skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

zscaler-insights

Query Zscaler Z-Insights for threat intelligence, security events, and traffic analytics.

650|182|Updated Feb 19, 2026
Search Tags:#threat intelligence#Zero Trust#risk score#zscaler#security events#traffic analytics#sandbox reports
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill zscaler-insights
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zscaler-insights
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/zscaler-insights
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill zscaler-insights

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need fast access to Zscaler threat intelligence, blocked threats, anomalies, and compliance posture without manually navigating the Z-Insights console.

Core Features & Use Cases

  • Threat Intelligence & Events: Retrieve threat intelligence for indicators like IP addresses and list or inspect security events and blocked threats.
  • Analytics & Anomalies: Pull traffic analytics, detected anomalies, sandbox reports, top threats, and organizational risk scores.
  • Use Case: Ask what threats were blocked today, then drill into a specific blocked threat and check the current compliance posture in one conversation.

Quick Start

Show security events from the last hour and list any threats blocked today.

Frequently Asked Questions about zscaler-insights

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check blocked threats in Zscaler?▼

Use the list_blocked_threats tool to retrieve threats blocked by Zscaler, then call get_blocked_threat with a specific threat ID for full details. You can also ask in natural language, such as what threats were blocked today.

How to get threat intelligence for an IP address with Zscaler?▼

Call the get_threat_intelligence tool with the IP address as the indicator, for example requesting threat intelligence for 1.2.3.4. The skill queries Zscaler Z-Insights through the OneAPI connection.

What credentials does the Zscaler Insights integration require?▼

It requires ZSCALER_CLIENT_ID and ZSCALER_CLIENT_SECRET for OneAPI authentication, plus ZSCALER_CUSTOMER_ID and ZSCALER_VANITY_DOMAIN to identify the tenant. The ZSCALER_MCP_SERVICES variable must include zinsights.

Can I review sandbox analysis reports through Zscaler Z-Insights?▼

Yes, use list_sandbox_reports to enumerate sandbox analysis reports and get_sandbox_report to inspect a specific report. This supports investigation of suspicious files detected in your environment.

Why is the Zscaler Insights skill not returning data?▼

The most common cause is missing or incorrect environment variables, especially ZSCALER_MCP_SERVICES not including zinsights. Verify the OneAPI client credentials, customer ID, and vanity domain are set correctly.

Related Skills

Explore More Software Engineering Skills→
zscalerzscaler
44

cross-product-troubleshoot-user-connectivity

Diagnose cross-product user connectivity issues across ZCC, ZDX, ZPA, and ZIA.

Official
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-sentiment

Analyze ITSM incident communications to detect sentiment and escalation risk.

Official
Intermediate
zscalerzscaler
44

zins-investigate-security-incident

Correlate Zscaler Z-Insights security data sources into a structured incident timeline.

Official
Advanced
zscalerzscaler
44

zins-analyze-web-traffic

Query Zscaler Analytics to summarize web traffic by location, protocol, and threats.

Official
Intermediate