{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Mon Oct 16 22:55:48 2023","cloudname":"zscaler.net","host":"mail.google.com","serverip":"81.2.69.144","external_devid":"1234","devicemodel":"20L8S7WC08","action":"Allowed","recordid":"123456789","reason":"File Attachment Cautioned","threatseverity":"Critical (90–100)","tz":"GMT","filesubtype":"rar","upload_filesubtype":"rar","sha256":"81ec78bc8298568bb5ea66d3c2972b670d0f7459b6cdbbcaacce90ab417ab15c","bamd5":"196a3d797bfee07fe4596b69f4ce1141","filename":"nssfeed.txt","upload_filename":"nssfeed.exe","filetype":"RAR Files","devicename":"PC11NLPA:5F08D97BBF43257A8FB4BBF4061A38AE324EF734","devicehostname":"THINKPADSMITH","deviceostype":"iOS","deviceosversion":"Version 10.14.2 (Build 18C54)","devicetype":"Zscaler Client Connector","reqsize":"1300","reqmethod":"invalid","b64referer":"d3d3LmV4YW1wbGUuY29t","respsize":"10500","respcode":"100","reqversion":"1.1","respversion":"1","proto":"HTTP","company":"Zscaler","dlpmd5":"154f149b1443fbfa8c121d13e5c019a1","apprulelabel":"File_Sharing_1","dlprulename":"DLP_Rule_1","rulelabel":"URL_Filtering_1","urlfilterrulelabel":"URL_Filtering_1","cltip":"10.0.0.2","cltintip":"192.168.1.10","cltsourceport":"1235","threatname":"EICAR Test File","cltsslcipher":"SSL3_CK_RSA_NULL_MD5","clttlsversion":"SSL2","b64url":"d3d3LnRyeXRoaXNlbmNvZGV1cmwuY29tL2luZGV4","useragent":"Mozilla/5.0","login":"jdoe@safemarch.com","applayerprotocol":"FTP","appclass":"Administration","appname":"Adobe Connect","appriskscore":"None","bandwidthclassname":"Entertainment","bandwidthrulename":"Office 365","bwthrottle":"Yes","bypassedtime":"Mon Oct 16 22:55:48 2023","bypassedtraffic":"0","cltsslsessreuse":"Unknown","cltpubip":"10.0.0.3","cltsslfailcount":"100","cltsslfailreason":"Bad Record Mac","client_tls_keyex_pqc_offers":0,"client_tls_keyex_non_pqc_offers":0,"client_tls_keyex_hybrid_offers":1,"client_tls_keyex_unknown_offers":1,"client_tls_sig_pqc_offers":1,"client_tls_sig_non_pqc_offers":0,"client_tls_sig_hybrid_offers":1,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"X23319LMKEM788","client_tls_sig_alg":"rsa_pss_rsae_sha256","contenttype":"application/vnd_apple_keynote","datacentercity":"Sa","datacentercountry":"US","datacenter":"CA Client Node DC","day":"Mon","day_of_month":"16","dept":"Sales","dstip_country":"India","deviceappversion":"192.168.1.100","deviceowner":"jsmith","df_hosthead":"df_hosthead","df_hostname":"df_hostname","dlpdicthitcount":"4","dlpdict":"Credit Cards","dlpeng":"HIPAA","dlpidentifier":"6646484838839026000","eedone":"Yes","epochtime":"1578128400","fileclass":"Active Web Contents","flow_type":"Direct","forward_gateway_ip":"10.1.1.1","forward_gateway_name":"FWD_1","forward_type":"Direct","ft_rulename":"FT Name","hour":"22","is_sslexpiredca":"Yes","is_sslselfsigned":"Yes","is_ssluntrustedca":"Pass","is_src_cntry_risky":"Yes","is_dst_cntry_risky":"No","keyprotectiontype":"HSM Protection","location":"Headquarters","malwarecategory":"Adware","malwareclass":"Sandbox","minute":"55","mobappcategory":"Communication","mobappname":"Amazon","mobdevtype":"Google Android","module":"Administration","month":"Oct","month_of_year":"10","nssserviceip":"192.168.2.200","oapprulelabel":"5300295980","obwclassname":"10831489","ocip":"6200694987","ocpubip":"624054738","odevicehostname":"2168890624","odevicename":"2175092224","odeviceowner":"10831489","odlpdict":"10831489","odlpeng":"4094304256","odlprulename":"6857275752","ofwd_gw_name":"8794487099","ologin":"4094304256","ordr_rulename":"3399565100","ourlcat":"7956407282","ourlfilterrulelabel":"4951704103","ozpa_app_seg_name":"7648246731","externalsslpolicyreason":"Blocked","productversion":"5.0.902.95524_04","prompt_req":"Prompt","rdr_rulename":"FWD_Rule_1","refererhost":"www.example.com for http://www.example.com/index.html","reqheadersize":"300","reqdatasize":"1000","respheadersize":"500","respdatasize":"10000","riskscore":"10","ruletype":"File Type Control","second":"48","srcip_country":"India","srvcertchainvalpass":"Unknown","srvcertvalidationtype":"EV (Extended Validation)","srvcertvalidityperiod":"Short","srvsslcipher":"SSL3_CK_RSA_NULL_MD5","serversslsessreuse":"Unknown","server_tls_keyex_alg":"X23319LMKEM788","server_tls_sig_alg":"rsa_pss_rsae_sha256","srvocspresult":"Good","srvtlsversion":"SSL2","srvwildcardcert":"Unknown","ssldecrypted":"Yes","ssl_rulename":"SSL Policy","throttlereqsize":"5","throttlerespsize":"7","totalsize":"11800","trafficredirectmethod":"DNAT (Destination Translation)","unscannabletype":"Encrypted File","upload_doctypename":"Corporate Finance","upload_fileclass":"upload_fileclass","upload_filetype":"RAR Files","urlcatmethod":"Database A","urlsubcat":"Entertainment","urlsupercat":"Travel","urlclass":"Bandwidth Loss","useragentclass":"Firefox","useragenttoken":"Google Chrome (0.x)","userlocationname":"userlocationname","year":"2023","ztunnelversion":"ZTUNNEL_1_0","zpa_app_seg_name":"ZPA_test_app_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Tue Oct 17 09:23:15 2023","cloudname":"zscaler.net","host":"www.dropbox.com","serverip":"81.2.69.142","external_devid":"2345","devicemodel":"MacBookPro16,1","action":"Blocked","recordid":"987654321","reason":"Malware Detected","threatseverity":"High (70–89)","tz":"GMT","filesubtype":"exe","upload_filesubtype":"exe","sha256":"a3f5b8c9d2e1f4a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0","bamd5":"abc123def456789012345678901234ab","filename":"malware.exe","upload_filename":"update.exe","filetype":"Executable Files","devicename":"MAC01:9A8B7C6D5E4F3A2B1C0D9E8F7A6B5C4D3E2F1A0B","devicehostname":"MACBOOK-JONES","deviceostype":"macOS","deviceosversion":"Version 13.5.1 (Build 22G90)","devicetype":"Zscaler Client Connector","reqsize":"2500","reqmethod":"GET","b64referer":"ZHJvcGJveC5jb20vZmlsZXM=","respsize":"45000","respcode":"403","reqversion":"2.0","respversion":"2","proto":"HTTPS","company":"Acme Corp","dlpmd5":"fedcba9876543210fedcba9876543210","apprulelabel":"Cloud_Storage_Block","dlprulename":"DLP_Sensitive_Data","rulelabel":"Cloud_Block_Rule","urlfilterrulelabel":"Cloud_Block_Rule","cltip":"10.0.0.51","cltintip":"192.168.10.25","cltsourceport":"54321","threatname":"Trojan.GenericKD","cltsslcipher":"TLS_AES_256_GCM_SHA384","clttlsversion":"TLS1.3","b64url":"d3d3LmRyb3Bib3guY29tL2Rvd25sb2Fk","useragent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)","login":"mjones@acmecorp.com","applayerprotocol":"HTTPS","appclass":"Cloud Storage","appname":"Dropbox","appriskscore":"Medium","bandwidthclassname":"Cloud Services","bandwidthrulename":"Cloud Throttle","bwthrottle":"No","bypassedtime":"Tue Oct 17 09:23:15 2023","bypassedtraffic":"0","cltsslsessreuse":"Yes","cltpubip":"10.0.0.52","cltsslfailcount":"0","cltsslfailreason":"None","client_tls_keyex_pqc_offers":1,"client_tls_keyex_non_pqc_offers":1,"client_tls_keyex_hybrid_offers":0,"client_tls_keyex_unknown_offers":0,"client_tls_sig_pqc_offers":0,"client_tls_sig_non_pqc_offers":1,"client_tls_sig_hybrid_offers":0,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"ECDHE","client_tls_sig_alg":"ecdsa_secp256r1_sha256","contenttype":"application/octet-stream","datacentercity":"San Francisco","datacentercountry":"US","datacenter":"SF Client Node DC","day":"Tue","day_of_month":"17","dept":"Engineering","dstip_country":"United States","deviceappversion":"192.168.10.50","deviceowner":"mjones","df_hosthead":"dropbox_host","df_hostname":"dropbox_hostname","dlpdicthitcount":"8","dlpdict":"PII Data","dlpeng":"GDPR","dlpidentifier":"7757595949950137111","eedone":"Yes","epochtime":"1697533395","fileclass":"Executable Content","flow_type":"Proxy","forward_gateway_ip":"10.2.2.1","forward_gateway_name":"FWD_2","forward_type":"Proxy","ft_rulename":"Block Executables","hour":"09","is_sslexpiredca":"No","is_sslselfsigned":"No","is_ssluntrustedca":"Pass","is_src_cntry_risky":"No","is_dst_cntry_risky":"No","keyprotectiontype":"Software Protection","location":"San Francisco Office","malwarecategory":"Trojan","malwareclass":"Cloud Sandbox","minute":"23","mobappcategory":"Productivity","mobappname":"Dropbox","mobdevtype":"Apple macOS","module":"Web Security","month":"Oct","month_of_year":"10","nssserviceip":"192.168.3.100","oapprulelabel":"6411306091","obwclassname":"21942600","ocip":"7311805098","ocpubip":"735165849","odevicehostname":"3279901735","odevicename":"3286203335","odeviceowner":"21942600","odlpdict":"21942600","odlpeng":"5205415367","odlprulename":"7968386863","ofwd_gw_name":"9905598210","ologin":"5205415367","ordr_rulename":"4510676211","ourlcat":"8067518393","ourlfilterrulelabel":"5062815214","ozpa_app_seg_name":"8759357842","externalsslpolicyreason":"Allowed","productversion":"5.1.0.100_05","prompt_req":"Block","rdr_rulename":"FWD_Rule_2","refererhost":"www.dropbox.com for https://www.dropbox.com/home","reqheadersize":"450","reqdatasize":"2050","respheadersize":"600","respdatasize":"44400","riskscore":"75","ruletype":"Malware Protection","second":"15","srcip_country":"United States","srvcertchainvalpass":"Pass","srvcertvalidationtype":"OV (Organization Validation)","srvcertvalidityperiod":"Standard","srvsslcipher":"TLS_AES_256_GCM_SHA384","serversslsessreuse":"Yes","server_tls_keyex_alg":"ECDHE","server_tls_sig_alg":"ecdsa_secp256r1_sha256","srvocspresult":"Good","srvtlsversion":"TLS1.3","srvwildcardcert":"Yes","ssldecrypted":"Yes","ssl_rulename":"Inspect All","throttlereqsize":"0","throttlerespsize":"0","totalsize":"47500","trafficredirectmethod":"GRE Tunnel","unscannabletype":"None","upload_doctypename":"Engineering Docs","upload_fileclass":"executable_class","upload_filetype":"Executable Files","urlcatmethod":"Database A","urlsubcat":"Cloud Storage","urlsupercat":"Business","urlclass":"Acceptable Use","useragentclass":"Safari","useragenttoken":"Safari (16.x)","userlocationname":"sf_office","year":"2023","ztunnelversion":"ZTUNNEL_2_0","zpa_app_seg_name":"ZPA_dropbox_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Wed Oct 18 14:30:22 2023","cloudname":"zscaler.net","host":"slack.com","serverip":"81.2.69.142","external_devid":"3456","devicemodel":"Surface Pro 8","action":"Allowed","recordid":"456789123","reason":"Safe Content","threatseverity":"None (0)","tz":"GMT","filesubtype":"pdf","upload_filesubtype":"pdf","sha256":"b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6","bamd5":"def456789012345678901234567890cd","filename":"report.pdf","upload_filename":"quarterly_report.pdf","filetype":"PDF Documents","devicename":"SURF01:1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B","devicehostname":"SURFACE-WILLIAMS","deviceostype":"Windows","deviceosversion":"Windows 11 Pro (Build 22621)","devicetype":"Zscaler Client Connector","reqsize":"800","reqmethod":"POST","b64referer":"c2xhY2suY29tL3dvcmtzcGFjZQ==","respsize":"5200","respcode":"200","reqversion":"2.0","respversion":"2","proto":"HTTPS","company":"TechStart Inc","dlpmd5":"0123456789abcdef0123456789abcdef","apprulelabel":"Collaboration_Allow","dlprulename":"DLP_Standard","rulelabel":"Collab_Tools_Allow","urlfilterrulelabel":"Collab_Tools_Allow","cltip":"10.0.0.101","cltintip":"192.168.20.30","cltsourceport":"62345","threatname":"None","cltsslcipher":"TLS_CHACHA20_POLY1305_SHA256","clttlsversion":"TLS1.3","b64url":"c2xhY2suY29tL2FwaS9tZXNzYWdlcw==","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","login":"swilliams@techstart.io","applayerprotocol":"HTTPS","appclass":"Collaboration","appname":"Slack","appriskscore":"Low","bandwidthclassname":"Business Apps","bandwidthrulename":"Priority Traffic","bwthrottle":"No","bypassedtime":"Wed Oct 18 14:30:22 2023","bypassedtraffic":"0","cltsslsessreuse":"Yes","cltpubip":"10.0.0.102","cltsslfailcount":"0","cltsslfailreason":"None","client_tls_keyex_pqc_offers":0,"client_tls_keyex_non_pqc_offers":1,"client_tls_keyex_hybrid_offers":1,"client_tls_keyex_unknown_offers":0,"client_tls_sig_pqc_offers":1,"client_tls_sig_non_pqc_offers":1,"client_tls_sig_hybrid_offers":0,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"X25519","client_tls_sig_alg":"rsa_pss_rsae_sha256","contenttype":"application/json","datacentercity":"New York","datacentercountry":"US","datacenter":"NY Client Node DC","day":"Wed","day_of_month":"18","dept":"Marketing","dstip_country":"United States","deviceappversion":"192.168.20.100","deviceowner":"swilliams","df_hosthead":"slack_host","df_hostname":"slack_hostname","dlpdicthitcount":"0","dlpdict":"None","dlpeng":"Standard","dlpidentifier":"8868606050061248222","eedone":"Yes","epochtime":"1697639422","fileclass":"Document Content","flow_type":"Direct","forward_gateway_ip":"10.3.3.1","forward_gateway_name":"FWD_3","forward_type":"Direct","ft_rulename":"Allow Documents","hour":"14","is_sslexpiredca":"No","is_sslselfsigned":"No","is_ssluntrustedca":"Pass","is_src_cntry_risky":"No","is_dst_cntry_risky":"No","keyprotectiontype":"TPM Protection","location":"New York Office","malwarecategory":"None","malwareclass":"None","minute":"30","mobappcategory":"Business","mobappname":"Slack","mobdevtype":"Microsoft Windows","module":"Web Security","month":"Oct","month_of_year":"10","nssserviceip":"192.168.4.100","oapprulelabel":"7522417202","obwclassname":"32053711","ocip":"8422916209","ocpubip":"846276960","odevicehostname":"4390012846","odevicename":"4397314446","odeviceowner":"32053711","odlpdict":"32053711","odlpeng":"6316526478","odlprulename":"9079497974","ofwd_gw_name":"11016709321","ologin":"6316526478","ordr_rulename":"5621787322","ourlcat":"9178629504","ourlfilterrulelabel":"6173926325","ozpa_app_seg_name":"9870468953","externalsslpolicyreason":"Allowed","productversion":"5.1.1.200_06","prompt_req":"Allow","rdr_rulename":"FWD_Rule_3","refererhost":"slack.com for https://slack.com/workspace","reqheadersize":"350","reqdatasize":"450","respheadersize":"400","respdatasize":"4800","riskscore":"5","ruletype":"URL Filtering","second":"22","srcip_country":"United States","srvcertchainvalpass":"Pass","srvcertvalidationtype":"EV (Extended Validation)","srvcertvalidityperiod":"Standard","srvsslcipher":"TLS_CHACHA20_POLY1305_SHA256","serversslsessreuse":"Yes","server_tls_keyex_alg":"X25519","server_tls_sig_alg":"rsa_pss_rsae_sha256","srvocspresult":"Good","srvtlsversion":"TLS1.3","srvwildcardcert":"No","ssldecrypted":"Yes","ssl_rulename":"Standard Inspect","throttlereqsize":"0","throttlerespsize":"0","totalsize":"6000","trafficredirectmethod":"PAC File","unscannabletype":"None","upload_doctypename":"Marketing Materials","upload_fileclass":"document_class","upload_filetype":"PDF Documents","urlcatmethod":"Database A","urlsubcat":"Collaboration","urlsupercat":"Business","urlclass":"Productivity","useragentclass":"Edge","useragenttoken":"Microsoft Edge (118.x)","userlocationname":"ny_office","year":"2023","ztunnelversion":"ZTUNNEL_2_0","zpa_app_seg_name":"ZPA_slack_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Thu Oct 19 08:15:33 2023","cloudname":"zscaler.net","host":"github.com","serverip":"81.2.69.142","external_devid":"4567","devicemodel":"ThinkPad X1 Carbon","action":"Cautioned","recordid":"789123456","reason":"Sensitive Data Upload","threatseverity":"Medium (40–69)","tz":"GMT","filesubtype":"zip","upload_filesubtype":"zip","sha256":"c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7","bamd5":"567890abcdef123456789012345678ef","filename":"source_code.zip","upload_filename":"project_backup.zip","filetype":"Archive Files","devicename":"THINK01:2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C","devicehostname":"THINKPAD-CHEN","deviceostype":"Linux","deviceosversion":"Ubuntu 22.04.3 LTS","devicetype":"Zscaler Client Connector","reqsize":"15000","reqmethod":"PUT","b64referer":"Z2l0aHViLmNvbS9yZXBv","respsize":"1200","respcode":"201","reqversion":"2.0","respversion":"2","proto":"HTTPS","company":"DevOps Solutions","dlpmd5":"abcdef0123456789abcdef0123456789","apprulelabel":"Code_Repo_Caution","dlprulename":"DLP_Source_Code","rulelabel":"Dev_Tools_Monitor","urlfilterrulelabel":"Dev_Tools_Monitor","cltip":"10.0.0.151","cltintip":"192.168.30.40","cltsourceport":"43210","threatname":"None","cltsslcipher":"TLS_AES_128_GCM_SHA256","clttlsversion":"TLS1.3","b64url":"Z2l0aHViLmNvbS91cGxvYWQ=","useragent":"git/2.42.0","login":"lchen@devops-solutions.dev","applayerprotocol":"HTTPS","appclass":"Development","appname":"GitHub","appriskscore":"Low","bandwidthclassname":"Developer Tools","bandwidthrulename":"Dev Priority","bwthrottle":"No","bypassedtime":"Thu Oct 19 08:15:33 2023","bypassedtraffic":"0","cltsslsessreuse":"No","cltpubip":"10.0.0.152","cltsslfailcount":"0","cltsslfailreason":"None","client_tls_keyex_pqc_offers":1,"client_tls_keyex_non_pqc_offers":0,"client_tls_keyex_hybrid_offers":1,"client_tls_keyex_unknown_offers":0,"client_tls_sig_pqc_offers":0,"client_tls_sig_non_pqc_offers":1,"client_tls_sig_hybrid_offers":1,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"MLKEM768","client_tls_sig_alg":"ed25519","contenttype":"application/zip","datacentercity":"Seattle","datacentercountry":"US","datacenter":"SEA Client Node DC","day":"Thu","day_of_month":"19","dept":"Engineering","dstip_country":"United States","deviceappversion":"192.168.30.150","deviceowner":"lchen","df_hosthead":"github_host","df_hostname":"github_hostname","dlpdicthitcount":"12","dlpdict":"Source Code","dlpeng":"Code Protection","dlpidentifier":"9979717161172359333","eedone":"Yes","epochtime":"1697702133","fileclass":"Archive Content","flow_type":"Direct","forward_gateway_ip":"10.4.4.1","forward_gateway_name":"FWD_4","forward_type":"Direct","ft_rulename":"Monitor Archives","hour":"08","is_sslexpiredca":"No","is_sslselfsigned":"No","is_ssluntrustedca":"Pass","is_src_cntry_risky":"No","is_dst_cntry_risky":"No","keyprotectiontype":"Software Protection","location":"Seattle Office","malwarecategory":"None","malwareclass":"None","minute":"15","mobappcategory":"Development","mobappname":"GitHub","mobdevtype":"Linux Desktop","module":"DLP","month":"Oct","month_of_year":"10","nssserviceip":"192.168.5.100","oapprulelabel":"8633528313","obwclassname":"43164822","ocip":"9534027320","ocpubip":"957388071","odevicehostname":"5501123957","odevicename":"5508425557","odeviceowner":"43164822","odlpdict":"43164822","odlpeng":"7427637589","odlprulename":"10190609085","ofwd_gw_name":"12127820432","ologin":"7427637589","ordr_rulename":"6732898433","ourlcat":"10289740615","ourlfilterrulelabel":"7285037436","ozpa_app_seg_name":"10981580064","externalsslpolicyreason":"Allowed","productversion":"5.2.0.300_07","prompt_req":"Caution","rdr_rulename":"FWD_Rule_4","refererhost":"github.com for https://github.com/repo","reqheadersize":"500","reqdatasize":"14500","respheadersize":"350","respdatasize":"850","riskscore":"45","ruletype":"DLP Control","second":"33","srcip_country":"United States","srvcertchainvalpass":"Pass","srvcertvalidationtype":"EV (Extended Validation)","srvcertvalidityperiod":"Long","srvsslcipher":"TLS_AES_128_GCM_SHA256","serversslsessreuse":"No","server_tls_keyex_alg":"MLKEM768","server_tls_sig_alg":"ed25519","srvocspresult":"Good","srvtlsversion":"TLS1.3","srvwildcardcert":"No","ssldecrypted":"Yes","ssl_rulename":"Dev SSL Policy","throttlereqsize":"0","throttlerespsize":"0","totalsize":"16200","trafficredirectmethod":"DNAT (Destination Translation)","unscannabletype":"None","upload_doctypename":"Source Code","upload_fileclass":"archive_class","upload_filetype":"Archive Files","urlcatmethod":"Database A","urlsubcat":"Software Development","urlsupercat":"Technology","urlclass":"Acceptable Use","useragentclass":"CLI Tool","useragenttoken":"git (2.x)","userlocationname":"sea_office","year":"2023","ztunnelversion":"ZTUNNEL_2_0","zpa_app_seg_name":"ZPA_github_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Fri Oct 20 16:45:11 2023","cloudname":"zscaler.net","host":"twitter.com","serverip":"81.2.69.142","external_devid":"5678","devicemodel":"iPhone 14 Pro","action":"Blocked","recordid":"321654987","reason":"Social Media Policy","threatseverity":"Low (1–39)","tz":"GMT","filesubtype":"jpg","upload_filesubtype":"jpg","sha256":"d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8","bamd5":"890abcdef123456789012345678901gh","filename":"photo.jpg","upload_filename":"profile_pic.jpg","filetype":"Image Files","devicename":"IPHONE01:3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D","devicehostname":"IPHONE-GARCIA","deviceostype":"iOS","deviceosversion":"iOS 17.0.3","devicetype":"Zscaler Client Connector","reqsize":"500","reqmethod":"GET","b64referer":"dHdpdHRlci5jb20vaG9tZQ==","respsize":"0","respcode":"403","reqversion":"2.0","respversion":"2","proto":"HTTPS","company":"Finance Corp","dlpmd5":"cdef0123456789abcdef012345678901","apprulelabel":"Social_Block","dlprulename":"DLP_None","rulelabel":"Social_Media_Block","urlfilterrulelabel":"Social_Media_Block","cltip":"10.0.0.201","cltintip":"192.168.40.50","cltsourceport":"32109","threatname":"None","cltsslcipher":"TLS_AES_256_GCM_SHA384","clttlsversion":"TLS1.3","b64url":"dHdpdHRlci5jb20vZmVlZA==","useragent":"Twitter/9.0 iOS/17.0.3","login":"agarcia@financecorp.com","applayerprotocol":"HTTPS","appclass":"Social Media","appname":"Twitter","appriskscore":"High","bandwidthclassname":"Social Media","bandwidthrulename":"Block Social","bwthrottle":"Yes","bypassedtime":"Fri Oct 20 16:45:11 2023","bypassedtraffic":"0","cltsslsessreuse":"Yes","cltpubip":"10.0.0.202","cltsslfailcount":"0","cltsslfailreason":"None","client_tls_keyex_pqc_offers":0,"client_tls_keyex_non_pqc_offers":1,"client_tls_keyex_hybrid_offers":0,"client_tls_keyex_unknown_offers":0,"client_tls_sig_pqc_offers":0,"client_tls_sig_non_pqc_offers":1,"client_tls_sig_hybrid_offers":0,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"ECDHE","client_tls_sig_alg":"rsa_pkcs1_sha256","contenttype":"text/html","datacentercity":"Chicago","datacentercountry":"US","datacenter":"CHI Client Node DC","day":"Fri","day_of_month":"20","dept":"Finance","dstip_country":"United States","deviceappversion":"192.168.40.200","deviceowner":"agarcia","df_hosthead":"twitter_host","df_hostname":"twitter_hostname","dlpdicthitcount":"0","dlpdict":"None","dlpeng":"None","dlpidentifier":"1010828272283470444","eedone":"No","epochtime":"1697820311","fileclass":"Image