---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Security Incident Response integration with Zscaler

# Security Incident Response integration with Zscaler {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Security Incident Response integration with Zscaler

The Security Incident Response integration with Zscaler connects your Zscaler Internet Access (ZIA) server logs with the ServiceNow AI Platform.
This cloud-delivered web gateway integration provides valuable data points and insights into your enterprise security environment.
It enhances visibility into internet usage and supports security investigations within ServiceNow.
Show full answer Show less  

## Key Features

* **Reputation Lookup:** Check observables against Zscaler's global threat library, which includes data on threat trends, origins, destinations, volume, and categories, enabling comprehensive threat investigations.
* **Observable Management:** Maintain observables in block or allow lists directly within the Zscaler product, helping enforce security policies efficiently.
* **Sandbox Analysis:** Retrieve and review sandbox reports for files via MD5 hash. The Cloud Sandbox runs files in a virtual environment to detect malicious behavior.
* **Security Alerts:** Receive alerts from Patient 0 events generated when users download unknown malicious files, facilitating early incident detection.
* **URL Category Lists:** Utilize multiple URL category lists as block or allow lists, with automatic expiration of old entries to manage list size effectively.
* **Approval Workflow:** Govern the addition and removal of observables from URL category lists through an approval process, ensuring controlled security updates.
* **Incident Tagging and Linking:** Tag ServiceNow AI Platform security incidents with URL categories, linking entries to observable records and threat intelligence for detailed incident context.

## Practical Benefits for ServiceNow Customers

By integrating Zscaler with ServiceNow, customers gain enhanced threat visibility and actionable insights directly within the AI Platform. This enables faster and more informed security incident investigations, streamlined management of threat data, and improved enforcement of security policies through automated workflows and detailed threat intelligence.  
You can use the Security Incident Response integration with Zscaler product to connect
your Zscaler Internet Access server (ZIA) logs with the ServiceNow AI Platform.
This integration enables you to view dashboards, create custom alerts, and help you investigate
security incidents.

## Request apps on the Store {#zscaler-integration-for-security-operations__section_qdr_5nw_v4b}

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#zscaler-integration-for-security-operations__inline-send-to-store}

## Overview {#zscaler-integration-for-security-operations__section_ddh_hsj_vpb}

The Zscaler internet and web gateway product is delivered from the cloud. It
provides you with the key data points and insights into your enterprise security environment.
Security Incident Response integration with Zscaler connects the Zscaler Internet Access product with your ServiceNow AI Platform instance. By using
the Zscaler product on the ServiceNow AI Platform, you get more insights into
your organization's internet usage.

## Key features of the integration {#zscaler-integration-for-security-operations__section_djq_hsj_vpb}

This integration includes the following key features:

* Reputation lookup of observables against the global threat library that the Zscaler product maintains.  
  Note:  
  The Zscaler global threat library lists threats by trends, country of origin, target destination, volume, and various threat categories. This global threat library enables you to investigate your observables against the global threat landscape.
* Maintenance of observables in a block list or allow list on the Zscaler product.
* Ability to fetch and review sandbox reports from the Zscaler product for an MD5 hash. The Cloud Sandbox feature in the Zscaler product runs and analyzes files in a virtual environment to detect malicious behavior.
* Security alerts from Patient 0 events that are generated in the Zscaler product when a user downloads an unknown malicious file.
* Multiple URL category lists that act as block lists or allow lists as defined in the Zscaler product.
* ServiceNow AI Platform security incidents that can be tagged to identify the URL category that the observables are added to.
* Expiration periods that maintain the size of the URL category list entries by automatically expiring or removing the older entries.
* Approval workflow for adding and removing observables from the URL category lists.
* URL category entries that can be linked to observable records and security incidents that include threat intelligence results and details about why an entry is blocked.
{#zscaler-integration-for-security-operations__ul_tpd_jsj_vpb}

## Learn about this integration {#zscaler-integration-for-security-operations__section_bsv_lws_qpb}

{#zscaler-integration-for-security-operations__table_ggn_x4y_ymb__entry__2}

| Document identifier | Document title |
|-|-|
| Zscaler product documentation website | [ZScaler Product Documentation website](https://help.zscaler.com/) |
| ServiceNow product documentation website | [ServiceNow Product Documentation website](https://www.servicenow.com/docs) |
[ ]

{#zscaler-integration-for-security-operations__table_ggn_x4y_ymb}