Zia Audit Ssl Inspection Bypass

zia_list_ssl_inspection_rules()```text
Categorize each rule by its action:
- **INSPECT** (also called DECRYPT) -- traffic is fully decrypted and inspected- **DO_NOT_INSPECT** -- traffic is not decrypted or inspected (full bypass)- **DO_NOT_DECRYPT** -- traffic is not decrypted but metadata is still visible- **BLOCK** -- traffic is blocked at the SSL layer
If the user asks about a specific action (e.g., "which rules are in decryption mode"), filter the results to show only rules matching that action.
---
### Step 2: Analyze Rule Details
For each relevant rule, extract and present:
**What it covers:**
- `url_categories` -- URL categories affected- `cloud_applications` -- specific cloud apps affected- `zpa_app_segments` -- ZPA application segments affected
**Who it applies to:**
- `users` -- specific user IDs- `groups` -- user group IDs- `departments` -- department IDs- `locations` -- location IDs- `device_trust_levels` -- device trust level requirements
**Scope:**
- `platforms` -- OS platforms (iOS, Android, macOS, Windows, Linux)- `user_agent_types` -- browser types- `enabled` -- whether the rule is active- `order` -- rule evaluation order
Resolve IDs to human-readable names only when needed:
```textget_zia_user_groups(search="<group_name>")get_zia_user_departments(search="<department_name>")zia_list_locations()```text
---
### Step 3: Risk Assessment (for bypass audits)
If the user is auditing bypasses (DO_NOT_INSPECT / DO_NOT_DECRYPT), classify each by risk level:
**CRITICAL Risk:**
- Broad categories bypassed (e.g., "Uncategorized", "Miscellaneous")- AI/ML applications bypassed- Bypass applies to ALL users (no scoping)- Categories with known data exfiltration risk (file sharing, webmail, social media)
**HIGH Risk:**
- Bypass for cloud applications that handle sensitive data- Large user groups or entire departments bypassed
**MEDIUM Risk:**
- Specific applications bypassed due to certificate pinning (legitimate technical reason)- Narrow scope -- specific users or small groups- Categories with low data sensitivity (e.g., government sites, health portals)
**LOW Risk:**
- Platform-specific bypasses (e.g., iOS system services)- Well-known applications with strong native encryption and no data loss risk- Bypasses scoped to high-trust devices only
---
### Step 4: Generate Report
Present findings organized by the user's question. Adapt the format:
**If the user asks "which rules are in decryption mode":**
```textSSL Inspection Rules -- DECRYPT (Active Inspection)=====================================================
Total SSL rules: XDECRYPT (active inspection): Y rulesDO_NOT_DECRYPT (bypass): Z rulesBLOCK: W rules
DECRYPT Rules:1. "<rule_name>" (order: N, enabled: yes/no)   - URL Categories: ...   - Cloud Apps: ...   - Applies To: <users/groups/departments>   - Platforms: ...
2. "<rule_name>" ...```text
**If the user asks "audit SSL bypass exceptions":**
```textSSL Inspection Bypass Audit============================
Total SSL rules: XBypass rules (DO_NOT_INSPECT/DO_NOT_DECRYPT): Y
CRITICAL RISK:- "<rule>": Bypasses <N> categories for All Users
HIGH RISK:- "<rule>": Bypasses <apps> for <department>
MEDIUM RISK:- "<rule>": Certificate-pinned app bypass for specific users
LOW RISK:- "<rule>": OS update bypass (expected)
Recommendations:1. Review and narrow critical/high-risk bypasses2. Consider per-user scoping instead of All Users```text
---
## Optional: Cross-Reference with DLP / URL Filtering
**Only perform this step if the user explicitly asks** for DLP impact, URL filtering overlap, or a comprehensive security gap analysis.
```textzia_list_web_dlp_rules()zia_list_url_filtering_rules()```text
Check if bypassed URL categories overlap with categories targeted by DLP or URL filtering rules. Flag any DLP rules that are rendered ineffective because their target categories are SSL-bypassed.
---
## Edge Cases
### No Bypass Rules Found
```textAudit Complete: No SSL inspection bypass rules found.
All SSL inspection rules use the INSPECT action. This means all HTTPStraffic is being decrypted and inspected.
Note: Verify this is intentional -- some applications with certificatepinning may break without DO_NOT_INSPECT exceptions.```text
### All Rules Disabled
```textWarning: All X bypass rules are currently DISABLED.
This means full SSL inspection is effectively enabled for all traffic.However, these disabled rules exist and could be re-enabled.
Recommendation: If no longer needed, delete them to prevent accidentalre-enablement.```text
### Predefined/Default Rules
```textNote: Rule "<name>" is a predefined/default rule (predefined=True).This rule cannot be modified or deleted. Factor it into the audit butflag that changes require a Zscaler support request.```text
---
## When NOT to Use This Skill
- Creating or modifying SSL rules -- use `zia_create_ssl_inspection_rule` or `zia_update_ssl_inspection_rule` directly- Investigating a specific URL category's full policy -- use the "investigate-url-category" skill- Checking user access -- use the "check-user-url-access" skill- Auditing DLP rules -- query DLP tools directly, not through this skill
---
## Quick Reference
**Primary workflow:** List SSL Rules → Analyze Details → Risk Assessment → Report
**Core tools (always use):**
- `zia_list_ssl_inspection_rules()` -- list all SSL inspection rules- `zia_get_ssl_inspection_rule(rule_id)` -- get details of a specific rule
**Supporting tools (use only to resolve IDs in SSL rules):**
- `get_zia_user_groups(search)` -- resolve group IDs to names- `get_zia_user_departments(search)` -- resolve department IDs to names- `zia_list_locations()` -- resolve location IDs to names
**DO NOT call unless explicitly asked:**
- `zia_list_web_dlp_rules()` -- only if user asks for DLP impact analysis- `zia_list_url_filtering_rules()` -- only if user asks for URL filtering overlap
**Risk classification:**
- CRITICAL: Broad categories, all users, high-risk apps- HIGH: Sensitive apps/categories, large user scope- MEDIUM: Certificate-pinning exceptions, narrow scope- LOW: OS updates, system services, no data sensitivity