# Threat protection — engines after SSL, prove the sandbox

Source: https://ai.techclick.in/blog_zscaler_b11_07_threat_protection
Markdown: https://ai.techclick.in/blog_zscaler_b11_07_threat_protection.md
Publisher: Techclick Infosec Pvt Ltd

Place ZIA threat engines after SSL inspect, configure Malware Protection, ATP, Cloud Sandbox and Browser Control, and prove a sandbox verdict in Insights.

⚡ Quick answer (say this out loud)

   ZIA web engines run in a documented order:  Firewall → SSL Inspection → ATP → Malware/AV → Cloud App → URL → File Type → DLP → Cloud Sandbox . SSL is the gate — without Inspect, content engines do not see file bytes.  Malware Protection  is global Allow/Block on known malware families.  ATP  is destination and page behaviour (phishing, C2, cryptomining, Page Risk).  Sandbox  detonates unknowns;  Quarantine  holds the download until a verdict,  Allow & Scan  delivers now and can create a Patient 0. Prove it in Web Insights ( Blocked Policy Type  / policy reason) then open the Sandbox Detail Report by MD5. Never disable an engine for one false positive — add a Security Exception or a scoped Sandbox rule.

## 1. Why the four engines exist

 Lesson 6 gave ZIA the cleartext. Threat protection is what that decrypt is for. URL Filtering blocks a category. These engines block a  payload , a  phishing page , a  never-seen executable , or a  vulnerable User-Agent .

 When the CISO asks what stopped last week’s incident, the honest answer is one of four: Malware Protection hit a known family, ATP hit a destination or page-risk score, Cloud Sandbox detonated an unknown file, or Browser Control refused an EOL client. Get any engine too loose and the payload lands. Get it too tight, with no exception model, and CI dies on Friday and someone disables Sandbox for the whole tenant.

   Visual 1 — four stations after decrypt

   Feel: decrypt first, then reputation and antivirus, then sandbox on the unknown. Exact order is the SVG below — not this poster.

#### URL Filtering ≠ ATP

 URL is slow acceptable-use categories. ATP is live threat verdicts (phishing, C2, Page Risk). A “Business” site can still be ATP-blocked.

#### Sandbox ≠ AV

 AV needs a known family or feed. Sandbox detonates a first-seen file. Known malware should die at AV so Sandbox is not your only gate.

## 2. Mental model — who inspects what

 Pre-train the four names before you open the Admin Console. Two of them (Malware Protection and ATP) are  global tenant toggles  — no user/group rule order. Sandbox and Browser Control are policies you can scope.

        Engine  What it inspects  How it decides  Typical catch

          Malware Protection
         File bytes after SSL Inspect (HTTP, HTTPS if inspected, FTP / FTP-over-HTTP)
         Signature + Zscaler malware feeds. Per-category Allow/Block. Files ≤ 400 MB; up to 5 archive layers.
         Trojan, ransomware, worm, virus, adware, spyware, PUA, RAT

          Advanced Threat Protection
         URL / destination / page content / callback pattern
         ThreatLabz + Page Risk index (Help recommends  35 ) + category toggles
         Phishing, C2, DGA, cryptomining, anonymizer, browser exploit, XSS

          Cloud Sandbox
         Unknown files that matched a Sandbox rule
         First-Time Action + optional AI Instant Verdict + later detonation report
         Zero-day / first-seen PE, macros, novel dropper

          Browser Control
         User-Agent / plugin / document-app version on the  request
         Version checks + notify or block
         IE11, EOL Chrome, Java plugin, Flash, old Reader

   Hard words before the runbook

- First-Time Action — what Sandbox does the first time it sees that file hash: Quarantine (hold) or Allow & Scan (deliver now, analyse in the background).

- Patient 0 — a user who already received a file that later comes back malicious. Official Help: malicious files downloaded under Allow & Scan are Patient 0 events. Investigate them.

- AI Instant Verdict — Sandbox ML that can return a high-confidence result without waiting for full detonation. Help: only when First-Time Action is Quarantine or Allow & Scan.

- Security Exception — ATP URL allowlist. It bypasses all ATP scanning for that URL, not one category.

## 3. Engine order vs SSL inspect

 Flowchart first. Zscaler’s  ZIA Policy Leading Practices Guide  lists the web-module order. SSL Inspection is station two. Cloud Sandbox is last. That is why “Sandbox didn’t see my HTTPS file” is almost always an SSL ticket, not a Sandbox ticket.

   Visual 2 — stations after the handshake

   Feel: SSL splits Inspected vs still-encrypted. Exact official order is the SVG — read left to right.

   Flow 1 · official web-module order

       Firewall then SSL then ATP then Malware then later Cloud Sandbox

- Web module order (Leading Practices) Firewall SSL inspect Inspected → ATP → Malware/AV → Cloud App → URL → File Type → DLP → Sandbox Do Not Inspect → no file bytes. URL-based ATP (known phishing / malicious URL) may still match SNI 1 Firewall first. Then SSL/TLS Inspection Policy first-match (Inspect / Do Not Inspect / Block). 2 ATP next — destination, Page Risk, phishing, C2. Some URL-based ATP can fire without decrypt. 3 Malware/AV scans file bytes only on the inspected (or clear HTTP/FTP) stream. Limit 400 MB. 4 Cloud App, URL Filtering, File Type, then DLP — still before Sandbox. 5 Cloud Sandbox last: first-seen files that matched a Sandbox rule. Quarantine holds here. 6 Browser Control is a request-time User-Agent check — not a file engine. It does not replace ATP. Interview line: “If SSL Policy Reason is any Not inspected…, Malware and Sandbox never saw the bytes.” Do not invent a private order. Quote the Leading Practices list, then the Insights columns. Read left → right. Diamond after SSL is the real fork. Sandbox is last on purpose: known-bad should already have died at ATP or AV. Do not reverse the order in an interview A common wrong story is “Sandbox detonates first, then AV.” Official order is the opposite. Known malware should be a Malware Protection block. Sandbox is the first-seen / zero-day station. If the session was Do Not Inspect, you debug SSL — you do not add another Sandbox rule. ## 4. How to choose First-Time Action Sandbox is the only engine in this lesson where the first download of a hash can be held. Pick the action by blast radius, not by “we hate waiting.” Choice What the user gets Use when Cost Quarantine (First-Time Action) Download is held until verdict. Policy reason documents a temporary hold. Executables, installers, macro Office from untrusted URL categories. Wait. Breaks one-time / signed-URL downloads if the origin expires during the hold. Allow & Scan File delivers now. Analysis runs in the background. Later Malicious = Patient 0. Low-risk types, or a trusted internal source you must not stall. Patient 0 risk. SOC must read Sandbox Activity Report. AI Instant Verdict (with either action) High-confidence ML can finish before full VM detonation. On, for Quarantine or Allow & Scan. You do not set a custom threshold in the default rule. Does not replace the behavioural report on novel files. ATP / Malware Security Exception That URL skips the named security scan (ATP exception skips all ATP). One confirmed false-positive host. Never a whole threat category. Allowlist is a hole. Keep it a hostname, not *.com . Say this out loud Quarantine for first-seen executables from the open internet. Allow & Scan only where holding the file breaks a signed URL or a hash-verified pipeline. ATP and Malware stay on — they are not Sandbox. ## 5. Runbook — Side A malware/ATP, Side B sandbox, Side C proof Do this on a pilot group after SSL Inspection already shows Inspected on the test destination. Each block cites one primary Help article. ### Side A — Malware Protection + ATP (global) Primary sources: Configuring the Malware Protection Policy and Configuring the Advanced Threat Protection Policy . #### Confirm Inspect before you touch threat toggles Web Insights on the pilot user: SSL/TLS Policy Reason = Inspected for the test HTTPS download. If it is any “Not inspected…” reason, stop. Fix Lesson 6 first. Content-based Malware and Sandbox will not see the file.

- #### Malware Protection — leave defaults unless you own a change Policies → Cybersecurity → Inline Security → Malware Protection . On the Malware Policy tab enable Inspect Inbound Traffic (and Outbound if you scan uploads). Inspect HTTP, and FTP / FTP-over-HTTP only if those protocols are in use. Help’s on-page guidance: do not casually change the default category Allow/Block set. Categories are tenant-wide: Virus, Trojan, Worm, Ransomware, Adware, Spyware, Unwanted Applications, Remote Access Tool.

- #### Unscannable and password-protected archives Same page, file-handling: Block Unscannable Files and Block Password-Protected Archive Files are the two documented levers. Files over 400 MB are not scanned. Password-protected ZIPs are not “Sandbox will crack them” — they are unscannable unless you block or carve them out.

- #### ATP — block malicious active content, set Page Risk Policies → Cybersecurity → Inline Security → Advanced Threat Protection . Recommended Help: block Malicious Active Content . Set Suspicious Content Protection (Page Risk) to the documented starter of 35 unless Legal signed a different tolerance. Keep Known + Suspected Phishing, Command & Control Servers/Traffic, Crypto Mining, and Anonymizers on Block for a production tenant.

- #### False positive? Exception, not category off ATP is global — you cannot “turn Suspicious Destinations off for Engineering.” Add the exact host to Security Exceptions (ATP allowlist). That URL then bypasses all ATP, so keep the entry a hostname (lab: jenkins.lab.example ), never a category toggle.

     admin.zscalerthree.net · Policies → Cybersecurity → Inline Security → Advanced Threat Protection

     Training mock · not live

       Policies / Cybersecurity / Inline Security / Advanced Threat Protection

### Advanced Threat Protection

          Page Risk (Suspicious Content)  35 · recommended

          Malicious Active Content  Block

          Known / Suspected Phishing  Block

          Crypto Mining  Block

        Security Exceptions (allowlist)  jenkins.lab.example — not a category off-switch

        Cancel  Save and Activate

    Source:  Zscaler Help — Configuring the Advanced Threat Protection Policy / Recommended Advanced Threat Protection Policy. Page Risk 35 is the documented starter. Exceptions bypass all ATP for that URL.

### Side B — Cloud Sandbox rule

 Primary sources:  About Sandbox ,  Configuring the Sandbox Policy ,  Recommended Sandbox Policy .

- #### Open Sandbox, do not fight the default rule Policies → Cybersecurity → Inline Security → Sandbox . Rules evaluate in ascending numerical order . The default behavioural-analysis rule is last. Add your custom rule above it. Confirm the tenant SKU (Basic vs Advanced) before you promise Office/PDF detonation — Basic historically covers a short executable/archive list only.

- #### Add a Quarantine rule for high-risk first-seen files Lab name: Sandbox-Exec-Quarantine-Lab . File types: Windows executables / libraries (and, if Advanced, macro Office). URL categories: all except the internal-software category you own. Users/Groups: pilot first. First-Time Action = Quarantine . AI Instant Verdict = Enabled . Action for subsequent known-malicious downloads = Block. Enable the quarantine notification page so the user sees a wait, not a silent hang.

- #### Add a higher Allow & Scan (or Allow) rule for trusted internal artifacts Lab name: Sandbox-Artifactory-AllowScan-Lab , order below only if you want Quarantine to miss this source — put this rule above the catch-all. URL custom: artifactory-internal.lab.example . First-Time Action = Allow & Scan if you still want a background verdict; or exclude the URL from Sandbox if the pipeline already hash-pins every artifact. Do not set First-Time Action Quarantine on a 200+ MB CI installer unless you have measured queue time.

- #### Optional MD5 allow list — Advanced Policy Settings Help: Policies → Cybersecurity → Inline Security → Sandbox → Advanced Policy Settings . Custom MD5 hashes can be allow-listed so a known-good build is not re-held. Use the hash of the file you actually ship, not a guess. Activate.

     admin.zscalerthree.net · Policies → Cybersecurity → Inline Security → Sandbox → Add Rule

     Training mock · not live

       Policies / Cybersecurity / Inline Security / Sandbox / Add Rule

### Add Sandbox Rule

          Rule Order  10

          Rule Status  Enabled

        Rule Name  Sandbox-Exec-Quarantine-Lab

          File Types  Windows Executable, Windows Library

          URL Categories  Any except lab-internal-software

          First-Time Action  Quarantine

          AI Instant Verdict  Enabled

        Cancel  Save and Activate

    Source:  Zscaler Help — About Sandbox / Configuring the Sandbox Policy / Recommended Sandbox Policy. Quarantine holds the first-seen file. AI Instant Verdict is valid only with Quarantine or Allow & Scan.

### Side C — Browser Control + prove the sandbox verdict

 Primary sources:  Configuring the Browser Control Policy ,  About the Sandbox Activity Report ,  Policy Reasons ,  Web Insights Logs: Columns .

- #### Browser Control — request-time only Help title: Configuring the Browser Control Policy (left-nav may sit under Access Control / Internet & SaaS). Enable checks and user notification. Block IE 6–11 and EOL plugins (Java, Flash, ActiveX). Warn on old Chrome/Firefox rather than a hard block on day one. This reads the User-Agent — spoofing defeats it, which is why ATP still sits behind it.

- #### Trigger a known-good sandbox hold From the inspected pilot: download a first-seen lab executable that matches the Quarantine rule (or Zscaler’s published sandbox test file if your tenant still hosts one). The browser should show the quarantine notification, not a raw TCP hang.

- #### Web Insights — quote the engine Analytics → Insights → Web . Filter user + URL + last 30 minutes. You need SSL/TLS Policy Reason = Inspected and either a hold reason (“temporarily held due to a Sandbox First Time Action policy set to Quarantine”) or Blocked Policy Type = Sandbox / Malware Protection / Advanced Threat Protection. Copy the MD5 from the row.

- #### Sandbox Detail Report — that MD5 is the proof Open Analytics → Sandbox (Sandbox Activity Report). Click the MD5 to open the Sandbox Detail Report : verdict (Benign / Suspicious / Malicious), AI/ML score if present, behaviour, and MITRE mapping when the SKU provides it. Help: files that landed under Allow & Scan and later went Malicious are Patient 0 — investigate, do not ignore.

   Visual 3 — proof is a report, not Activate

   Activate is not proof. The ticket closes when Insights names the engine and the Detail Report names the MD5 verdict.

  Dummy lab · what “done” looks like
 time=16:44:12Z user=pilot@lab.example url=https://files.lab.example/tools/build.exe
ssl_tls_policy_reason=Inspected
action=held
reason="temporarily held due to a Sandbox First Time Action policy set to Quarantine"
md5=d41d8cd98f00b204e9800998ecf8427e

time=16:45:08Z  same md5
blocked_policy_type=Sandbox  verdict=BENIGN
sandbox_detail_report=open  ai_instant_verdict=not_required

# ATP false-positive pattern (different ticket)
blocked_policy_type=Advanced Threat Protection
reason=Suspicious Destination / Page Risk
fix=Security Exception for jenkins.lab.example  (not category off)

## 6. Runtime path after Activate

 Forwarding did not change (Client Connector, GRE/IPSec, or PAC). After Activate, each download walks the official stations. Browser Control can refuse the request on User-Agent before a file exists. Sandbox only runs if earlier stations allowed the object and a Sandbox rule matched.

   Flow 2 · prove a first-seen executable

       Inspected download through AV then Quarantine or Allow and Scan then Insights proof

- First-seen file · two First-Time Actions Inspected GET ATP + AV Sandbox match? Quarantine hold Allow & Scan Deliver if Benign Patient 0 if later bad 1 Known malware dies at ATP or AV. Sandbox never spends a VM on a signature hit. 2 Quarantine: user waits; Insights reason names First-Time Action. Then Detail Report by MD5. 3 Allow & Scan: file is already on disk. If verdict flips Malicious, that user is Patient 0. 4 Trusted Artifactory: higher Allow & Scan / URL exception. Not “Sandbox off for executables.” 5 Proof package: Inspected + engine name + MD5 Detail Report. Optional NSS to SIEM for Malicious. Stuck in Quarantine on a signed S3 URL? Origin expired during the hold — switch that domain to Allow & Scan. Quarantine vs Allow & Scan is the only Sandbox decision that changes Patient 0 risk. The proof is always MD5 → Detail Report. ## 7. Traps and the proof checklist What you see Likely cause Fix + evidence HTTPS .exe never appears in Sandbox SSL Do Not Inspect (or Bypass Other Policies) on that destination. Web Insights: SSL/TLS Policy Reason. If Not inspected, fix SSL. Do not add another Sandbox rule. CI installer hangs 90s then 504 First-Time Action = Quarantine on a large internal artifact; queue depth high. Higher Sandbox rule for that host (Allow & Scan or skip). Keep Quarantine on the open internet. Internal Jenkins blocked “Suspicious Destination” ATP reputation / Page Risk on a new or low-reputation host. ATP Security Exception for that URL. Do not disable the ATP category tenant-wide. Office file “Benign — no active content” Static pre-check found no macro/script — not a full detonation. Read the Detail Report wording. Do not claim Sandbox executed the file. File over 400 MB “allowed” but never scanned Malware Protection size limit. Sandbox SKU may also refuse the object. Help: files above 400 MB are not scanned. Use File Type Control or an approved channel. IE-mode intranet dies after Browser Control Edge IE-mode still presents an IE User-Agent. Keep the external IE block. Exempt the intranet host. Audit UA quarterly. Do not ship with these mistakes Calling ATP “better AV” and turning Malware Protection off.

- Disabling Sandbox for all executables because Artifactory queued.

- Expecting Sandbox to brute-force a password-protected ZIP.

- Treating Activate as proof — no MD5 Detail Report, no ticket close.

- ATP Security Exception on a whole public suffix because one page mined crypto.

- Writing a Sandbox rule and testing it on a Do Not Inspect banking bypass.

   Pilot checklist — print this

- Test URL shows SSL/TLS Policy Reason = Inspected .

- Malware: EICAR (or tenant test file) → Blocked Policy Type = Malware Protection. Category visible in reason.

- ATP: published phishing/malicious test URL → Blocked Policy Type = Advanced Threat Protection.

- Sandbox: first-seen lab exe → quarantine notification → Detail Report by MD5 with a verdict.

- Trusted internal host has a higher Allow & Scan / exception rule. Catch-all Quarantine still on.

- Browser Control: curl -A "Mozilla/4.0 (compatible; MSIE 8.0)" hits the notify/block page.

- Activate done. Optional: NSS web logs with threat / sandbox fields into SIEM for Malicious after hours.

## Knowledge check

   Six judgment questions. Same bar as the runbook: SSL first, official order, scoped exception, MD5 proof.

       Q1
       A user downloads  setup.exe  from an HTTPS site that matches a Do Not Inspect rule. Malware Protection and Cloud Sandbox are enabled. What actually happens to the file bytes?

           Sandbox still detonates the file because it is last in the official order
           Content engines do not see the file bytes. You may still get URL-based ATP on the SNI/domain. Fix SSL inspect before you debug Sandbox
           Malware Protection decrypts the file on its own
           Browser Control opens the PE headers from the User-Agent

       Correct:  b . SSL Inspection is the gate. Official order puts it before ATP, AV, and Sandbox. Re-read  Engine order vs SSL inspect .

       Q2
       Which sequence matches Zscaler’s documented web-module order in the Policy Leading Practices Guide?

           Sandbox → Malware/AV → ATP → SSL Inspection
           File Type Control → SSL Inspection → Firewall
           Firewall → SSL Inspection → ATP → Malware/AV → … → Cloud Sandbox last
           ATP and Sandbox run only on the endpoint, never on the Public Service Edge

       Correct:  c . Quote that list. Known-bad should die at ATP or AV; Sandbox is the first-seen station. Re-read  Engine order .

       Q3
       The CISO asks why ZIA needs both Malware Protection and ATP — “isn’t ATP just better AV?” What is the accurate split?

           Malware is for mobile; ATP is for desktops
           Malware Protection is signature/feed Allow/Block on file bytes. ATP is destination, Page Risk, phishing, C2, cryptomining — including threats with no downloadable file
           They are the same policy with two names. Disable either one
           ATP only runs if Sandbox Quarantine is on

       Correct:  b . A phishing landing page has no PE for AV. A novel binary from a clean-reputation CDN has no ATP URL hit. Re-read  Mental model .

       Q4
       You set Sandbox First-Time Action = Quarantine for executables. CI now stalls on  artifactory-internal.lab.example . What is the production fix?

           Disable Sandbox for all executables tenant-wide
           Turn Malware Protection off — Sandbox already covers it
           Add a higher Sandbox rule (Allow & Scan or skip) for that trusted host, keep Quarantine on everything else
           Set Page Risk to 100 so ATP ignores CI

       Correct:  c . Scoped exception. Quarantine stays on the open internet. Re-read  Side B  and  How to choose .

       Q5
       A  .docm  is held. How do you  prove  the sandbox verdict to close the ticket?

           Administration → Audit Logs for the admin who clicked Activate
           Web Insights: Inspected + Sandbox hold/block reason, copy the MD5, open Sandbox Activity → Detail Report for that hash
           Policy → URL & Cloud App Control — the rule list is the verdict
           Ask the user if the block page “looked like sandbox”

       Correct:  b . Policy reason + MD5 Detail Report is the proof package. Re-read  Side C .

       Q6
       Insights shows ATP “Suspicious Destination” on  jenkins.lab.example . Dev wants the category disabled. What do you do?

           Add that hostname to ATP Security Exceptions so the category still protects every other new domain
           Disable Suspicious Destinations for the whole tenant
           Disable ATP entirely for the Engineering group — ATP is per-group
           Turn SSL Inspection off so ATP cannot see the host

       Correct:  a . ATP is a global policy. A Security Exception is a surgical hole; a category off-switch is not. Re-read  Side A .

       Check answers
       Reset

## Sources

- ZIA Policy Leading Practices Guide — web-module order: Firewall → SSL Inspection → ATP → Malware/AV → Cloud App → URL → File Type → DLP → Cloud Sandbox.

- Configuring the Malware Protection Policy — Policies → Cybersecurity → Inline Security → Malware Protection; Inspect Inbound/Outbound; HTTP / FTP / FTP-over-HTTP.

- Configuring Security Exceptions for the Malware Protection Policy — files up to 400 MB are scanned; larger files are not.

- Recommended Malware Protection Policy

- Configuring the Advanced Threat Protection Policy — fraud, unauthorized communication, malicious objects/scripts; Security Exceptions allowlist.

- Recommended Advanced Threat Protection Policy — block Malicious Active Content; Page Risk starter 35.

- Configuring Security Exceptions for the Advanced Threat Protection Policy

- About Sandbox — zero-day / APT layer; AI analysis; rules in ascending order.

- Recommended Sandbox Policy — Quarantine vs Allow & Scan; default rule on Windows executables/libraries from suspicious URL categories.

- Configuring the Default Sandbox Rule — AI Instant Verdict only when First-Time Action is Quarantine or Allow & Scan.

- Configuring Sandbox Advanced Policy Settings — custom MD5 allow list.

- About the Sandbox Activity Report — Patient 0 after Allow & Scan.

- Using the Sandbox Scanning Portal — MD5 → Detail Report.

- Policy Reasons — temporary hold when First-Time Action = Quarantine.

- Configuring the Browser Control Policy — outdated browsers, plugins, applications.

- Recommended Browser Control Policy

- Web Insights Logs: Columns

- Adding URLs to the Allowlist — exceptions apply across Malware, ATP, Sandbox, and URL Filtering.

 Related:  SSL inspection + File Type  ·  URL & Cloud App Control  ·  DLP & CASB  ·  Zscaler authentication  ·  ZIA traffic flow

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt