# Zscaler Zinsights

> Use when querying Zscaler analytics — web traffic, firewall stats, cyber incidents, shadow IT, IoT devices, CASB reports, threat intelligence.

- **Type:** Skill
- **Install:** `agentstack add skill-secsilab-zscaler-claude-skills-zscaler-zinsights`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [secsilab](https://agentstack.voostack.com/s/secsilab)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [secsilab](https://github.com/secsilab)
- **Source:** https://github.com/secsilab/zscaler-claude-skills/tree/main/skills/zscaler-zinsights

## Install

```sh
agentstack add skill-secsilab-zscaler-claude-skills-zscaler-zinsights
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Zscaler Insights (ZInsights)

## Overview

ZInsights provides analytics and reporting across the Zscaler platform. Use for web traffic analysis, firewall statistics, cyber incident tracking, shadow IT discovery, IoT device inventory, and CASB application reports.

## MCP Tools

All ZInsights operations are read-only via MCP tools:

| Tool | Description |
|------|-------------|
| `zinsights_get_web_traffic_no_grouping` | Web traffic summary without grouping |
| `zinsights_get_web_traffic_by_location` | Web traffic grouped by location |
| `zinsights_get_web_protocols` | Web traffic by protocol (HTTP/HTTPS/etc.) |
| `zinsights_get_firewall_by_action` | Firewall events by action (allow/block) |
| `zinsights_get_firewall_by_location` | Firewall events by location |
| `zinsights_get_firewall_network_services` | Firewall events by network service |
| `zinsights_get_cyber_incidents` | Cyber incident summary |
| `zinsights_get_cyber_incidents_daily` | Daily cyber incident trend |
| `zinsights_get_cyber_incidents_by_location` | Cyber incidents by location |
| `zinsights_get_cyber_incidents_by_threat_and_app` | Cyber incidents by threat type and application |
| `zinsights_get_threat_class` | Threat classification breakdown |
| `zinsights_get_threat_super_categories` | Threat super-category breakdown |
| `zinsights_get_shadow_it_apps` | Shadow IT application list |
| `zinsights_get_shadow_it_summary` | Shadow IT summary statistics |
| `zinsights_get_iot_device_stats` | IoT device inventory and statistics |
| `zinsights_get_casb_app_report` | CASB application security report |

For full API endpoint reference, see ENDPOINTS.md in this skill directory.

## Authentication

Uses OneAPI OAuth2 (same as ZIA/ZPA). No separate auth flow.

## Common Patterns

- Daily security briefing: cyber incidents + threat classes + shadow IT summary
- Location risk assessment: web traffic + firewall blocks + incidents per location
- Shadow IT review: list unsanctioned apps, check CASB reports
- IoT inventory: device stats for network segmentation planning

## Known Limitations

- All tools are read-only (analytics/reporting only)
- No Postman collection available — endpoints only accessible via MCP tools
- Time range parameters vary by tool — check MCP tool schema
- Data freshness depends on Zscaler cloud processing (typically 15-30 min delay)

## MCP Server

Live analytics queries for ZInsights are available via the [zscaler-mcp-server](https://github.com/zscaler/zscaler-mcp-server) (`zinsights_*` tools). This skill provides workflow guidance and context; the MCP server executes the GraphQL queries. See the MCP server repository for the full tool list and time range parameters.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [secsilab](https://github.com/secsilab)
- **Source:** [secsilab/zscaler-claude-skills](https://github.com/secsilab/zscaler-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-secsilab-zscaler-claude-skills-zscaler-zinsights
- Seller: https://agentstack.voostack.com/s/secsilab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.