Zscaler Tables

Tables

ZScalerAdminAuditLogReports

This table stores audit log reports for administrative actions within ZScaler. It records details about user actions, timestamps, results, and additional metadata related to ZScaler administrative activities.

Name	Type	Description
AAInCloud	string	Admin Audit in cloud.
Action	string	The type of action performed.
After	string	Post-action details or changes made after an action.
BatchDate	datetime	The date and time data was synced to our database.
Category	string	The category of the audit log entry.
ClientIP	string	The IP address of the client making the request.
ca	integer	The ID of the configuration within Compyl.
Interface	string	The interface through which the action was performed.
PreAction	string	Pre-action details or changes made after an action.
Resource	string	Resource or object the action was performed upon.
Result	string	The result of the action.
SubCategory	string	The subcategory of the audit log entry.
TimeStringValue	string	A string representation of the timestamp.
TraceID	string	A trace ID generated for debugging and tracking API transactions.
User	string	The name of the admin performing the action.
UTCTime	datetime	The UTC timestamp of the audit log entry.
ZScalerAuditLogReportID	integer	Unique identifier for each audit log entry.

ZScalerAdministratorUsers

This table stores information about Zscaler administrator users, including their login details, roles, permissions, and account settings. It is used to manage administrators and auditors within the Zscaler system.

Name	Type	Description
AdministratorUserId	integer	The unique identifier for an admin or auditor user.
BatchDate	datetime	The date and time data was synced to our database.
Comments	string	Additional information about the admin or auditor.
ConfigID	integer	The ID of the configuration within Compyl.
Disabled	bit	Indicates whether the admin account is disabled. If true, the account is inactive.
Email	string	The email address associated with the administrator or auditor.
ID	integer	Currently unused.
IsAuditor	bit	Indicates whether the user is an auditor. If true, the user has read-only permissions.
IsExecMobileAppEnabled	bit	Indicates whether the administrator has access to the Executive Insights Mobile App.
IsNonEditable	bit	Indicates whether the admin account is editable. If true, the account cannot be modified or deleted.
IsPasswordExpired	bit	Indicates whether the admin’s password has expired. If true, a password reset is required.
IsPasswordLoginAllowed	bit	Indicates whether password-based login is allowed. When SAML authentication is enabled, this can be set to false to enforce Single Sign-On (SSO) only.
IsProductUpdateCommEnabled	bit	Determines whether the admin receives product update communications regarding new features and enhancements.
IsSecurityReportCommEnabled	bit	Determines whether the admin receives security update communications regarding vulnerabilities and threats.
IsServiceUpdateCommEnabled	bit	Determines whether the admin receives service update communications related to Zscaler services and cloud releases.
LoginName	string	The admin or auditor’s login name, formatted as an email address, associated with the Zscaler account.
Password	string	Currently unused.
Role	string	The role of the administrator user.
UserName	string	The admin or auditor’s display name.

ZScalerCategories

The ZScalerCategories table stores category information related to ZScaler integrations. Each category has a unique identifier, a name, and an optional reference to a parent category.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the category.
Name	string	The name of the category.
ParentUuid	string	The UUID of the parent category.
Uuid	string	The universally unique identifier (UUID) of the category.

ZScalerClassifications

This table stores information about device classifications as identified by ZScaler AI/ML. It maps device classification universally unique identifiers (UUIDs) to their classification names and their parent classification UUIDs (which categorize them into broader device categories).

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the classification.
Name	string	The name of the classification.
ParentUuid	string	The UUID of the parent classification.
Uuid	string	The universally unique identifier (UUID) for a device classification

ZScalerDepartments

The ZScalerDepartments table stores information about departments within the ZScaler integration. This table includes details such as department names, associated identity provider (IdP) IDs, and additional comments. It supports search functionality based on department names and comments and allows tracking of deleted departments.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
Comments	string	Additional information or notes about the department.
ConfigID	integer	The ID of the configuration within Compyl.
Deleted	bit	Indicates whether the department has been marked as deleted. Default value is false.
DepartmentID	integer	The department's unique identifier within ZScaler.
ID	integer	A unique identifier for each department entry in the system.
IdpId	integer	The identity provider (IdP) ID associated with this department
Name	string	The name of the department.

