---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Get started

# Getting started with Security Incident Response integration with Zscaler {#ariaid-title1}

Release version: Australia  
Updated October 22, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Getting started with Security Incident Response integration with Zscaler

This guide outlines the necessary steps for ServiceNow customers to activate and configure the integration between Zscaler Internet Access and the ServiceNow Security Incident Response (SIR) product.
The integration enables automated threat detection and incident management by connecting Zscaler's security capabilities with ServiceNow's AI Platform and SIR workflows.
Show full answer Show less  

## Prerequisites and Role Assignments

* Assign essential roles within ServiceNow: **admin** (installs integration and assigns roles), **snsi.admin** (configures integration, manages URL Category lists, assigns *snsi.analyst* ), and **snsi.analyst** (creates entries and manages security incidents).
* Ensure core ServiceNow applications are installed and activated before proceeding with the integration setup.

## Required Plugins and Applications

* Install and activate the **ServiceNow Integration Hub Enterprise Pack Installer \[com.glide.hub.integrations.enterprise\]** plugin.
* Install and activate the **Security Incident Response plugin (com.snc.securityincident)**, which automatically installs dependencies needed by SIR.
* Sequentially install and activate additional Security Operations applications from the ServiceNow Store, including Security Incident Response Dependency, Security Integration Framework, Security Support Common, Security Support Orchestration, Threat Intelligence Support Common, Trusted Security Circles, Security Operations Setup Assistant, and Security Incident Response itself.

## Zscaler Version and Permissions Requirements

* This integration supports Zscaler Internet Access version 1.0 or later.
* Compatibility tested with Zscaler Client Connector versions 3.0 for Windows and macOS, Beta for Linux, and Zscaler Cloud Connector 6.1.
* Obtain necessary admin credentials and API access permissions for Zscaler Internet Access, including a valid cloud service API subscription provided by Zscaler Support.
* API authentication can use Basic Auth (admin username and password combined with API key) or OAuth 2.0 (client ID, client secret, and tenant vanity domain).

## What This Enables for ServiceNow Customers

By following these steps, customers can integrate Zscaler Internet Access security data directly into ServiceNow's Security Incident Response workflows. This integration streamlines incident detection and response, automates threat categorization through URL Category lists, and enhances overall security operations efficiency.  
Activate and set up the Zscaler Internet Access product to interface
with your ServiceNow AI Platform instance and Security Incident Response
product.
{#get-started-with-zscaler__table_z2c_gyj_vpb__entry__2}

| Setup task | Description |
|-|-|
| Assign and verify the required ServiceNow AI Platform and Security Incident Response roles. | These roles are required for configuration and verification of the expected results: * The admin role installs the integration from the ServiceNow Store and assigns the sn_si.admin role. * The sn_si.admin role performs the following tasks: * Configures the integration. * Creates, activates, and removes the URL Category lists. * Assigns the sn_si.analyst role. {#get-started-with-zscaler__ul_bfc_gyj_vpb} * The sn_si.analyst role creates entries and works with security incidents. {#get-started-with-zscaler__ul_afc_gyj_vpb} |
| Verify that the ServiceNow core applications are installed and activated before you configure this integration. | The ServiceNow Integration Hub Enterprise Pack Installer \[com.glide.hub.integrations.enterprise\] plugin is required. The Security Incident Response plugin (com.snc.security_incident) is required. This plugin automatically installs all the dependencies for the Security Incident Response product. Install and activate this plugin before you install and activate the other Security Operations applications for the integration. Verify that the following Security Operations applications are installed and activated from the ServiceNow Store. If these applications are not already installed, install and activate each application one at a time in the following order: 1. Security Incident Response Dependency (com.snc.si_dep) 2. Security Integration Framework 3. Security Support Common 4. Security Support Orchestration 5. Threat Intelligence Support Common 6. Trusted Security Circles 7. Security Operations Setup Assistant 8. Security Incident Response {#get-started-with-zscaler__ol_dfc_gyj_vpb} |
| Verify the Zscaler versions. | * This integration is supported on Zscaler Internet Access version 1.0 or later. * This integration is tested with the following Zscaler versions: * Zscaler Client Connector for Windows - 3.0 * Zscaler Client Connector for macOS - 3.0 * Zscaler Client Connector for Linux - Beta * Zscaler Cloud Connector - 6.1 {#get-started-with-zscaler__ul_cvh_sbk_vpb} {#get-started-with-zscaler__ul_xhf_rbk_vpb} |
| Verify that you have the required Zscaler permissions and have configured [access to the Zscaler Internet Access APIs](https://www.servicenow.com/docs/BHxSp~Zb5dlz89wPst06MA "Configure access to the Zscaler Internet Access server to authenticate the secure connection between the ServiceNow AI Platform instance and the Zscaler server."). | * You must have the admin credentials for Zscaler Internet Access. * You must have a valid cloud service API subscription. Zscaler Support must provide your key. * If you use Basic Auth, you must have Zscaler Internet Access admin credentials (user name and password). API authentication is based on a combination of the API key and Zscaler Internet Access admin credentials. * If you use OAuth 2.0, you must have a client ID, a client secret, and your tenant's vanity domain. For example, `acme.zslogin.net`. {#get-started-with-zscaler__ul_qbs_fck_vpb} Note: For more information on managing the Zscaler Internet Access API keys, see the [Zscaler documentation](https://help.zscaler.com/zia/api-getting-started#CreateSession). |
[Table 1. Checklist]

{#get-started-with-zscaler__table_z2c_gyj_vpb}