zia-look-up-rule-targets
Look up the shared 'who/where/when/what-device' fields that every ZIA rule resource scopes by — users, groups, departments, locations, location_groups, url_categories, devices, device_groups, workload_groups, labels, and time_windows — and return the IDs (or canonical strings) the rule API expects. Use this skill from inside any ZIA rule create/update workflow (Cloud Firewall, DNS, IPS, URL Filtering, SSL Inspection, Web DLP, File Type Control, Sandbox, Cloud App Control) when the admin names a user, group, location, label, etc. by display name and you need the ID before building the rule payload. Centralises the read-before-write lookup convention so individual rule skills stay short and accurate. The skill enforces the project's hard rules: empty list = does not exist, never invent IDs, never silently substitute, never fan-out retries.
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zia/look-up-rule-targets" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zia/look-up-rule-targets ~/.claude/skills/zia-look-up-rule-targetsFrom README
ZIA: Look Up Rule Targets Why this skill exists Every ZIA rule resource (Cloud Firewall, DNS, IPS, URL Filtering, SSL Inspection, Web DLP, File Type Control, Sandbox, Cloud App Control) scopes by the same set of "who/where/when/what-device" target fields: users, groups, departments — who the rule applies to locations, locationgroups — where the user is connecting from urlcategories — which URL category the request hits devices, devicegroups — which managed device the user is on workloadgroups — which workload (cloud-asset) the connection is to/from labels — admin-assigned tags for organisation/reporting timewindows — which time-of-day schedule the rule honours Every one of those fields takes IDs (or, for urlcategories, canonical UPPERSNAKE strings), not display names. The admin will almost always name them by display name.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.