Zscaler operations guides
Practical answers to everyday Zscaler security operations questions. Each guide covers how to do it in Zscaler itself, the gotchas worth knowing, and how Zmate does it from Slack.
- How to handle uncategorized URLs in Zscaler ZIA
What "Miscellaneous or Unknown" means, how to investigate a host, and when to block, allow, isolate or request recategorization.
- How to contain a compromised user in Zscaler (ZPA and ZIA)
Identity first, a ZPA block that's actually at the top, a ZIA per-user block, isolation as a softer option, and the way back.
- How to block a URL or domain in Zscaler ZIA
Custom category, DNS control, threat list or firewall: which to use, the entry syntax, and why a blocked URL can still load.
- Zscaler Client Connector one-time passwords: log out or turn off ZIA
Which code unlocks what, where admins find a device's codes, and how to hand them out without opening a hole.
- Zscaler incident response in seconds, not minutes
Why containing a compromised user takes 15 to 25 minutes of console work, the runbook approach that cuts it to seconds, and an on-call checklist.
- Zscaler ChatOps: running Zscaler from Slack
What Zscaler ChatOps means, the guardrails to insist on, portals vs scripts vs a ChatOps tool, and build versus buy.
- Why is Zscaler blocking this site? A troubleshooting runbook
Read the symptom (block page, certificate error, login loop), find the category and the rule that decided it, check the layers outside URL filtering, and fix it narrowly.
- Zscaler Site Review: how to check and change a URL's category
Look a URL up on sitereview.zscaler.com, request a recategorization and what to expect, and override the category in your own ZIA tenant while you wait.