Zia Investigate Url Category

zia_url_lookup(urls=["example.com"])```text
This returns the URL's category classification (e.g., "SOCIAL_NETWORKING", "STREAMING_MEDIA").
**If given a category name**, list categories to find the exact ID. Narrow therequest — unfiltered, this returns every category in the tenant:
```textzia_list_url_categories(custom_only=True, search="partner")```text
`custom_only=True` is a real API filter and the right first move whenever theadmin is asking about a category they created. `search` matches the configuredname; if it comes back empty, drop it and match on the `id` instead.
Find the category in the results and note its `id` (e.g., "CUSTOM_01","SOCIAL_NETWORKING"). By default the listing reports how many URLs each categoryholds, not the URLs themselves.
To see the URLs, `superCategory` and the rest of the definition, fetch thecategory itself:
```textzia_get_url_category(category_id="<category_id>")```text
#### Present Initial Findings
```textURL Category Identified:
**Category:** Social Networking- ID: SOCIAL_NETWORKING- Super Category: Entertainment & Recreation- Type: Built-in
Now searching across all policy rule types...```text
---
### Step 2: Search URL Filtering Rules
```textzia_list_url_filtering_rules()```text
Scan every rule's `urlCategories` field for the target category ID or name. For each match, note:
- Rule name and ID- Action (`ALLOW`, `BLOCK`, `CAUTION`)- Which users/groups/departments/locations are affected- Whether the rule is enabled- Rule order (priority)
---
### Step 3: Search SSL Inspection Rules
```textzia_list_ssl_inspection_rules()```text
Scan every rule's `urlCategories` field. For each match, note:
- Rule name and ID- Action (`INSPECT`, `DO_NOT_INSPECT`, `DO_NOT_DECRYPT`)- Which users/groups are affected- Whether the rule is enabled
---
### Step 4: Search DLP Web Rules
```textzia_list_web_dlp_rules()```text
Scan every rule's `urlCategories` field. For each match, note:
- Rule name and ID- Action (`ALLOW`, `BLOCK`)- DLP engines and dictionaries involved- Which users/groups are affected
---
### Step 5: Compile and Present Results
Build a comprehensive report showing everywhere the category is referenced.
#### Report Format
```textURL Category Investigation Report==================================
**Category:** <name> (<id>)**Super Category:** <super_category>**Type:** Built-in / Custom
---
## URL Filtering Rules (X matches)
| # | Rule Name              | Action  | Enabled | Users/Groups          | Order ||---|------------------------|---------|---------|----------------------|-------|| 1 | Block Social Media     | BLOCK   | Yes     | All Users             | 3     || 2 | Allow Marketing Social | ALLOW   | Yes     | Marketing Department  | 2     |
**Analysis:** Social Networking is BLOCKED for all users by default (Rule #1,order 3), but ALLOWED for the Marketing department (Rule #2, order 2 --higher priority).
---
## SSL Inspection Rules (X matches)
| # | Rule Name                  | Action         | Enabled | Users/Groups ||---|----------------------------|----------------|---------|-------------|| 1 | Do Not Inspect Social      | DO_NOT_INSPECT | Yes     | All Users   |
**Analysis:** SSL traffic to Social Networking sites is NOT inspected,meaning DLP policies cannot scan content on these sites.
---
## DLP Web Rules (X matches)
| # | Rule Name               | Action | Enabled | DLP Engine    ||---|-------------------------|--------|---------|---------------|| 1 | Block PII Upload Social | BLOCK  | Yes     | PII Detection |
**Analysis:** Even if Social Networking is allowed by URL filtering, DLPwill block uploads containing PII.
NOTE: Since SSL is not inspected for this category (see above), this DLPrule will NOT be effective for HTTPS traffic. Consider enabling SSLinspection for this category.
---
## Cloud Firewall Rules (X matches)
No firewall rules reference this URL category directly.
---
## Summary
The URL category "<name>" is referenced in:- X URL Filtering rules- X SSL Inspection rules- X DLP Web rules- X Cloud Firewall rules
**Effective Policy (for a standard user):**1. URL Filtering: BLOCKED (rule order 3)2. SSL Inspection: NOT INSPECTED3. DLP: Block PII upload (but ineffective without SSL inspection)
**Recommendations:**- If DLP enforcement is needed, enable SSL inspection for this category- Review the Marketing department exception to ensure it is still needed```text
---
## Advanced Investigation
### Check Impact on a Specific User or Group
If the admin asks "Can user X access category Y?":
1. Look up the user's department and groups:
```textget_zia_users(search="<username>")get_zia_user_groups(search="<group_name>")get_zia_user_departments(search="<department_name>")```text
2. Then cross-reference with the rules found above, evaluating rule order and specificity.
### Check Custom URL Categories
Custom categories may contain specific URLs. Get the full list:
```textzia_get_url_category(category_id="CUSTOM_01")```text
Review the `urls`, `dbCategorizedUrls`, `keywords`, and `ipRanges` fields.
### Check If a URL Is in Multiple Categories
```textzia_url_lookup(urls=["suspicious-site.com"])```text
A URL can match multiple categories. Repeat the investigation for each returned category.
---
## Edge Cases
### Category Not Found in Any Rules
```textInvestigation complete: The URL category "<name>" is not referenced in anyURL filtering, SSL inspection, DLP, or firewall rules.
This means:- The DEFAULT rules will apply for this category- Check the default URL filtering rule for the baseline action- Check the default SSL inspection rule for inspection behavior```text
### Category Referenced in Disabled Rules Only
```textThe URL category "<name>" is only referenced in DISABLED rules.Currently, only the default policy applies.
Disabled rules found:- [Disabled] "Block Streaming" (URL Filtering, BLOCK)
These rules have no effect until re-enabled.```text
---
## When NOT to Use This Skill
- Creating or modifying URL categories -- pick the right tool for the flavour. Custom: `zia_create_url_category`, `zia_update_url_category` (full PUT), `zia_delete_url_category`. Predefined (Zscaler-curated, e.g. `FINANCE`, `NEWS_AND_MEDIA`): `zia_get_url_category_predefined`, `zia_update_url_category_predefined` (full PUT). The custom-only tools refuse predefined IDs at the safety-guard layer.- Adding/removing URLs from a category -- use `zia_add_urls_to_category` or `zia_remove_urls_from_category`. Both work transparently on custom *and* predefined categories (they use the SDK's `?action=ADD_TO_LIST` / `?action=REMOVE_FROM_LIST` endpoints, which preserve Zscaler's curated list on predefined categories).- Creating new filtering rules -- use `zia_create_url_filtering_rule` directly- Investigating SSL bypass specifically -- use the "audit-ssl-inspection-bypass" skill
---
## Quick Reference
**Primary workflow:** Identify Category → Search URL Rules → Search SSL Rules → Search DLP Rules → Compile Report
**Tools used:**
- `zia_url_lookup(urls)` -- classify a URL into categories- `zia_list_url_categories(custom_only, type, search)` -- find a category id (URL counts, not URLs)- `zia_get_url_category(category_id)` -- get category details- `zia_list_url_filtering_rules()` -- search URL filtering rules- `zia_list_ssl_inspection_rules()` -- search SSL inspection rules- `zia_list_web_dlp_rules()` -- search DLP rules- `zia_list_cloud_firewall_rules()` -- search firewall rules- `get_zia_users(search)` -- look up specific users- `get_zia_user_groups(search)` -- look up groups- `get_zia_user_departments(search)` -- look up departments
**Remember:**
- Rule order matters -- lower order number = higher priority- SSL inspection affects DLP effectiveness- A URL can belong to multiple categories- Default rules apply when no explicit rule matches- Always check for disabled rules that may cause confusion