Integrating Forescout Cloud with Zscaler Internet and SaaS Access

Forescout Cloud integrates with with Zscaler Internet and SaaS Access (ZIA) to support security orchestration, automation, and response (SOAR) workflows by automating your IT tasks to reduce strain on your team.

Before integrating, note the following credentials:

  • Base URL
  • Organization ID
  • Client ID
  • Client secret
  • API role name

Note: Ensure that the API role you configure using ZIA has sufficient access to modify the ZIA allow/deny list and manage firewall rules.

To integrate Forescout Cloud with ZIA to support SOAR:

  1. In the Forescout Cloud Console, select Administration > Integrations.
  2. Click the Add Application button.
  3. In the Category dropdown, select SOAR.
  4. In the Application dropdown, select Zscaler Internet Access (ZIA).
  5. In the Application Name field, enter a unique name for the integration.
  6. In the Configurations pane, enter the Client ID, Client Secret, and Vanity Domain Name you obtained from ZIA.
  7. Click Add Application to save the configuration.

SOAR actions for ZIA

After you integrate Forescout Cloud with ZIA, you can configure actions. For details on configuring SOAR actions, see Configuring SOAR actions.

Note: For detailed information, including descriptions, request and response details, and samples for the following actions, see Device Groups, Firewall Policies, URL Categories, URL Filtering Policy, and User Management in the Zscaler API Developer and Reference Guide.

The following table shows enrichment actions that support SOAR for ZIA.

Enrichment actions
ZIA API Action
Device Groups List Devices
Firewall Policies List Firewall Rules
Firewall Policies Get Firewall Rule By ID
URL Filtering Policy Get URL Allow List
URL Filtering Policy Get URL Block List
User Management List Users
User Management Get User By ID or Name

The following table shows response actions that support SOAR for ZIA.

Response actions
ZIA API Action
Firewall Policies Add a New Firewall Rule
Firewall Policies Remove Firewall Rule By ID
Firewall Policies Disable Firewall Rule By ID
URL Categories Add URL(s) to Zscaler URL Category
URL Categories Remove URL(s) from Zscaler URL Category
URL Categories Get Custom URL Category ID by Configured Name
URL Filtering Policy Unblock Domain or URL
URL Filtering Policy Block Domain or URL