Zdx Compare Location Experience

zdx_list_locations()```text
**List departments:**
```textzdx_list_departments()```text
Note the IDs returned -- these are used as filters in subsequent calls.
---
### Step 2: Compare Application Scores Across Locations
For each application of interest, retrieve scores filtered by different locations.
**Location A:**
```textzdx_list_applications(location_id=["<location_a_id>"], since=24)```text
**Location B:**
```textzdx_list_applications(location_id=["<location_b_id>"], since=24)```text
**Location C:**
```textzdx_list_applications(location_id=["<location_c_id>"], since=24)```text
Compile the scores side by side to identify which locations are underperforming.
---
### Step 3: Drill Into Score Trends for Underperforming Locations
For the worst-performing location, check the score trend.
```textzdx_get_application_score_trend(  app_id="<app_id>",  location_id=["<worst_location_id>"],  since=24)```text
Compare with a healthy location:
```textzdx_get_application_score_trend(  app_id="<app_id>",  location_id=["<healthy_location_id>"],  since=24)```text
**What to look for:**
- Does the underperforming location show a consistent low score or a sudden drop?- Does the score correlate with specific times of day (peak hours)?- Are multiple applications affected at this location, or just one?
---
### Step 4: Compare Metrics Across Locations
Drill into metrics for the specific application at each location.
**Page Fetch Time by location:**
```textzdx_get_application_metric(  app_id="<app_id>",  metric_name="pft",  location_id=["<location_a_id>"])```text
```textzdx_get_application_metric(  app_id="<app_id>",  metric_name="pft",  location_id=["<location_b_id>"])```text
**DNS by location:**
```textzdx_get_application_metric(  app_id="<app_id>",  metric_name="dns",  location_id=["<location_a_id>"])```text
**Availability by location:**
```textzdx_get_application_metric(  app_id="<app_id>",  metric_name="availability",  location_id=["<location_a_id>"])```text
---
### Step 5: Compare Impacted Users by Location
Understand user impact at each location.
```textzdx_list_application_users(  app_id="<app_id>",  score_bucket="poor",  location_id=["<worst_location_id>"])```text
```textzdx_list_application_users(  app_id="<app_id>",  score_bucket="poor",  location_id=["<healthy_location_id>"])```text
**Calculate impact ratios:** If Location A has 5 poor users out of 50 total (10%) vs Location B with 25 poor users out of 100 total (25%), Location B has a more severe issue despite Location A having fewer total users.
---
### Step 6: Check Location-Specific Alerts
```textzdx_list_alerts(location_id=["<worst_location_id>"], since=48)```text
```textzdx_list_historical_alerts(location_id=["<worst_location_id>"], since=168)```text
Recurring alerts at a specific location indicate a persistent infrastructure issue at that site.
---
### Step 7: Assess Device Health at Underperforming Locations
Check if the issue is device-related rather than network-related.
```textzdx_list_devices(location_id=["<worst_location_id>"])```text
For specific devices showing issues:
```textzdx_get_device(device_id="<device_id>")```text
Check for:
- High CPU/memory usage across many devices (hardware refresh needed)- Outdated ZCC agent versions- WiFi issues (common in specific offices)
---
### Step 8: Present Comparison Report
Assemble the `__ZDX_DATA__` payload defined in the *Data Payload Contract* and render it through `./templates/report.html.template` (see the **HTML OUTPUT** section). The template already produces the location ranking table, KPI cards, color coding by tier, search/sort, and CSV export — do **not** hand-author any HTML or markdown table here.
What you DO write is the `analysis` block inside the payload. **Do not skip it.** This is what makes the comparison useful:
- **`analysis.summary`** (3–5 sentences): rank the locations and call out the gap between best and worst. Quote concrete numbers from the metric calls in Steps 2–4 (e.g., *"Dallas is the clear outlier with a score of 42, significantly below the org average of 75. DNS resolution at 180ms is 4× the average of other locations (28ms), which is cascading into elevated Page Fetch Times."*).- **`analysis.rootCause`** (2–4 sentences for each worst performer): identify the dominant bottleneck (DNS, ISP, WiFi, device fleet) using the historical alert pattern (Step 6) and device health (Step 7) as evidence.- **`analysis.remediation`** (4–6 items): label each with a priority bucket and a concrete action.
| Priority | Apply to | Action ||---|---|---|| `Immediate` | Worst performer(s) (score < 50) | Investigate the bottleneck metric. If DNS, check local resolver health and consider a redundant DNS provider. If ISP, open a ticket with the carrier with timestamps. || `Investigate` | Borderline locations (score 50–79) | Compare against healthy peers; track active alerts. Escalate if score drops further within 24h. || `Monitor` | Healthy locations on a downward trend | Add to weekly watchlist; verify no regional events are pending. || `Communicate` | All affected locations | Notify site IT contacts with the metric evidence and the expected remediation timeline. |
---
## Department Comparison Variant
The same workflow applies when comparing departments instead of locations.
```textzdx_list_applications(department_id=["<dept_a_id>"], since=24)zdx_list_applications(department_id=["<dept_b_id>"], since=24)```text
**Department comparison is useful for:**
- Understanding if a specific team is disproportionately affected- Compliance reporting (e.g., "How is the Finance team's experience?")- Device fleet differences between departments (older hardware, different OS)
---
## Multi-Application Comparison
Compare how all applications perform at a single location.
```textzdx_list_applications(location_id=["<location_id>"], since=24)```text
If all applications are degraded at one location:
- The issue is likely network infrastructure (ISP, WiFi, LAN)- Not application-specific
If only one application is degraded at a location:
- Likely application-specific routing or server issue for that region- Check application CDN or server closest to that location
---
## Edge Cases
### Location with No Active Devices
```textNo active devices found at location "<location_name>" in therequested time window. The office may be closed, or devicesmay not be reporting.
Verify:- Is the office operational?- Are ZDX agents deployed at this location?- Check the 'since' parameter (try a wider window)```text
### All Locations Equally Degraded
If all locations show similar poor scores:
- The issue is not location-specific- Likely an application server or Zscaler service-wide event- Switch to the **Analyze Application Health** skill
### New Location Without Baseline
For recently added locations with no historical data:
- Cannot reliably compare with established locations- Collect at least 1 week of data before drawing conclusions- Use current metrics as the initial baseline
---
## Quick Reference
**Primary workflow:** List Locations/Depts → Compare App Scores → Drill Trends → Compare Metrics → Check Users → Review Alerts → Report
**Tools used:**
- `zdx_list_locations()` -- enumerate locations- `zdx_list_departments()` -- enumerate departments- `zdx_list_applications(location_id/department_id)` -- scores by dimension- `zdx_get_application_score_trend(app_id, location_id)` -- trend by location- `zdx_get_application_metric(app_id, metric_name, location_id)` -- metrics by location- `zdx_list_application_users(app_id, score_bucket, location_id)` -- impacted users by location- `zdx_list_alerts(location_id)` -- location-specific alerts- `zdx_list_historical_alerts(location_id)` -- recurring patterns- `zdx_list_devices(location_id)` -- devices at a location- `zdx_get_device(device_id)` -- device health details
**Comparison dimensions:**
- `location_id` -- by office / ZIA location- `department_id` -- by business unit- `geo_id` -- by geographic region
**Related skills:**
- [Troubleshoot User Experience](../troubleshoot-user-experience/) -- individual user drill-down- [Analyze Application Health](../analyze-application-health/) -- org-wide app health- [Investigate Alerts](../investigate-alerts/) -- alert-focused investigation