zia-investigate-sandbox
Investigate ZIA Sandbox file analysis results, quarantine issues, and security policy enforcement. Uses sandbox report, quota, behavioral analysis, and file hash tools combined with SSL inspection checks to diagnose why files are blocked, allowed, or stuck in quarantine. Incorporates runbook knowledge for Malware Protection, ATP, and Sandbox policy troubleshooting. Use when an administrator asks 'why is this file blocked?', 'check sandbox report for this hash', 'file stuck in quarantine', or 'sandbox is not analyzing files.'
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zia/investigate-sandbox" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zia/investigate-sandbox ~/.claude/skills/zia-investigate-sandboxFrom README
ZIA: Investigate Sandbox Keywords sandbox, file blocked, quarantine, md5 hash, sandbox report, malware, atp, advanced threat protection, malware protection, file analysis, patient zero, patient 0, sandbox quota, file not scanning, quarantine stuck, sandbox verdict, behavioral analysis, unscannable file Overview Investigate ZIA Sandbox file analysis results and security policy enforcement issues. This skill combines API-driven sandbox inspection (reports, quota, behavioral analysis) with runbook-guided troubleshooting for Malware Protection, Advanced Threat Protection (ATP), and Sandbox policies. Use this skill when: An administrator reports files being unexpectedly blocked or allowed, files stuck in quarantine, sandbox not analyzing files, missing Patient 0 alerts, or needs to verify a sandbox verdict for a specific file hash.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.