ZScalerDeviceGroupDevices

This table stores information about devices associated with ZScaler device groups. It includes details such as the device's name, model, operating system, owner, and group type.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	Additional details or notes about the device.
DeviceGroupType	string	The type of device group the device belongs to. Example: ZCC_OS.
DeviceId	integer	Unique identifier for the device.
DeviceModel	string	The model of the device (e.g., a specific laptop or mobile model).
HostName	string	The network hostname assigned to the device.
Name	string	The name assigned to the device.
OSType	string	The operating system type running on the device.
OSVersion	string	The version of the operating system installed on the device.
OwnerName	string	The name of the device owner.
OwnerUserId	integer	The unique identifier of the user who owns the device.

ZScalerDeviceGroups

This table stores information about ZScaler device groups, which are logical groupings of devices based on operating system type, predefined classifications, or other criteria. These groups are used within ZScaler to manage device configurations, policies, and access.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	A human-readable description of the device group.
DeviceCount	integer	The number of devices that belong to this device group.
DeviceGroupId	integer	The unique identifier for the device group.
GroupType	string	The type of the device group.
ID	integer	The ID of the Device Group
Name	string	The name of the device group.
OsType	string	The operating system (OS) associated with the device group.
Predefined	bit	Indicates whether the device group is predefined by ZScaler. If true, the group is predefined.

ZScalerDevices

This table stores information about discovered devices identified by Zscaler’s AI/ML engine. Each device is uniquely identified by a DeviceUuid and belongs to a specific customer organization. The table includes details such as the device's IP address, location, classification, category, and type, as well as timestamps marking the start and end of Zscaler's evaluation of the device's web logs.

Name	Type	Description
AutoLabel	string	A machine learning-generated label describing the device’s prominent characteristics.
BatchDate	datetime	The date and time data was synced to our database.
CategoryUuid	string	The UUID representing the category of the device. Categories provide more specific grouping within classifications.
ClassificationUuid	string	The UUID representing the classification of the device. Classification typically refers to broader categories such as IoT devices, workstations, or mobile devices.
CloudName	string	The name of the Zscaler cloud where the organization is provisioned.
ConfigID	integer	The ID of the configuration within Compyl.
CustomerId	integer	The unique identifier for the customer organization that owns the device.
DeviceTypeUuid	string	The UUID representing the type of the device as classified by Zscaler AI/ML.
DeviceUuid	string	The universally unique identifier (UUID) assigned to the device by Zscaler AI/ML.
FlowEndTime	integer	The epoch timestamp when Zscaler's AI/ML engine stops evaluating the device’s weblog records.
FlowStartTime	integer	The epoch timestamp when Zscaler's AI/ML engine begins evaluating the device’s weblog records.
ID	integer	The Device ID.
IpAddress	string	The IP address of the discovered device.
LocationId	string	The identifier for the location where the device resides. This helps determine the geographical or network location of the device.

ZScalerDeviceTypes

This table stores the mapping between device type universally unique identifier (UUID) values and the device type names for all the device types supported by the Zscaler AI/ML. It helps categorize and track various device types.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the DeviceType.
Name	string	The name of the device type.
ParentUuid	string	The universally unique identifier (UUID) of the parent device type, indicating a hierarchical relationship.
Uuid	string	The universally unique identifier (UUID) of the device type. This uniquely identifies each device type.

ZScalerDLPEngines

This table stores information about Data Loss Prevention (DLP) engines used within the ZScaler integration. A DLP engine is a set of rules used to detect and manage sensitive data based on predefined or custom-defined expressions. Each engine is uniquely identified and may either be a predefined engine or a custom one defined by administrators.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
CustomDlpEngine	bit	Indicates whether this is a custom DLP engine (true for custom engines, false for predefined engines).
Description	string	A brief description of the DLP engine, explaining its purpose or configuration details.
DLPEngineID	integer	The unique identifier for the DLP engine.
EngineExpression	string	A logical expression defining the DLP engine's behavior. It uses logical operators (AND, OR, NOT, SUM) to determine how different data dictionaries are combined for content inspection.
ID	integer	The ID of the DLP Engine.
Name	string	The name of the DLP engine.
PredefinedEngineName	string	The name of a predefined DLP engine.

ZScalerEventLogReports

The ZScalerEventLogReports table stores event log reports generated for ZScaler API calls. Each record represents an event log entry captured during API interactions. These logs help track API requests and responses, categorize events, and record outcomes, messages, and errors.

Name	Type	Description
After	string	A description of what happened after the event was recorded.
BatchDate	datetime	The date and time data was synced to our database.
Category	string	The category under which the event falls. Categories help group related events, such as authentication, network security, or access control.
ConfigID	integer	The ID of the configuration within Compyl.
ErrorCode	string	The error code recorded in the event log, if applicable. This is useful for troubleshooting failed API calls.
Message	string	The message associated with the event log.
PreAction	string	A description of the state or actions taken before the event was recorded.
Result	string	The outcome of the API call, such as "Success" or "Failure." This helps in identifying the overall status of each logged event.
SubCategory	string	A subcategory providing more granular classification within the event category.
TimeStringValue	string	A human-readable string representation of the event timestamp.
UTCTime	datetime	The UTC timestamp when the event was logged. This helps in tracking the exact time of API interactions.
ZScalerEventLogID	integer	Unique identifier for each ZScaler event log entry.

ZScalerGroups

The ZScalerGroups table stores information about groups used in the ZScaler integration. These groups are defined by their name, identity provider (IdP) association, and additional descriptive details.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
Comments	string	Additional information or notes related to the group.
ConfigID	integer	The ID of the configuration within Compyl.
GroupId	integer	A unique identifier for the group.
ID	integer	The ID of the Group.
IdpId	integer	The unique identifier for the identity provider (IdP) associated with the group.
Name	string	The name of the group.

ZScalerICAPServers

This table stores information about Data Loss Prevention (DLP) servers that use the Internet Content Adaptation Protocol (ICAP) for integration with Zscaler. These servers facilitate secure communication between Zscaler and DLP solutions. The table contains details such as the server’s unique identifier, name, URL, and operational status.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ICAPServierID	integer	The unique identifier for an ICAP server.
ID	integer	The ID of the ICAP Server
Name	string	The name of the DLP server using ICAP.
Status	string	The current operational status of the DLP server. Possible values: "ENABLED" (active) or "DISABLED" (inactive).
Url	string	The URL of the DLP server.

ZScalerLocationGroups

The ZScalerLocationGroups table stores information about location groups within the ZScaler system. A location group is a logical grouping of locations, which can be either static or dynamic. Static groups contain predefined locations, while dynamic groups use criteria such as country, city, or name pattern matching to include locations dynamically. This table captures essential metadata about these groups, including their type, name, deletion status, and additional comments.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
Comments	string	Additional descriptive information or notes about the location group.
ConfigID	integer	The ID of the configuration within Compyl.
Deleted	bit	Indicates whether the location group has been deleted (true = deleted, false = active).
GroupType	string	The type of location group. Possible values: STATIC_GROUP (static group) or DYNAMIC_GROUP (dynamic group).
ID	integer	The ID of the Location Group.
LocationGroupID	integer	Unique identifier for a location group
Name	string	The name of the location group, which provides a human-readable identifier.
Predefined	bit	Indicates whether this location group is predefined in the system (true = predefined, false = user-defined).

ZScalerLocations

This table stores location data related to ZScaler's cloud security services. It includes information about network locations, bandwidth limits, authentication requirements, security settings, and geographic details.

Name	Type	Description
AupBlockInternetUntilAccepted	bit
AupEnabled	bit
AupForceSslInspection	bit	If true, enforces SSL inspection to ensure AUP compliance for HTTPS traffic.
AupTimeoutInDays	integer	The number of days after which the AUP must be re-validated.
AuthRequired	bit	If true, authentication is required for this location.
BatchDate	datetime	The date and time data was synced to our database.
CautionEnabled	bit	If true, enables caution notifications for users at this location.
City	string	The city name associated with the location.
ConfigID	integer	The ID of the configuration within Compyl.
Country	string	The country where the location is situated. This is an enumerated list of country codes.
Description	string	Additional notes or information about the location.
DisplayTimeUnit	string	The time unit to display for Surrogate IP idle timeout. Possible values: MINUTE, HOUR, DAY.
DnBandwidth	integer	The download bandwidth in kbps. A value of 0 means no bandwidth control is enforced.
GeoOverride	bit	If true, the latitude and longitude values must be manually provided.
ID	integer	The ID of the location.
IdleTimeInMinutes	integer	The idle timeout in minutes for disassociating users from Surrogate IP. Required if Surrogate IP is enabled
IotDiscoveryEnabled	bit	If true, IoT discovery is enabled for this location.
IpsControl	bit	If true, enables IPS (Intrusion Prevention System) control for this location. Requires firewall to be enabled.
Ipv6Dns64Prefix	string	The configured DNS64 prefix for IPv6 translation.
Ipv6Enabled	bit	If true, enables IPv6 traffic forwarding for this location.
Latitude	decimal	The latitude of the location, requiring up to 7-digit precision, ranging between -90 and 90 degrees. Required if GeoOverride is true.
LocationId	integer	Unique identifier for a location.
Longitude	decimal	The longitude of the location, requiring up to 7-digit precision, ranging between -180 and 180 degrees. Required if GeoOverride is true.
Name	string	The name of the location.
OfwEnabled	bit	If true, enables the firewall for this location.
Other6SubLocation	bit	If true, indicates that this is a system-generated default sub-location for IPv6 addresses not assigned to any user-defined sub-location. Only applies if IPv6 is enabled.
OtherSubLocation	bit	If true, indicates that this is a system-generated default sub-location for IPv4 addresses not assigned to any user-defined sub-location.
ParentId	integer	The ID of the parent location. If this ID is 0, it is a top-level location. Otherwise, it is a sub-location under the specified parent.
Profile	string	The profile tag categorizing traffic for this location.
SslScanEnabled	bit	Deprecated. Previously enabled SSL inspection to scan encrypted traffic for security risks.
SurrogateIP	bit	If true, enables Surrogate IP, which maps users to internal device IPs.
SurrogateIPEnforcedForKnownBrowsers	bit	If true, enforces Surrogate IP for all known browsers.
SurrogateRefreshTimeInMinutes	integer	Refresh time in minutes for re-validating Surrogate IPs
SurrogateRefreshTimeUnit	string	The time unit to display for Surrogate IP refresh time. Possible values: MINUTE, HOUR, DAY.
Tz	string	Timezone of the location. Defaults to GMT if not specified.
UpBandwidth	integer	The upload bandwidth in kbps. A value of 0 means no bandwidth control is enforced.
XffForwardEnabled	bit	If true, enables X-Forwarded-For (XFF) forwarding, passing client IPs through ZScaler Cloud.
ZappSSLScanEnabled	bit	Deprecated. Previously enabled ZScaler App SSL scanning for HTTPS traffic.

ZScalerNetworkServices

This table stores information about network services integrated with ZScaler. It includes details such as service name, type, description, and associated tags. The table is primarily used for managing network service configurations and retrieving relevant metadata.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	A human-readable description of the network service.
ID	integer	The ID of the Network service.
IsNameL10nTag	bit	Indicates whether the service name is a localization tag. Default is false, meaning the name is not localized by default.
Name	string	The name of the Network Service.
NetworkServiceID	integer	Unique identifier for the network service.
Tag	string	A predefined category or classification assigned to the network service. Possible values include various protocols and services such as ICMP_ANY, UDP_ANY, TCP_ANY, DNS, FTP, HTTP, HTTPS, and many more.
Type	string	Specifies the type of network service. Possible values include: STANDARD (default type), PREDEFINED (built-in service), and CUSTOM (user-defined service).

ZScalerSecurityPolicyDenyList

This table stores a list of URLs that are denied access based on security policies configured in ZScaler. It represents the denylist for an organization's advanced security policy, ensuring that specified URLs are blocked for compliance and security purposes.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
BlacklistUrl	string	The URL that is on the denylist for the organization's security policy
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the Security Policy Deny List.

ZScalerSecurityPolicyWhiteList

This table stores a list of URLs that are allowlisted in the ZScaler security policy. These URLs are exempt from malware scanning, advanced threat protection, and sandbox inspections. This allowlist is typically used to permit downloads from trusted websites that might otherwise be blocked due to security policies.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ID	integer	The ID of the Security Policy White List.
WhitelistUrl	string	The URL that has been added to the allowlist. Content from this URL will not be scanned for malware, spyware, or advanced threats. Users can download files from this URL without security inspections.

ZScalerSubLocations

The ZScalerSubLocations table stores information about sub-locations associated with ZScaler locations. A sub-location is a subset of a parent location and includes various configurations related to bandwidth, authentication, firewall settings, geolocation, and security policies. This data is used to manage network traffic and security policies for different geographic or logical divisions within an organization.

Name	Type	Description
AupBlockInternetUntilAccepted	bit	If true, blocks internet access until the user accepts the AUP.
AupEnabled	bit	If true, requires users to accept an Acceptable Use Policy (AUP) before accessing the internet.
AupForceSslInspection	bit	If true, forces SSL inspection for first-time AUP acceptance.
AupTimeoutInDays	integer	The number of days before the Acceptable Use Policy (AUP) must be re-accepted.
AuthRequired	bit	If true, authentication is enforced for users at this sub-location.
BatchDate	datetime	The date and time data was synced to our database.
CautionEnabled	bit	If true, enables a caution notification before internet access is granted.
City	string	The city where the sub-location is located.
ConfigID	integer	The ID of the configuration within Compyl.
Country	string	The country where the sub-location is located.
Description	string	Additional notes or information about the sub-location.
DisplayTimeUnit	string	The unit of time used to display idle time. Possible values: MINUTE, HOUR, DAY.
DnBandwidth	integer	The maximum download bandwidth (in kbps) allocated for the sub-location. A value of 0 means no bandwidth control is enforced.
GeoOverride	bit	If true, latitude and longitude values must be provided. Otherwise, they are automatically derived. Default is false.
ID	integer	The ID of the Sub Location.
IdleTimeInMinutes	integer	The idle time (in minutes) before user disassociation when Surrogate IP is enabled.
IotDiscoveryEnabled	bit	If true, enables IoT device discovery at this sub-location.
IpsControl	bit	If true, enables Intrusion Prevention System (IPS) control for the sub-location.
Ipv6Dns64Prefix	string	The DNS64 prefix used for NAT64 configuration when IPv6 is enabled.
Ipv6Enabled	bit	If true, enables IPv6 support for this sub-location.
Latitude	decimal	The latitude coordinate of the sub-location, required if GeoOverride is set to true.
Longitude	decimal	The longitude coordinate of the sub-location, required if GeoOverride is set to true.
Name	string	The name of the sub-location.
OfwEnabled	bit	If true, enables firewall enforcement for this sub-location.
Other6SubLocation	bit	If true, indicates this is a default sub-location created to accommodate IPv6 addresses not assigned to other user-defined sub-locations.
OtherSubLocation	bit	If true, indicates this is a default sub-location created to accommodate IPv4 addresses not assigned to other user-defined sub-locations.
ParentId	integer	The ID of the parent location. If this value is 0 or null, the sub-location is a parent location itself.
Profile	string	The profile tag that classifies the traffic type at this location. Auto-set based on authentication status.
SslScanEnabled	bit	Deprecated: Previously used to enable SSL inspection. Maintained for backward compatibility.
SubLocationID	integer	The unique identifier for the sub-location.
SurrogateIP	bit	If true, enables Surrogate IP, which maps users to internal device IPs.
SurrogateIPEnforcedForKnownBrowsers	bit	If true, enforces Surrogate IP for all known browsers.
SurrogateRefreshTimeInMinutes	integer	The time interval (in minutes) for revalidating Surrogate IP mappings.
SurrogateRefreshTimeUnit	string	The unit of time for surrogate refresh. Possible values: MINUTE, HOUR, DAY.
Tz	string	The time zone associated with the sub-location. Defaults to GMT if not specified.
UpBandwidth	integer	The maximum upload bandwidth (in kbps) allocated for the sub-location. A value of 0 means no bandwidth control is enforced.
XffForwardEnabled	bit	If true, the X-Forwarded-For (XFF) header is used for forwarding user IPs to ZScaler Cloud.
ZappSSLScanEnabled	bit	Deprecated: Previously used to enable SSL scanning for ZScaler App. Maintained for backward compatibility

ZScalerURLCategories

The ZScalerURLCategories table stores information about URL categories as defined by Zscaler. It includes predefined and custom categories used for filtering and classifying web traffic based on security and business policies. Each category can have associated URLs, keywords, and IP ranges, along with metadata such as whether the category is editable or custom.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
ConfiguredName	string	The name of the URL category, primarily used for custom categories. Predefined categories use default names provided by Zscaler.
CustomCategory	bit	Indicates whether this category is custom-defined. Defaults to false. Organizations can create up to 48 custom URL categories.
CustomUrlsCount	integer	The number of custom URLs added to this category. Organizations can add up to 25,000 custom URLs across all categories.
Description	string	A user-defined description for custom categories. Predefined categories contain a tag name that requires localization on the client side.
Editable	bit	Indicates if the category is editable. Custom categories are usually editable, but certain scope restrictions may apply. Defaults to false for predefined categories.
SuperCategory	string	The broader category to which this URL category belongs. Required for custom URL categories. (Enum: 40 predefined super categories such as EDUCATION, GOVERNMENT_AND_POLITICS, SECURITY, etc.)
TotalKeywordCount	integer	The total number of keywords linked to this category. Keywords help categorize web traffic.
TotalURLCount	integer	The total number of custom URLs associated with this category.
Type	string	Defines the type of the category.
URLCategoryId	string	Unique identifier for the URL category.
UrlsRetainingParentCategoryCount	integer	The number of custom URLs that remain linked to their original parent category for policy enforcement.

ZScalerURLFilteringRules

The ZScalerURLFilteringRules table stores information about URL filtering rules used in ZScaler security policies. Each rule defines conditions under which web traffic is filtered, blocked, allowed, or restricted based on URL categories, protocols, user groups, and other criteria. These rules help enforce company-wide security and compliance policies for internet usage.

Name	Type	Description
Action	string	Specifies the action taken when traffic matches the rule.
BatchDate	datetime	The date and time data was synced to our database.
BlockOverride	bit	If true, users may override the blocking action of this rule.
Ciparule	bit	If true, the rule enforces CIPA compliance.
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	Additional information about the rule and its purpose.
DeviceTrustLevels	string	Trust level of devices for which the rule applies. Possible values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
EndUserNotificationUrl	string	URL of the notification page displayed to end users when this rule is triggered.
EnforceTimeValidity	bit	If true, the rule applies only during a specified validity period.
LastModifiedBy_Id	bigint	The unique identifier of the administrator who last modified this rule.
LastModifiedBy_Name	string	The name of the administrator who last modified this rule.
LastModifiedTime	datetime	Timestamp of the last modification to this rule.
Name	string	The name assigned to the URL Filtering Rule.
Order	integer	Defines the execution order of the rule relative to other filtering rules.
Protocols	string	Specifies the protocol(s) this rule applies to. Possible values include HTTP, HTTPS, SSL, FTP, etc.
Rank	integer	The rank of the administrator who created this rule.
RequestMethods	string	Specifies which HTTP request methods (GET, POST, PUT, DELETE, etc.) this rule applies to.
RuleId	integer	Unique identifier for each URL Filtering Rule.
SizeQuota	integer	The data size (in KB) limit after which the rule is applied. If not set, no size restriction applies.
State	string	Indicates whether the rule is enabled or disabled. Possible values: ENABLED, DISABLED.
TimeQuota	integer	The time limit (in minutes) after which the rule is applied. If not set, no time restriction applies.
URLCategory	varchar	Primary category of URLs to which the rule applies.
URLCategory2	varchar	Secondary category of URLs, combined with URLCategory using a logical AND condition.
ValidityEndTime	datetime	The end date/time after which the rule expires, if time-based restrictions apply.
ValidityStartTime	datetime	The start date/time from which the rule is valid, if time-based restrictions apply.
ValidityTimeZoneId	string	The timezone used for ValidityStartTime and ValidityEndTime.

ZScalerUserGroups

The ZScalerUserGroups table stores relationships between users and groups in the ZScaler integration. This table links users to the groups they belong to, which is crucial for policy enforcement and access control. Each record represents a specific user-group association.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
GroupId	integer	The unique identifier for a group.
UserId	integer	The unique identifier for a user in the system

ZScalerUsers

The ZScalerUsers table stores information about users within the ZScaler system, including their identity, department, authentication details, and administrative roles. This data is used for managing user access, applying policies, and integrating with identity providers.

Name	Type	Description
AdminUser	bit	Indicates whether the user has administrative privileges. Defaults to false.
BatchDate	datetime	The date and time data was synced to our database.
Comments	string	Additional information about the user, such as notes or remarks.
ConfigID	integer	The ID of the configuration within Compyl.
DepartmentId	integer	The unique identifier of the department the user belongs to.
Email	string	The user's email address, which must be unique within the system.
ID	integer	The ID of the User.
IsAuditor	bit	Whether the user is assigned an auditor role.
Name	string	The full name of the user.
Password	string	The user's password.
TempAuthEmail	string	A temporary authentication email address.
Type	string	The type of user, provided only if they are not a standard end user. Possible values: SUPERADMIN, ADMIN, AUDITOR, GUEST, REPORT_USER, UNAUTH_TRAFFIC_DEFAULT.
UserId	integer	The unique identifier for a user.

ZScalerWebApplicationRules

The ZScalerWebApplicationRules table stores information about web application rules configured in ZScaler. These rules define access control policies for various cloud applications, including restrictions on usage, order of execution, time-based validity, and predefined rule settings.

Name	Type	Description
AccessControl	string	Determines the access privilege of this rule based on the admin's Role-Based Access (RBA) state.
BatchDate	datetime	The date and time data was synced to our database.
BrowserEunTemplateID	integer	The identifier for the browser-based EUN template.
CascadingEnabled	bit	If true, the rule settings cascade down to other associated rules.
ConfigID	integer	The ID of the configuration within Compyl.
EnforceTimeValidity	bit	If true, the rule is only valid for a specific time period, as defined by start and end times.
EunEnabled	bit	If true, Enhanced User Notification (EUN) is enabled for this rule.
EunTemplateID	integer	The identifier for the EUN template associated with this rule.
ID	integer	The ID of the Web Application Rule.
Name	string	The name assigned to the web application rule.
Order	integer	Defines the order in which this rule executes relative to other web application rules.
Predefined	bit	Indicates whether the rule is predefined by the system or custom-created by an administrator.
Rank	integer	The admin rank of the administrator who created the rule.
State	string	The current state of the rule. Options include ENABLED and DISABLED.
Type	string	Specifies the type of web application rule. Options include predefined categories like SOCIAL_NETWORKING, STREAMING_MEDIA, BUSINESS_PRODUCTIVITY, FINANCE, AI_ML, etc. (from schema).

ZScalerWebDLPRules

This table stores information about Web DLP (Data Loss Prevention) policy rules in ZScaler. These rules define how sensitive data is monitored and controlled when transmitted over web protocols. The rules can specify access control, severity, applicable protocols, file types, and various other configurations.

Name	Type	Description
AccessControl	string	The access privilege for this DLP policy rule based on the admin's state. Options: NONE (0), READ_ONLY (1), READ_WRITE (2).
Action	string	The action taken when traffic matches the rule criteria. Options: ANY, NONE, BLOCK, ALLOW, ICAP_RESPONSE.
BatchDate	datetime	The date and time data was synced to our database.
CloudApplications	string	The cloud applications to which this DLP policy rule applies. (This is a large predefined list in ZScaler).
ConfigID	integer	The ID of the configuration within Compyl.
Description	string	A human-readable description of the DLP rule.
DlpDownloadScanEnabled	bit	If true, DLP scanning is enabled for file downloads from cloud applications specified in the rule.
ExternalAuditorEmail	string	The email address of an external auditor who receives DLP notifications.
FileTypes	string	The list of file types the rule applies to. Example file types: PDF, ZIP, JPEG, EXE, DOCX.
ID	integer	The ID of the Web DLP Rule.
LastModifiedTime	integer	The timestamp of the last modification to the rule.
MatchOnly	bit	If true, the rule is evaluated for a match but does not enforce an action.
MinSize	integer	The minimum file size (in KB) that triggers the DLP rule evaluation.
Name	string	The name of the DLP policy rule.
Order	integer	The order in which this rule executes relative to other DLP rules.
ParentRule	integer	The unique identifier of the parent rule under which an exception rule is added.
Protocols	string	The protocol criteria specified for the rule. Options: ANY_RULE, FTP_RULE, HTTPS_RULE, HTTP_RULE.
Rank	integer	The rank of the administrator who created the DLP policy rule.
Severity	string	Indicates the severity of the rule violation. Options: RULE_SEVERITY_HIGH, RULE_SEVERITY_MEDIUM, RULE_SEVERITY_LOW, RULE_SEVERITY_INFO.
State	string	Whether the DLP rule is active or not. Options: DISABLED, ENABLED.
SubRules	string	A list of exception rules applied under this rule. Each sub-rule inherits attributes from the parent.
WebDLPRuleID	integer	The unique identifier for the Web DLP policy rule.
WithoutContentInspection	bit	If true, the rule operates without content inspection.
ZccNotificationsEnabled	bit	If true, ZScaler Client Connector notifications are enabled when this rule blocks traffic.
ZscalerIncidentReceiver	bit	Indicates whether a ZScaler Incident Receiver is associated with the rule.

Bridge Tables

ZScalerGroups_URLFilteringRules

Bridge table to represent many-to-many relationship between Groups and URL Filtering Rules.

Name	Type	Description
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
GroupId	bigint	The ID of the Group.
GroupName	string	The name of the Group.
RuleId	integer	The ID of the Rule.

ZScalerWebApplicationActions_ZScalerWebApplicationRules

Bridge table for Web Application Actions and Web Application Rules.

Name	Type	Description
ActionName	string	The action name.
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
WebApplicationRuleID	integer	The ID of the Web Application Rule.

ZScalerWebApplications_ZScalerWebApplicationRules

Bridge table for Web Applications and Web Application Rules.

Name	Type	Description
ApplicationName	string	The Application Name.
BatchDate	datetime	The date and time data was synced to our database.
ConfigID	integer	The ID of the configuration within Compyl.
WebApplicationRuleID	integer	The ID of the Web Application Rule.