This blog page focuses on Zscaler Internet Access(ZIA) service monitoring on the Client device and how to create alerting mechanism to inform Internal Security teams when the ZIA service disabled. The purpose behind this alerting to make sure to have visibility on the endpoint device and help to improve the security posture on the enterprise environments.
Step 1: Enable CLI Access in Zscaler
Before the script will work, you must enable CLI access in your Zscaler App Profiles:
-
Log in to the Zscaler Client Connector Portal.
-
Go to App Profiles > Windows (or macOS).
-
Edit your policy and look for the Command Line Interface Access section.
-
Enable the Command Line Interface and click Save.
Step 2: Create the Check Script in JumpCloud
Create a script that checks the ZIA status. If the status is not "ON," the script will exit with code 1, which JumpCloud will recognize as an alert trigger.
For MacOS and Windows use the following link to find the related command line options to develop the script
Also an example script for the Windows environment can be found here.
Step 3: Configure JumpCloud Monitoring Rule
a.) Create the Command:
-
Go to Device Management > Commands.
-
Click (+) and select Command.
-
Paste the script you have created or the example script attached above.
-
Set Type to PowerShell (Windows) or Bash (Mac).
-
Under Launch Events, select Run as Repeating.
-
Set it to repeat every 10 Minutes.
-
Bind it to the relevant Device Groups.
b.) Create the Alert Rule:
-
Go to Insights > Alerts (or Alerts in the left nav).
-
Click the Rules tab and click + Rule.
-
Select the Command Execution Failure template.
-
Condition: Select the Command you created in the previous step.
-
Priority: Set to High or Medium.
-
Actions: - Toggle Send Notifications.
-
Configure your Notification Channel (Email, Slack, or Webhook). Ensure your email is added to the notification channel in Settings > Notification Channels.
-
How it works:
Every 10 minutes, JumpCloud runs the script.
If ZIA is "OFF" or "DISABLED," the script exits with 1.
JumpCloud sees the 1, marks the command execution as a "Failure," and immediately triggers the Alert Rule to send you an email.
