riposte-marketplace/integrations/zscaler/manifest.yaml

id: zscaler
name: Zscaler Internet Access
version: 1.1.1
description: "Zscaler Internet Access (ZIA REST API) — web-layer containment: block/unblock URLs and IPs (advanced block list), manage the allow list, add URLs to custom categories, read Sandbox reports, and activate configuration changes. Session-based API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 7 commands that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: URL/IP block list add/remove, block-list and allow-list read, allow-list add, category URL add, Sandbox report, activate changes."
category: network

# Per-instance configuration. Authentication is session-based: each command logs
# in with the obfuscated API key + username/password, then reuses the session
# cookie for the request.
config_schema:
  properties:
    cloud:
      type: string
      description: "Zscaler cloud base URL (e.g. https://zsapi.zscalertwo.net)"
    username:
      type: string
      description: "ZIA admin username"
    password:
      type: string
      description: "ZIA admin password"
      x-soar-sensitive: true
    api_key:
      type: string
      description: "ZIA API key"
      x-soar-sensitive: true
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - cloud
    - username
    - password
    - api_key

commands:
  - id: blacklist_url
    name: zscaler-blacklist-url
    description: "Add one or more URLs to the advanced block list."
    risk: destructive
    inputs_schema:
      properties:
        urls: { type: string, description: "Comma-separated URLs to block" }
      required: [urls]
    outputs_schema: { properties: {} }
  - id: undo_blacklist_url
    name: zscaler-undo-blacklist-url
    description: "Remove one or more URLs from the advanced block list."
    risk: destructive
    inputs_schema:
      properties:
        urls: { type: string, description: "Comma-separated URLs to remove" }
      required: [urls]
    outputs_schema: { properties: {} }
  - id: blacklist_ip
    name: zscaler-blacklist-ip
    description: "Add one or more IP addresses to the advanced block list."
    risk: destructive
    inputs_schema:
      properties:
        ips: { type: string, description: "Comma-separated IP addresses to block" }
      required: [ips]
    outputs_schema: { properties: {} }
  - id: undo_blacklist_ip
    name: zscaler-undo-blacklist-ip
    description: "Remove one or more IP addresses from the advanced block list."
    risk: destructive
    inputs_schema:
      properties:
        ips: { type: string, description: "Comma-separated IP addresses to remove" }
      required: [ips]
    outputs_schema: { properties: {} }
  - id: get_blacklist
    name: zscaler-get-blacklist
    description: "Get the current advanced block list (URLs and IPs)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: whitelist_url
    name: zscaler-whitelist-url
    description: "Add one or more URLs to the allow list."
    risk: destructive
    inputs_schema:
      properties:
        urls: { type: string, description: "Comma-separated URLs to allow" }
      required: [urls]
    outputs_schema: { properties: {} }
  - id: get_whitelist
    name: zscaler-get-whitelist
    description: "Get the current allow list."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: category_add_url
    name: zscaler-category-add-url
    description: "Add one or more URLs to a custom URL category."
    risk: destructive
    inputs_schema:
      properties:
        category_id: { type: string, description: "URL category id (from zscaler-get-categories)" }
        urls: { type: string, description: "Comma-separated URLs to add to the category" }
      required: [category_id, urls]
    outputs_schema: { properties: {} }
  - id: get_categories
    name: zscaler-get-categories
    description: "List URL categories (id and name)."
    risk: read
    inputs_schema:
      properties:
        custom_only: { type: boolean, description: "Return only custom categories (default false)" }
      required: []
    outputs_schema: { properties: {} }
  - id: sandbox_report
    name: zscaler-sandbox-report
    description: "Get the Zscaler Sandbox report for a file by MD5 hash."
    risk: read
    inputs_schema:
      properties:
        md5: { type: string, description: "MD5 hash of the file" }
        details: { type: string, description: "Report detail level: 'full' or 'summary' (default full)" }
      required: [md5]
    outputs_schema: { properties: {} }
  - id: activate_changes
    name: zscaler-activate-changes
    description: "Activate pending configuration changes in the Zscaler session."
    risk: destructive
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: zscaler-test-connection
    description: "Verify connectivity and credentials by opening a session (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }