+

Integrated Products

ThreatConnect & Zscaler
ThreatConnect® and Zscaler® have partnered to enable joint
users to automate their incident response and proactively
protect their network from today’s sophisticated attacks.

ThreatConnect
Zscaler ZIA

Integration Overview
Zscaler Internet Access (ZIA) is a security platform delivered from the cloud. ZIA sits between your users and the Internet,
securing your users by providing full protection from online threats. Zscaler allows organizations to easily scale protection
to all offices and users, regardless of their location, without the need for appliances.
With ThreatConnect, users gain relevant and actionable insights from intelligence sources within the platform. Then, basedon that intelligence, users can take action by providing those insights to the necessary people and technologies in theirsecurity environment.
With this integration, security teams can quickly operationalize intelligence in their environment and turn network controls
into an effective defense against threats.

Use Case #1: Threat Hunting

Retrive sandbox resultsfrom Zscaler ZIA

Action: Get Zscaler Sandbox Results

With this Playbook App, users can automatically
retrieve sandbox results from Zscaler, correlate
the results with known intelligence sources in

Send relevant IOCs from Zscaler
to Firewall or EDR tools

ThreatConnect, and request their EDR platform
to find and block the malicious files. Analysts cancreate a repeatable Threat Hunting workflow By
putting all of this into a Playbook, a full threat
hunting workflow can be created.

FirewallEndpoint Detection
and Response

Use Case # 2: Enable Smarter Defensive Decisions and Actions
Action: Zscaler Blacklist

With this Playbook App, users can send indicators of compromise to the Zscaler Blacklist for automated blocking oralerting, or determine where deeper investigation is needed based on a ThreatAsses score determined in ThreatConnect.
ThreatAssess is an in-platform scoring system which captures the threat criticality of an IOC on a single numeric scaleand helps to prioritize and triage decision making. This gives teams the ability to monitor and block the most relevant andmalicious threats leveraging validated threat intelligence from ThreatConnect. The Job App for Zscaler works the sameway but allows users to add indicators in bulk and on a schedule.

ThreatConnect.com

3865 Wilson Blvd., Suite 550
Arlington, VA 22203

sales@threatconnect.com
1.800.965.2708

Ingest threat data from multiple sources
STRUCTURED DATAUNSTRUCTURED DATAOSINT FEEDS

THREATCONNECT
COMMUNITIESCorrelate, normalize,
and enrich threat data inThreatConnect

Send validated threat intelligence
to Zscaler ZIA for alerting,blocking, and unblocking

ISAC/ISAO DATAPREMIUM FEEDSEMAILS

Features and Benefits
Monitor and block the mostrelevant and malicious threats
leveraging validated threat
intelligence from ThreatConnect

Shorten security operations
workflows by automating manualtasks and providing deep visibility
into operational KPIs



Allow Playbooks to automaticallyalert or block/unblock based on
the indicator’s threat ratingin ThreatConnectThreatConnect acts as a storage
repository for assets related
to specific cases, as well asserves as a place to document
all actions and notes related tocases, artifacts, or evidence in a
structured format.

Retrieve full reports fromZscaler Sandbox

How to GetStarted

Analysts can leverage additionalThreatConnect integrations forfurther enrichment or triage.

Automated data enrichment andcase creation for smarter andfaster incident response activities.

Users have full control of which
ThreatConnect indicators are sentto ZIA

If you are already a ThreatConnect customer, these Components can be downloaded and installed fromthe ThreatConnect App Catalogue or by contacting your Customer Success Representative. If you are
not a current ThreatConnect customer or user and would like to know more about this or any of ourother third-party apps or integrations, please email sales@threatconnect.com.

About Zscaler
Zscaler enables the world’s leading organizations to securely transform their networks and applications for a mobile and cloud-first world.
Its services, Zscaler Internet Access™ and Zscaler Private Access™, create fast, secure connections between users and applications,regardless of device, location, or network. Zscaler services are 100% cloud delivered and offer the simplicity, enhanced security, andimproved user experience that traditional appliances or hybrid solutions are unable to match. Used in more than 185 countries, theZscaler multi-tenant, distributed security cloud protects thousands of customers from cyberattacks and data loss, so they can embrace
cloud agility, speed, and cost containment—securely.

3865 Wilson Blvd., Suite 550
Arlington, VA 22203

ThreatConnect, Inc. provides cybersecurity software that reduces complexity for everyone, makes
decision making easy by turning intelligence into action, and integrates processes and technologies
to continually strengthen defenses and drive down risk. Designed by analysts but built for the entire
team (security leadership, risk, security operations, threat intelligence, and incident response),
ThreatConnect’s decision and operational support platform is the only solution available today withcyber risk quantification, intelligence, automation, analytics, and workflows combined. To learn more
about our Cyber Risk Quantification, Threat Intelligence Platform (TIP) or Security Orchestration,

1.800.965.2708

107-111 Fleet StreetLondon, EC4A 2AB
United Kingdom
44.20.7936.9101

Automation, and Response (SOAR) solutions, visit www.ThreatConnect.com
sales@threatconnect.com

ThreatConnect.com

Copyright © 2021 ThreatConnect, Inc.