one-time codes
  • ZPA and ZIA policy changes, with MFA on the high-impact ones

Both plans run as Cloud SaaS, hosted by HuCortex, or as the Enterprise Runner inside your own environment, managed by us. We connect it to your Slack with you in under ten minutes.

Questions buyers ask

Anything else? Email hello@zmate.io, or read the Zscaler guides.

Zmate is Zscaler ChatOps: a Slack app that gives teams already running Zscaler tested runbooks for incident response, policy changes and reporting across ZIA, ZPA, ZDX, ZCC, ZID, ZINS and ZEASM. Whoever is on call can contain a compromised user, block a site, check a suspicious link or unlock a laptop from Slack, without learning every Zscaler console. Nothing changes until a Zmate admin approves it, and Zmate uses no AI.
Security and IT teams that already run Zscaler: the engineers on call, the Zscaler admins and the security leads they report to. Zmate is an independent product made by HuCortex Inc. It isn't made by, affiliated with or endorsed by Zscaler, Inc., and it works with the Zscaler subscription you already have.
No. There's no AI in Zmate. Your Zscaler data, your users and your commands are never sent to an AI model, ours or anyone else's. Every command runs a fixed runbook that does the same thing every time, so there's no AI risk review to get through. The one exception is a Zscaler feature, not ours: /zmate analyze shows the findings of Zscaler's own ZDX root cause analysis, which runs inside your Zscaler as it would from the Zscaler portal.
Starter is free and read-only: every question your team asks of Zscaler, suspicious link checks and page scans, reports, and alerts posted to your channel. Pro adds every change, each approved before it runs: locking down and isolating users, blocking and allowing sites and IPs, device unlock codes, and ZPA and ZIA policy changes. Contact hello@zmate.io for Pro pricing.
Under 10 minutes. We connect your Zscaler to your Slack workspace with you, and every runbook is ready straight away. Nothing changes in your Zscaler setup, and there's nothing for you to host: HuCortex runs Zmate for you (Cloud SaaS), or deploys and manages it inside your own environment (Enterprise Runner).
Only Zmate admins: people who have registered an authenticator app (Google Authenticator, Authy or 1Password) with /zmate mfa setup. Everyone else in the channel can ask questions but can't change anything. Every change shows exactly what will happen and waits for an approval, and the highest-impact ones (lockdown, unlock, isolation, authentication exemptions, ZPA deletions) also need a 6-digit code from the admin's phone. Each code works once, and five wrong codes cancel the action.
Yes, for the everyday ones. /zmate unlock reverses a lockdown, even if Zmate has restarted since, and isolation, blocks, allows and exemptions each have a matching undo command. Deletions can't be undone, which is why Zmate always shows exactly what will be deleted before anyone approves it.
Zmate connects through Zscaler's official APIs, with access your team grants and can withdraw at any time. It doesn't keep a copy of your Zscaler data: answers go to your Slack workspace and stay there. With the Enterprise Runner, Zmate runs inside your own environment, so your Zscaler credentials never leave it. The only thing sent to outside services is the hostname of a link you ask Zmate to check, never who asked. Your onboarding guide lists every service and exactly what it receives.
Nothing changes in Zscaler. Zmate doesn't sit in your traffic path, and it only acts when someone asks it to. If it's offline, your Zscaler policies stay exactly as they are, and any change waiting for approval simply expires.

Next time it's 11 PM, anyone on call can handle it.

See it on your own Zscaler in a 30-minute demo, or start free with read-only access.