Content","flow_type":"Blocked","forward_gateway_ip":"10.5.5.1","forward_gateway_name":"FWD_5","forward_type":"Blocked","ft_rulename":"Block Images","hour":"16","is_sslexpiredca":"No","is_sslselfsigned":"No","is_ssluntrustedca":"Pass","is_src_cntry_risky":"No","is_dst_cntry_risky":"No","keyprotectiontype":"Secure Enclave","location":"Chicago Office","malwarecategory":"None","malwareclass":"None","minute":"45","mobappcategory":"Social Networking","mobappname":"Twitter","mobdevtype":"Apple iOS","module":"URL Filtering","month":"Oct","month_of_year":"10","nssserviceip":"192.168.6.100","oapprulelabel":"9744639424","obwclassname":"54275933","ocip":"10645138431","ocpubip":"1068499182","odevicehostname":"6612235068","odevicename":"6619536668","odeviceowner":"54275933","odlpdict":"54275933","odlpeng":"8538748700","odlprulename":"11301720196","ofwd_gw_name":"13238931543","ologin":"8538748700","ordr_rulename":"7844009544","ourlcat":"11400851726","ourlfilterrulelabel":"8396148547","ozpa_app_seg_name":"12092691175","externalsslpolicyreason":"Blocked","productversion":"5.2.1.400_08","prompt_req":"Block","rdr_rulename":"FWD_Rule_5","refererhost":"twitter.com for https://twitter.com/home","reqheadersize":"250","reqdatasize":"250","respheadersize":"0","respdatasize":"0","riskscore":"60","ruletype":"URL Filtering","second":"11","srcip_country":"United States","srvcertchainvalpass":"N/A","srvcertvalidationtype":"N/A","srvcertvalidityperiod":"N/A","srvsslcipher":"N/A","serversslsessreuse":"N/A","server_tls_keyex_alg":"N/A","server_tls_sig_alg":"N/A","srvocspresult":"N/A","srvtlsversion":"N/A","srvwildcardcert":"N/A","ssldecrypted":"No","ssl_rulename":"N/A","throttlereqsize":"0","throttlerespsize":"0","totalsize":"500","trafficredirectmethod":"PAC File","unscannabletype":"None","upload_doctypename":"None","upload_fileclass":"image_class","upload_filetype":"Image Files","urlcatmethod":"Database A","urlsubcat":"Social Networking","urlsupercat":"Personal","urlclass":"Blocked Category","useragentclass":"Mobile App","useragenttoken":"Twitter iOS (9.x)","userlocationname":"chi_office","year":"2023","ztunnelversion":"ZTUNNEL_2_0","zpa_app_seg_name":"ZPA_twitter_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Sat Oct 21 11:22:44 2023","cloudname":"zscaler.net","host":"aws.amazon.com","serverip":"81.2.69.144","external_devid":"6789","devicemodel":"Dell XPS 15","action":"Allowed","recordid":"654987321","reason":"Trusted Cloud Service","threatseverity":"None (0)","tz":"GMT","filesubtype":"json","upload_filesubtype":"json","sha256":"e7f9a1b3c5d7e9f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9","bamd5":"01234567890abcdef12345678901234ij","filename":"config.json","upload_filename":"lambda_config.json","filetype":"JSON Files","devicename":"DELL01:4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B1C2D3E","devicehostname":"DELLXPS-KUMAR","deviceostype":"Windows","deviceosversion":"Windows 11 Enterprise (Build 22631)","devicetype":"Zscaler Client Connector","reqsize":"3500","reqmethod":"POST","b64referer":"YXdzLmFtYXpvbi5jb20vY29uc29sZQ==","respsize":"8500","respcode":"200","reqversion":"2.0","respversion":"2","proto":"HTTPS","company":"Cloud Innovators","dlpmd5":"efgh0123456789abcdef0123456789ab","apprulelabel":"Cloud_Infrastructure_Allow","dlprulename":"DLP_Cloud_Config","rulelabel":"AWS_Allow","urlfilterrulelabel":"AWS_Allow","cltip":"10.0.0.251","cltintip":"192.168.50.60","cltsourceport":"21098","threatname":"None","cltsslcipher":"TLS_AES_256_GCM_SHA384","clttlsversion":"TLS1.3","b64url":"YXdzLmFtYXpvbi5jb20vbGFtYmRh","useragent":"aws-cli/2.13.0 Python/3.11.4","login":"rkumar@cloudinnovators.tech","applayerprotocol":"HTTPS","appclass":"Cloud Infrastructure","appname":"Amazon Web Services","appriskscore":"Low","bandwidthclassname":"Cloud Infrastructure","bandwidthrulename":"Cloud Priority","bwthrottle":"No","bypassedtime":"Sat Oct 21 11:22:44 2023","bypassedtraffic":"0","cltsslsessreuse":"Yes","cltpubip":"10.0.0.252","cltsslfailcount":"0","cltsslfailreason":"None","client_tls_keyex_pqc_offers":1,"client_tls_keyex_non_pqc_offers":1,"client_tls_keyex_hybrid_offers":1,"client_tls_keyex_unknown_offers":0,"client_tls_sig_pqc_offers":1,"client_tls_sig_non_pqc_offers":1,"client_tls_sig_hybrid_offers":1,"client_tls_sig_unknown_offers":0,"client_tls_keyex_alg":"ECDHE_KYBER","client_tls_sig_alg":"rsa_pss_rsae_sha384","contenttype":"application/json","datacentercity":"London","datacentercountry":"UK","datacenter":"LON Client Node DC","day":"Sat","day_of_month":"21","dept":"DevOps","dstip_country":"United States","deviceappversion":"192.168.50.250","deviceowner":"rkumar","df_hosthead":"aws_host","df_hostname":"aws_hostname","dlpdicthitcount":"2","dlpdict":"Cloud Config","dlpeng":"Cloud Security","dlpidentifier":"1121939383394581555","eedone":"Yes","epochtime":"1697887364","fileclass":"Configuration Content","flow_type":"Direct","forward_gateway_ip":"10.6.6.1","forward_gateway_name":"FWD_6","forward_type":"Direct","ft_rulename":"Allow Config Files","hour":"11","is_sslexpiredca":"No","is_sslselfsigned":"No","is_ssluntrustedca":"Pass","is_src_cntry_risky":"No","is_dst_cntry_risky":"No","keyprotectiontype":"HSM Protection","location":"London Office","malwarecategory":"None","malwareclass":"None","minute":"22","mobappcategory":"Cloud Services","mobappname":"AWS Console","mobdevtype":"Microsoft Windows","module":"Cloud Security","month":"Oct","month_of_year":"10","nssserviceip":"192.168.7.100","oapprulelabel":"10855750535","obwclassname":"65387044","ocip":"11756249542","ocpubip":"1179610293","odevicehostname":"7723346179","odevicename":"7730647779","odeviceowner":"65387044","odlpdict":"65387044","odlpeng":"9649859811","odlprulename":"12412831307","ofwd_gw_name":"14350042654","ologin":"9649859811","ordr_rulename":"8955120655","ourlcat":"12511962837","ourlfilterrulelabel":"9507259658","ozpa_app_seg_name":"13203802286","externalsslpolicyreason":"Allowed","productversion":"5.3.0.500_09","prompt_req":"Allow","rdr_rulename":"FWD_Rule_6","refererhost":"aws.amazon.com for https://aws.amazon.com/console","reqheadersize":"600","reqdatasize":"2900","respheadersize":"550","respdatasize":"7950","riskscore":"3","ruletype":"Cloud Access","second":"44","srcip_country":"United Kingdom","srvcertchainvalpass":"Pass","srvcertvalidationtype":"EV (Extended Validation)","srvcertvalidityperiod":"Standard","srvsslcipher":"TLS_AES_256_GCM_SHA384","serversslsessreuse":"Yes","server_tls_keyex_alg":"ECDHE_KYBER","server_tls_sig_alg":"rsa_pss_rsae_sha384","srvocspresult":"Good","srvtlsversion":"TLS1.3","srvwildcardcert":"Yes","ssldecrypted":"Yes","ssl_rulename":"Cloud SSL Policy","throttlereqsize":"0","throttlerespsize":"0","totalsize":"12000","trafficredirectmethod":"GRE Tunnel","unscannabletype":"None","upload_doctypename":"Cloud Configuration","upload_fileclass":"config_class","upload_filetype":"JSON Files","urlcatmethod":"Database A","urlsubcat":"Cloud Computing","urlsupercat":"Technology","urlclass":"Business Critical","useragentclass":"CLI Tool","useragenttoken":"aws-cli (2.x)","userlocationname":"lon_office","year":"2023","ztunnelversion":"ZTUNNEL_2_0","zpa_app_seg_name":"ZPA_aws_segment"}}
{"version":"v12","sourcetype":"zscalernss-web","event":{"time":"Mon Oct 16 22:55:48 2023","cloudname":"zscaler.net","host":"mail.google.com","action":"Allowed","recordid":"987654301","login":"jdoe@example.com","prompt_req":"rewrite%20the%20%22hello%20world%22%20example%20for%2050%%20off%0Apath%20C%3A%5Ctemp"}}