skills.rest
zscaler
zscalerOFFICIAL
Explore all skills by this author →
WebsiteGitHub

zia-investigate-sandbox

Diagnose ZIA Sandbox file analyses and policy enforcement events via API endpoints.

44|24|Updated May 29, 2025
Search Tags:#troubleshooting#sandbox#quarantine#md5#ssl-inspection#blocked-files#sandbox-report
One-click install
npx skills add https://github.com/zscaler/zscaler-mcp-server --skill zia-investigate-sandbox
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zia-investigate-sandbox
Source: https://github.com/zscaler/zscaler-mcp-server/tree/main/skills/zia/investigate-sandbox
Command: npx skills add https://github.com/zscaler/zscaler-mcp-server --skill zia-investigate-sandbox

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Administrators face fragmented guidance when ZIA Sandbox blocks, allows, or quarantines files. This skill consolidates sandbox analysis with runbook-guided troubleshooting to identify the root cause and streamline remediation.

Core Features & Use Cases

  • API-driven sandbox insights: fetch reports, quota, and behavioral analysis to diagnose verdicts and identify gaps.
  • Policy correlation: map sandbox results to Malware Protection and ATP actions for end-to-end troubleshooting.
  • Quarantine remediation & quick diagnosis: provide actionable steps to resolve quarantine or unexpected blocks, including SSL-inspection prerequisites when needed for analysis.

Quick Start

Diagnose a blocked file by MD5 hash using sandbox report, quota, and behavioral endpoints, then propose remediation steps.

Frequently Asked Questions about zia-investigate-sandbox

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I diagnose a file blocked by ZIA Sandbox?▼

Diagnose a file blocked by ZIA Sandbox by querying its MD5 hash against sandbox report, quota, and behavioral endpoints, then mapping the results to Malware Protection and ATP policies for remediation.

Why does ZIA Sandbox quarantine a file unexpectedly?▼

ZIA Sandbox quarantines files unexpectedly when behavioral analysis detects malicious activity, requiring you to review the sandbox report and verify SSL inspection prerequisites to interpret the verdict accurately.

Do I need SSL inspection enabled for ZIA Sandbox analysis?▼

SSL inspection is a required prerequisite for ZIA Sandbox analysis to ensure the sandbox can inspect uploaded file payloads and generate accurate behavioral verdicts for malware protection policies.

How do I check ZIA Sandbox quota and behavioral analysis status?▼

Check ZIA Sandbox quota and behavioral analysis status by querying the Sandbox API endpoints, which return report data and usage metrics to identify gaps in file analysis and policy enforcement.

What is the best way to troubleshoot ZIA Sandbox quarantine issues?▼

Troubleshoot ZIA Sandbox quarantine issues by correlating sandbox reports with Malware Protection and ATP policy actions, using runbook-guided steps to resolve unexpected blocks and configure SSL inspection.

Can I map ZIA Sandbox verdicts to ATP policy enforcement actions?▼

Map ZIA Sandbox verdicts to ATP policy enforcement actions by fetching sandbox behavioral data and correlating blocked, allowed, or quarantined file events with existing Advanced Threat Protection configurations.

Related Skills

Explore More Software Engineering Skills→
NVIDIANVIDIA
86

github-readonly-live

Query GitHub REST API issues, pull requests, commits, and file contents.

Official
Intermediate
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
djacobsmeyerdjacobsmeyer
3

sandbox-manager

Configure Claude Code sandbox policies in settings.json for secure code execution.

Community
Advanced
vahagn-madatyanvahagn-madatyan

zscaler-zia-zpa-audit

Audit ZIA and ZPA deployments for policy gaps and connector health.

Community
Advanced