# zms-analyze-policy-rules

> Claude/Codex skill by [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars · Updated 2026-10-12

Analyze Zscaler Microsegmentation (ZMS) policy rules for optimization opportunities. Reviews custom and default policy rules, identifies stale or unused rules, detects overly permissive rules, maps cross-zone communication patterns, and assesses default security posture. Use when an administrator asks: 'Are there unused policy rules?', 'Which rules are too broad?', 'Optimize our segmentation policies', 'Review our default deny posture', 'Show me policy rule coverage', or 'Analyze our ZMS policies.'

Tags: ai, gemini-cli-extension, hacktoberfest, mcp, mcp-server, pypi, zcc, zdx, zero-trust, zia, zpa, zscaler

## Install

```sh
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zms/analyze-policy-rules ~/.claude/skills/zms-analyze-policy-rules
```

## From README

ZMS: Analyze Policy Rules & Segmentation Optimization Keywords policy rules, segmentation policies, microsegmentation rules, default policy, deny all, allow all, stale rules, unused rules, overly permissive, rule optimization, cross-zone, app zones, lateral movement, zero trust policy, rule priority, policy coverage Overview Perform a focused analysis of Zscaler Microsegmentation policy rules to identify optimization opportunities. This skill examines custom segmentation rules for staleness, breadth, and coverage gaps; evaluates default policy posture (deny vs allow); maps cross-zone communication patterns through app zones; and correlates policy rules with resource group structure to identify unprotected segments. Policy rules are the enforcement backbone of microsegmentation. They define which resource groups can communicate with each other, over which ports and protocols, and in which direction.

## Links

- HTML page: https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zms/analyze-policy-rules/
- GitHub: https://github.com/zscaler/zscaler-mcp-server
- Author: [@zscaler](https://omgskills.com/library/zscaler/index.md)

## More from this repo

- [cross-product-troubleshoot-user-connectivity](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/cross-product/troubleshoot-user-connectivity/index.md) — Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [easm-review-attack-surface](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/easm/review-attack-surface/index.md) — Used to review the organization's external attack surface using Zscaler EASM.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [zcc-generate-logout-otp](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zcc/generate-logout-otp/index.md) — Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars