# zia-investigate-sandbox

> Claude/Codex skill by [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars · Updated 2026-10-12

Investigate ZIA Sandbox file analysis results, quarantine issues, and security policy enforcement. Uses sandbox report, quota, behavioral analysis, and file hash tools combined with SSL inspection checks to diagnose why files are blocked, allowed, or stuck in quarantine. Incorporates runbook knowledge for Malware Protection, ATP, and Sandbox policy troubleshooting. Use when an administrator asks 'why is this file blocked?', 'check sandbox report for this hash', 'file stuck in quarantine', or 'sandbox is not analyzing files.'

Tags: ai, gemini-cli-extension, hacktoberfest, mcp, mcp-server, pypi, zcc, zdx, zero-trust, zia, zpa, zscaler

## Install

```sh
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zia/investigate-sandbox ~/.claude/skills/zia-investigate-sandbox
```

## From README

ZIA: Investigate Sandbox Keywords sandbox, file blocked, quarantine, md5 hash, sandbox report, malware, atp, advanced threat protection, malware protection, file analysis, patient zero, patient 0, sandbox quota, file not scanning, quarantine stuck, sandbox verdict, behavioral analysis, unscannable file Overview Investigate ZIA Sandbox file analysis results and security policy enforcement issues. This skill combines API-driven sandbox inspection (reports, quota, behavioral analysis) with runbook-guided troubleshooting for Malware Protection, Advanced Threat Protection (ATP), and Sandbox policies. Use this skill when: An administrator reports files being unexpectedly blocked or allowed, files stuck in quarantine, sandbox not analyzing files, missing Patient 0 alerts, or needs to verify a sandbox verdict for a specific file hash.

## Links

- HTML page: https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zia/investigate-sandbox/
- GitHub: https://github.com/zscaler/zscaler-mcp-server
- Author: [@zscaler](https://omgskills.com/library/zscaler/index.md)

## More from this repo

- [cross-product-troubleshoot-user-connectivity](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/cross-product/troubleshoot-user-connectivity/index.md) — Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [easm-review-attack-surface](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/easm/review-attack-surface/index.md) — Used to review the organization's external attack surface using Zscaler EASM.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [zcc-generate-logout-otp](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zcc/generate-logout-otp/index.md) — Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars