Submit observables from a security incident record to a URL category list

Submit observables that are attached to a security incident record to a configured URL category list by using the allow or block request. Adding observables to the allow or block list for security scans allows users to review content from these URLs and gain access to trusted content.

Before you begin

Role required: sn_si.analyst

About this task

You submit observable entries by using the allow or block request action from the Associated Observables related list. Observables are artifacts found on a network or operating system that are likely to indicate an intrusion. Use the list of URL Categories configured previously to select the observable that you want to submit. After you submit the request, an approval request is sent to your approval group.

Procedure

1. Navigate to All > Security Incident > Incidents > Show All Incidents.
2. Select the security incident that you want to associate with the Zscaler allow or block request.
3. Select Show All Related Lists and the Associated Observables tab.
   If you do not find any observables, Select New.
4. Select an observable and then from the actions menu, select Allow/Block Request.
5. In the Allow/Block Request dialog box, select whether to perform the allow or block request on the observable.
6. Select Submit.
7. View the Work notes to see the status of your submission and the security tags.
   Select the links in the Work notes for more information about the status or to analyze the details on the Workflow Studio. Security tags are metadata on the responding record and define who should have access to specific types of security content.
8. To view the status of the observable that you selected, navigate to Zscaler Integration > Zscaler URL Category List Entries.
9. In the Zscaler URL Category List Entries page, select the observable to view the record.