--- title: "Response Actions for Zscaler Internet Access" slug: "response-actions-for-zscaler-internet-access" updated: 2026-09-09T16:09:40Z published: 2026-09-09T16:09:40Z canonical: "docs.redcanary.com/response-actions-for-zscaler-internet-access" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Response Actions for Zscaler Internet Access The Zscaler MDR [Automation](/doc/docs/automation) interface provides the following 10 response actions for Zscaler Internet Access: **Add IOC URLs to URL Category** Adds URLs/domains that are marked as indicators of compromise (IOCs) to the specified [URL Category](https://help.zscaler.com/zia/about-url-categories). Based on the [URL Filtering policy](https://help.zscaler.com/zia/about-url-filtering) applied to that category, use this action to block traffic, display a warning, enforce browser isolation, enforce conditional access, etc. **Remove IOC URLs from URL Category** Removes URLs/domains that are marked as indicators of compromise (IOCs) from the specified [URL Category](https://help.zscaler.com/zia/about-url-categories). Use this action to undo a previous “Add” action or remove a URL from a whitelisted category. **Add IOC IPs to Source IP Group** Adds source IP addresses that are marked as indicators of compromise (IOCs) to the specified [Source IP Group](https://help.zscaler.com/zia/about-source-ip-groups). Based on the policies that apply to that group ([firewall filtering rules](https://help.zscaler.com/zia/configuring-firewall-filtering-policy), [NAT rules](https://help.zscaler.com/zia/configuring-nat-control-policy), [DNS rules](https://help.zscaler.com/zia/configuring-dns-control-policy), [IPS Control policies](https://help.zscaler.com/zia/configuring-ips-control-policy), [forwarding rules](https://help.zscaler.com/zia/configuring-forwarding-policy), [DLP rules](https://help.zscaler.com/zia/configuring-dlp-policy-rules-content-inspection), [URL filtering rules](https://help.zscaler.com/zia/configuring-url-filtering-policy), or [TLS Inspection rules](https://help.zscaler.com/zia/configuring-ssl-inspection-policy)), use this action to control your inbound/outbound traffic from the source IP. **Remove IOC IPs from Source IP Group** Removes source IP addresses that are marked as indicators of compromise (IOCs) from the specified [Source IP Group](https://help.zscaler.com/zia/about-source-ip-groups). Use this action to undo a previous “Add” action or remove an IP address from a whitelisted group. **Add IOC IPs/Domains to Destination IP Group** Adds destination IP addresses or domains that are marked as indicators of compromise (IOCs) to the specified [Destination IP Group](https://help.zscaler.com/zia/about-destination-ip-groups). Based on the policies that apply to that group ([firewall filtering rules](https://help.zscaler.com/zia/configuring-firewall-filtering-policy), [NAT rules](https://help.zscaler.com/zia/configuring-nat-control-policy), [DNS rules](https://help.zscaler.com/zia/configuring-dns-control-policy), [IPS Control policies](https://help.zscaler.com/zia/configuring-ips-control-policy), [forwarding rules](https://help.zscaler.com/zia/configuring-forwarding-policy), or [TLS Inspection rules](https://help.zscaler.com/zia/configuring-ssl-inspection-policy)) use this action to control your inbound/outbound traffic from the destination IP or domain. **Remove IOC IPs/Domains to Destination IP Group** Removes destination IP addresses or domains that are marked as indicators of compromise (IOCs) from the specified [Destination IP Group](https://help.zscaler.com/zia/about-destination-ip-groups). Use this action to undo a previous “Add” action or remove an IP/domain from a whitelisted group. **Add IOC File Hashes to the Deny list** Adds MD5 hashes that are marked as indicators of compromise (IOCs) to the [Sandbox Deny list](https://help.zscaler.com/zia/add-custom-file-hashes). Use this action to block download of known malicious files. **Remove IOC File Hashes from the Deny list** Removes MD5 hashes that are marked as indicators of compromise (IOCs) from the [Sandbox Deny list](https://help.zscaler.com/zia/add-custom-file-hashes). Use this action to undo a previous “Add” action. **Add IOC File Hashes to the Allow list** Adds MD5 hashes that are marked as indicators of compromise (IOCs) to the [Sandbox Allow list](https://help.zscaler.com/zia/add-custom-file-hashes). Use this action to whitelist known good files. **Remove IOC File Hashes from the Allow list** Removes MD5 hashes that are marked as indicators of compromise (IOCs) from the [Sandbox Allow list](https://help.zscaler.com/zia/add-custom-file-hashes). Use this action to undo a previous “Add” action or remove an IP/domain from the whitelist. ## Prerequisites You have an active Zscaler MDR [Zscaler OneAPI integration](/doc/docs/integrate-zscaler-oneapi-with-red-canary) configured. ## Adding Zscaler Internet Access Response Actions to a Playbook To add one or more Zscaler Internet Access response actions to an Automate playbook: 1. From the Zscaler MDR portal navigation menu, select **Automation > Playbooks**. 2. In the **Playbooks** section, open an existing Automate playbook or make a new one by clicking **+Create New Playbook**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(51).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 3. Assign or edit the playbook name and description, then click **+Add Action**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(52).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 4. From the **Zscaler Internet Access** section, add the required action to the playbook. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(53).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 5. Enter the target ZIA **Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(54).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 6. If needed, select the target **URL Category**, **Source IP Group**, or **Destination IP Group**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(55).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 7. [OPTIONAL] Check the **Require Approval** box and provide contact details if you want someone to approve this action before it executes. This will apply to both manual and automatically-triggered executions. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(56).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 8. Click **Save**. ## Manually Executing the Response Actions To execute the Zscaler Internet Access response actions manually: 1. Open the playbook and click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(57).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 2. Search for the threat in the dropdown list then click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(58).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 3. Click the **Follow along…** link to view the results of the action. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(59).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A09%3A36Z&se=2026-11-04T16%3A09%3A36Z&sr=c&sp=r&sig=jRxLwA9yrdC%2BJbGB4VibBYWUv%2FACshjsvoqnTnQL1DY%3D) 4. If you set the action to **Require Approval**, you’ll need to approve it before it can execute. ## Automatically Executing the Response Actions To execute the Zscaler Internet Access response actions automatically, link an appropriate trigger to the playbook. For more information, see [Customize When a Playbook is Run With Triggers](/doc/docs/customize-when-a-playbook-is-run-with-triggers). ## FAQ --- ### #### When should I use URL Category versus Destination IP Group? Use URL Category actions when you need to target specific URLs (rather than entire domains), and when you need to target web traffic (HTTP/HTTPS) exclusively. Use Destination IP Group actions when you need to target IP addresses or entire domains, or when you need to block all network traffic (not just web traffic). #### When should I use Source IP Group versus Destination IP Group? Use Source IP Group actions when you need to target an endpoint within your organization. Use Destination IP Group actions when you need to target an endpoint on the internet.