Zscaler

LAST UPDATED: OCT 16, 2024

Overview

Zscaler is a cloud-based security service platform that enables users to establish fast and secure connections to their devices, regardless of their network, device or location. D3 SOAR's integration with Zscaler includes functions such as adding URLs to the blacklist or whitelist, removing URLs from the blacklist or whitelist and retrieving the blacklist or whitelist. Security teams can leverage D3 SOAR's integration with Zscaler for threat hunting, automating incident reponse, and orchestrating changes to black/white list.

D3 SOAR is providing REST operations to function with Zscaler.

Zscaler is available for use in:

D3 SOAR	V12.7.83.0+
Category	Network Security
Deployment Options	Option I, Option II, Option III, Option IV

Known Limitations

D3 Command	Required Source API	Rate Limit
Add URL To Blacklist	POST /security/advanced/blacklistUrls	1/sec and 400/hr
Add URL To Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Add URL To Category	PUT /urlCategories/{categoryId}	1/sec and 400/hr
Add URL To Category	DELETE /authenticatedSession	2/sec and 1000/hr
Add URL To Whitelist	PUT /security	1/sec and 400/hr
Add URL To Whitelist	DELETE /authenticatedSession	2/sec and 1000/hr
Get Blacklist	GET /security/advanced	1/sec and 400/hr
Get Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Get Sandbox Report	GET /sandbox/report/{md5Hash}	2/sec, 1000/hr, 1000/day
Get URL Category	POST /urlLookup	1/sec and 400/hr (100 URLs per call)
Get URL Category	DELETE /authenticatedSession	2/sec and 1000/hr
Get Whitelist	GET /security	2/sec and 1000/hr
Get Whitelist	DELETE /authenticatedSession	2/sec and 1000/hr
List All Categories	GET /urlCategories	2/sec and 1000/hr
List All Categories	DELETE /authenticatedSession	2/sec and 1000/hr
Remove URL From Blacklist	POST /security/advanced/blacklistUrls	1/sec and 400/hr
Remove URL From Blacklist	DELETE /authenticatedSession	2/sec and 1000/hr
Remove URL From Whitelist	GET /security	2/sec and 1000/hr
	PUT /security	1/sec and 400/hr
	DELETE /authenticatedSession	2/sec and 1000/hr
Upload File to Sandbox	POST /zscsb/submit	1/sec and 400/hr
Test Connection	POST /authenticatedSession	2/sec and 1000/hr

Please refer to the API Rate Limit Summary to check your rate limits.

Connection

To connect to Zscaler from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Server URL	The URL of the Zscaler server.	https://admin.*****.net/
Username	The username to authenticate the connection.	test@example.net
Password	The password to authenticate the connection.	P@$$w0rd
API Key	The API key to authenticate the connection.	api*****H2g
Sandbox Submission API Token	The Sandbox Submission API token to authenticate the connection.	AQ*****1wY
API Version	The version of the API to use for the connection.	v1.0

Permission Requirements

Each endpoint in the Zscaler API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Required Permission (Policy and Administrators Access)	Required Permission (Functional Scope)
Add URL To Blacklist	Policy Access: Full Administrators Access: N/A	Security
Add URL To Category	Policy Access: Full Administrators Access: N/A	Access Control (Web and Mobile) ->Custom URL Category Management, Override Existing Categories
Add URL To Whitelist	Policy Access: Full Administrators Access: N/A	Security
Get Blacklist	Policy Access: View Only Administrators Access: N/A	Security
Get Sandbox Report	Policy Access:N/A Administrators Access: N/A	N/A
Get URL Category	Policy Access: View Only Administrators Access: N/A	Access Control (Web and Mobile) ->Custom URL Category Management
Get Whitelist	Policy Access: View Only Administrators Access: N/A	Security
List All Categories	Policy Access: View Only Administrators Access: N/A	Access Control (Web and Mobile) ->Custom URL Category Management
Remove URL From Blacklist	Policy Access: Full Administrators Access: N/A	Security
Remove URL From Whitelist	Policy Access: Full Administrators Access: N/A	Security
Upload File to sandbox	Policy Access: N/A Administrators Access: N/A	N/A
Test Connection	Policy Access: N/A Administrators Access: N/A	N/A

Configuring Zscaler to Work with D3 SOAR

Adding a User

To add users in Zscaler, see Adding Users from Zscaler's documentation for instructions. You may use your created user or system default user for configuration.

Obtaining API key and Sandbox Submission API Token

To obtain your API key and Sanbox Submission API token, see Cloud Service API Key Management from Zscaler's documentation for instructions.

Creating an API Role

To create an API role, navigate to Administration > Role Management > Add API Role. Refer to Permission Requirements for the respective permissions to enable for each command.

Configuring D3 SOAR to Work with Zscaler

Log in to D3 SOAR.
Find the Zscaler integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type Zscaler in the search box to find the integration, then click it to select it.
4. Click + New Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Zscaler.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  1. Input your domain level Server URL. The default value is https://admin.zscalerthree.net.
  2. Input your Username.
  3. Input your Password.
  4. Input your saved API Key.
  5. Input the Sandbox Submission API Token if you need to use the Upload File to Sandbox command, it is optional for all other commands.
  6. Input your API Version. The default value is v1.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green check mark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click Add to create and add the configured connection.

Commands

Zscaler includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Zscaler API, please refer to the Zscaler API reference.

READER NOTE

Certain permissions are required for each command. Please refer to the Permission Requirements and Configuring Zscaler to Work with D3 SOAR for details.

Add URL To Blacklist

Adds URLs to the blacklist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the blacklist.	JSON `["Hello.com"]`

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Zscaler API response by adding the "result" field to indicate whether the URLs have been successfully added to the blacklist.

SAMPLE DATA

JSON

{
    "result": "Add URL to blacklist Successfully"
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 enriches the context data from the original Zscaler API response by adding the "result" field to indicate whether the URLs have been successfully added to the blacklist.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "result": "Add URL to blacklist Successfully"
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Add URL To Blacklist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Add URL To Category

Adds URLs to a category.

READER NOTE

Category is a required parameter to run this command.

Run the List All Categories command to obtain Category. Category is referring to the Category ID, which can be found from the returned raw data at the path $[*].id.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the specified category.	["hello.com"]
Category	Required	The ID of the category to add URLs. Category IDs can be obtained using the List All Categories command.	MUSIC

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "id": "MUSIC",
    "keywordsRetainingParentCategory": [],
    "urls": [
        "mozart.com",
        "hello.com",
        "aaa.com",
        "bbb.com"
    ],
    "dbCategorizedUrls": [
        "brahms.com"
    ],
    "customCategory": false,
    "editable": true,
    "description": "MUSIC_DESC",
    "type": "URL_CATEGORY",
    "val": 24,
    "customUrlsCount": 4,
    "urlsRetainingParentCategoryCount": 1
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "id": "MUSIC",
    "keywordsRetainingParentCategory": [],
    "urls": [
        "mozart.com",
        "hello.com",
        "aaa.com",
        "bbb.com"
    ],
    "dbCategorizedUrls": [
        "brahms.com"
    ],
    "customCategory": false,
    "editable": true,
    "description": "MUSIC_DESC",
    "type": "URL_CATEGORY",
    "val": 24,
    "customUrlsCount": 4,
    "urlsRetainingParentCategoryCount": 1
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Category": "MUSIC",
    "CustomCategory": false,
    "Urls": [
        "mozart.com",
        "hello.com",
        "aaa.com",
        "bbb.com"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

id	MUSIC
keywordsRetainingParentCategory
urls	mozart.com hello.com aaa.com bbb.com
dbCategorizedUrls	brahms.com
customCategory	False
editable	True
description	MUSIC_DESC
type	URL_CATEGORY
val	24
customUrlsCount	4
urlsRetainingParentCategoryCount	1

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Category failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Category Not Found.

Error Sample Data

Add URL To Category failed.

Status Code: 404.

Message: Category Not Found.

Add URL To Whitelist

Adds URLs to the whitelist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to add to the whitelist.	["world.com"]

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Zscaler API response by adding the "result" field to indicate whether the URLs have been successfully added to the blacklist.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "world.com"
    ]
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "world.com"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "world.com"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

whitelistUrls

world.com

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Add URL To Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Add URL To Whitelist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Get Blacklist

Retrieves blacklisted URLs.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "blacklistUrls": [
        "testd3test.com",
        "google.com",
        "testd4test.com",
        "youtube.com",
        "www.d4.com",
        "www.testestest.com",
        "xmr.pool.minergate.com",
        "youtub.com",
        "facebook.com",
        "www.d5.com",
        "Hell1o.com",
        "www.testd3test.com",
        "aaa.com",
        "www.testtesttest.com",
        "www.testd3.com",
        "world.com"
    ]
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "blacklistUrls": [
        "testd3test.com",
        "google.com",
        "testd4test.com",
        "youtube.com",
        "www.d4.com",
        "www.testestest.com",
        "xmr.pool.minergate.com",
        "youtub.com",
        "facebook.com",
        "www.d5.com",
        "Hell1o.com",
        "www.testd3test.com",
        "aaa.com",
        "www.testtesttest.com",
        "www.testd3.com",
        "world.com"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "BlacklistUrls": [
        "testd3test.com",
        "google.com",
        "testd4test.com",
        "youtube.com",
        "www.d4.com",
        "www.testestest.com",
        "xmr.pool.minergate.com",
        "youtub.com",
        "facebook.com",
        "www.d5.com",
        "Hell1o.com",
        "www.testd3test.com",
        "aaa.com",
        "www.testtesttest.com",
        "www.testd3.com",
        "world.com"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

blacklistUrls

testd3test.com
http://google.com
testd4test.com
http://youtube.com
www.d4.com
http://www.testestest.com
http://xmr.pool.minergate.com
youtub.com
http://facebook.com
www.d5.com
Hell1o.com
www.testd3test.com
http://aaa.com
www.testtesttest.com
www.testd3.com
http://world.com

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Get Blacklist failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

Get Sandbox Report

Retrieves a full or summarized report containing details about the MD5 hash of a file analyzed in the sandbox.

READER NOTE

If the selected report type is "Summary", the "Summary" path will provide data on "Summary", "Classification", and "FileProperties". On the other hand, if the selected report type is "Full", the "Full Details" path will include information on "System Summary", "Networking", "Security Bypass", "Stealth", as well as "Summary", "Classification", and "FileProperties". Refer to the sample data for more information.
To use this command, a subscription to the cloud sandbox is required. Without it, the command cannot be executed.

Input

Input Parameter	Required/Optional	Description	Example
MD5 Hash	Required	The MD5 hash of the file analyzed in the sandbox.	b3b13c2fe5710507612106cb11ceced3
Report Type	Optional	The report type (i.e., full or summary) to return. The default setting is Summary.	Full

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "Full Details": {
        "Summary": {
            "Status": "COMPLETED",
            "Category": "SCRIPT",
            "FileType": "CMD",
            "Start Time": 1509567511,
            "Duration": 454557,
            "Analysis": "0",
            "Url": "",
            "TimeUnit": "ms",
            "StartTime": "Nov 1, 2017 1:18:31 PM"
        },
        "Classification": {
            "Type": "MALICIOUS",
            "Category": "MALWARE_BOTNET",
            "Score": 86,
            "Max Score": 100,
            "DetectedMalware": ""
        },
        "File Properties": {
            "File Type": "CMD",
            "File Size": 9810,
            "MD5": "****************************************",
            "SHA1": "****************************************",
            "Sha256": "****************************************",
            "Issuer": "",
            "Digital Cerificate": "",
            "SSDeep": "****************************************",
            "RootCA": ""
        },
        "System Summary": [
            {
                "Risk": "LOW",
                "Signature": "Allocates memory within range which is reserved for system DLLs",
                "Signature Sources": [
                    "",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Classification label",
                "Signature Sources": [
                    "",
                    "mal68.***/***/***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Creates files inside the user directory",
                "Signature Sources": [
                    "",
                    "C:\\Users\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Found command line output",
                "Signature Sources": [
                    ""
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Queries the cryptographic machine GUID",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Reads software policies",
                "Signature Sources": [
                    "",
                    "HKEY_USERS\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Sample sleeps for a long time",
                "Signature Sources": [
                    ""
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Spawns processes",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Uses an in-process (OLE) Automation server",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            }
        ],
        "Networking": [
            {
                "Risk": "MODERATE",
                "Signature": "Uses ipconfig to modify the Windows network settings",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Uses netsh to modify the Windows network and firewall settings",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            }
        ],
        "Security Bypass": [
            {
                "Risk": "LOW",
                "Signature": "Checks for kernel debuggers",
                "Signature Sources": [
                    "",
                    "KernelDebuggerInformation"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Executes massive amount of sleeps in a loop",
                "Signature Sources": [
                    "",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Enables debug privileges",
                "Signature Sources": [
                    "",
                    "Debug"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Sample sleeps for a long time (installer files shows these property).",
                "Signature Sources": [
                    ""
                ]
            }
        ],
        "Stealth": [
            {
                "Risk": "LOW",
                "Signature": "Disables application error messages",
                "Signature Sources": [
                    "",
                    "NOOPENFILEERRORBOX",
                    "NOOPENFILEERRORBOX",
                    "NOOPENFILEERRORBOX",
                    "NOOPENFILEERRORBOX"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Very long cmdline option found",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe logman  create trace autosession\\*** -p  0xffffffff 255 -f bincirc -max 250 -o C:\\Users\\win_7_64bit\\Desktop\\***\\***\\***\\***\\***\\***.etl",
                    "C:\\Windows\\***\\***\\***.exe logman  create trace autosession\\***-p {***************************************} 0xffffffff 255 -f bincirc -max 250 -o C:\\Users\\***\\***\\***\\***\\***\\***"
            }
        ],
        "Persistence": [
            {
                "Risk": "MODERATE",
                "Signature": "Creates or modifies Windows services",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Modifies security policies related information",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Uses sc.exe to modify the status of services",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe"
                ]
            }
        ]
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "Full Details": {
        "Summary": {
            "Status": "COMPLETED",
            "Category": "SCRIPT",
            "FileType": "CMD",
            "Start Time": 1509567511,
            "Duration": 454557,
            "Analysis": "0",
            "Url": "",
            "TimeUnit": "ms",
            "StartTime": "Nov 1, 2017 1:18:31 PM"
        },
        "Classification": {
            "Type": "MALICIOUS",
            "Category": "MALWARE_BOTNET",
            "Score": 86,
            "Max Score": 100,
            "DetectedMalware": ""
        },
        "File Properties": {
            "File Type": "CMD",
            "File Size": 9810,
            "MD5": "***************************************",
            "SHA1": "***************************************",
            "Sha256": "***************************************",
            "Issuer": "",
            "Digital Cerificate": "",
            "SSDeep": "***************************************",
            "RootCA": ""
        },
        "System Summary": [
            {
                "Risk": "LOW",
                "Signature": "Allocates memory within range which is reserved for system DLLs",
                "Signature Sources": [
                    "",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76E70000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write",
                    "76F90000 page execute and read and write"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Classification label",
                "Signature Sources": [
                    "",
                    "mal68.***/***/***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Creates files inside the user directory",
                "Signature Sources": [
                    "",
                    "C:\\Users\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Found command line output",
                "Signature Sources": [
                    ""
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Queries the cryptographic machine GUID",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Reads software policies",
                "Signature Sources": [
                    "",
                    "HKEY_USERS\\***\\***\\***"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Sample sleeps for a long time",
                "Signature Sources": [
                    ""
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Spawns processes",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe ",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Uses an in-process (OLE) Automation server",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            }
        ],
        "Networking": [
            {
                "Risk": "MODERATE",
                "Signature": "Uses ipconfig to modify the Windows network settings",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Uses netsh to modify the Windows network and firewall settings",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            }
        ],
        "Security Bypass": [
            {
                "Risk": "LOW",
                "Signature": "Checks for kernel debuggers",
                "Signature Sources": [
                    "",
                    "KernelDebuggerInformation"
                ]
            },
            {
                "Risk": "LOW",
                "Signature": "Executes massive amount of sleeps in a loop",
                "Signature Sources": [
                    "",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms",
                    "-60000ms >= -60000ms"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Enables debug privileges",
                "Signature Sources": [
                    "",
                    "Debug"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Sample sleeps for a long time (installer files shows these property).",
                "Signature Sources": [
                    ""
                ]
            }
        ],
        "Stealth": [
            {
                "Risk": "LOW",
                "Signature": "Disables application error messages",
                "Signature Sources": [
                    "",
                    "******************",
                    "******************",
                    "******************"
                ]
            },
            {
                "Risk": "MODERATE",
                "Signature": "Very long cmdline option found",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe logman  create trace autosession\\IntelNetwfw02 -p  0xffffffff 255 -f bincirc -max 250 -o C:\\Users\\***\\***\\***\\***\\***\\***.etl",
                    "C:\\Windows\\***\\***\\***.exe logman  create trace autosession\\bcrmwlan -p {CEA4623F-AA31-4286-B3A5-797EF8A75C17} 0xffffffff 255 -f bincirc -max 250 -o C:\\Users\\***\\***\\***\\***\\***\\***",
                    "C:\\Windows\\***\\***\\***.exe logman  create trace autosession\\mwls97w8arm -p {BFA91C93-9E18-497C-971B-490D06089E97} 0x1 255 -f bincirc -max 250 -o C:\\Users\\***\\***\\***\\***\\***\\***"
             }
        ],
        "Persistence": [
            {
                "Risk": "MODERATE",
                "Signature": "Creates or modifies Windows services",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Modifies security policies related information",
                "Signature Sources": [
                    "",
                    "HKEY_LOCAL_MACHINE\\***\\***\\***"
                ]
            },
            {
                "Risk": "HIGH",
                "Signature": "Uses sc.exe to modify the status of services",
                "Signature Sources": [
                    "",
                    "C:\\Windows\\***\\***\\***.exe "
                ]
            }
        ]
    }
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "ClassificationType": "MALICIOUS",
    "ClassificationCategory": "MALWARE_BOTNET",
    "ClassificationScore": 86,
    "DetectedMalware": "",
    "FileType": "CMD",
    "MD5": "***************************************",
    "SHA1": "***************************************",
    "SHA256": "***************************************",
    "SSDeep": "***************************************"
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

Summary	{'Status': 'COMPLETED', 'Category': 'SCRIPT', 'FileType': 'CMD', 'Start Time': 1509567511, 'Duration': 454557, 'Analysis': '0', 'Url': '', 'TimeUnit': 'ms', 'StartTime': 'Nov 1, 2017 1:18:31 PM'}
Classification	{'Type': 'MALICIOUS', 'Category': 'MALWARE_BOTNET', 'Score': 86, 'Max Score': 100, 'DetectedMalware': ''}
File Properties	{'File Type': 'CMD', 'File Size': 9810, 'MD5': '********************************', 'SHA1': '******************************', 'Sha256': '******************************', 'Issuer': '', 'Digital Cerificate': '', 'SSDeep': '********************************', 'RootCA': ''}
System Summary	{'Risk': 'LOW', 'Signature': 'Allocates memory within range which is reserved for system DLLs', 'Signature Sources': ['', '76E70000 page execute and read and write', '76E70000 page execute and read and write', '76E70000 page execute and read and write', '76E70000 page execute and read and write', '76F90000 page execute and read and write', '76F90000 page execute and read and write', '76F90000 page execute and read and write', '76F90000 page execute and read and write']} {'Risk': 'LOW', 'Signature': 'Classification label', 'Signature Sources': ['', 'mal68.*//']} {'Risk': 'LOW', 'Signature': 'Creates files inside the user directory', 'Signature Sources': ['', 'C:\\\\Users\\\\\\\\\\\\']} {'Risk': 'LOW', 'Signature': 'Found command line output', 'Signature Sources': ['']} {'Risk': ‘LOW', 'Signature': 'Queries the cryptographic machine GUID', 'Signature Sources': ['', 'HKEY_LOCAL_MACHINE\\\\\\\\\\\\’]} {'Risk': 'LOW', 'Signature': 'Reads software policies', 'Signature Sources': ['', 'HKEY_USERS\\\\\\\\\\\\\\\\\\\\\\\\']} {'Risk': 'LOW', 'Signature': 'Sample sleeps for a long time', 'Signature Sources': ['']} {'Risk': 'LOW', 'Signature': 'Spawns processes', 'Signature Sources': ['', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ', 'C:\\\\Windows\\\\\\\\.exe ']} {'Risk': 'LOW', 'Signature': 'Uses an in-process (OLE) Automation server', 'Signature Sources': ['', 'HKEY_LOCAL_MACHINE\\\\\\\\\\\\\\\\\\\\{******************************}\\\\*']}
Networking	{'Risk': 'MODERATE', 'Signature': 'Uses ipconfig to modify the Windows network settings', 'Signature Sources': ['', 'C:\\\\Windows\\\\*\\\\.exe ']} {'Risk': 'HIGH', 'Signature': 'Uses netsh to modify the Windows network and firewall settings', 'Signature Sources': ['', 'C:\\\\Windows\\\\\\\\*.exe ']}
Security Bypass	{'Risk': 'LOW', 'Signature': 'Checks for kernel debuggers', 'Signature Sources': ['', 'KernelDebuggerInformation']} {'Risk': 'LOW', 'Signature': 'Executes massive amount of sleeps in a loop', 'Signature Sources': ['', '-60000ms >= -60000ms', '-60000ms >= -60000ms', '-60000ms >= -60000ms', '-60000ms >= -60000ms', '-60000ms >= -60000ms']} {'Risk': 'MODERATE', 'Signature': 'Enables debug privileges', 'Signature Sources': ['', 'Debug']} {'Risk': 'MODERATE', 'Signature': 'Sample sleeps for a long time (installer files shows these property).', 'Signature Sources': ['']}
Stealth	{'Risk': 'LOW', 'Signature': 'Disables application error messages', 'Signature Sources': ['', '************', '**********', '**********', '**********']} {'Risk': 'MODERATE', 'Signature': 'Very long cmdline option found', 'Signature Sources': ['', 'C:\\\\Windows\\\\\\\\.exe logman create trace \\\\ -p 0xffffffff 255 -f bincirc -max 250 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\\\\\.etl', 'C:\\\\Windows\\\\\\\\.exe logman create trace autosession\\\\bcrmwlan -p {CEA4623F-AA31-4286-B3A5-797EF8A75C17} 0xffffffff 255 -f bincirc -max 250 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\.exe logman create trace autosession\\\\mwls97w8arm -p {**********} 0x1 255 -f bincirc -max 250 -o C:\\\\Users\\\\win_7_64bit\\\\Desktop\\\\WlanTraces\\\\WIN_7_64BIT-PC-11-01-2017_0825\\\\Marvell_WIN_7_64BIT-PC_11-01-2017_0', 'C:\\\\Users\\\\\\\\\\\\.exe logman create trace autosession\\\\qcwlan -p {***********} 0xffff 18 -f bincirc -max 250 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\', 'C:\\\\Windows\\\\\\\\.exe logman start bcrmwlan -p {**********} 0xffffffff 255 -f bincirc -max 150 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\.etl -ets', 'C:\\\\Windows\\\\\\\\.exe logman start mwls97w8arm -p {***********} 0x1 255 -f bincirc -max 150 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\\\\\.etl -ets', 'C:\\\\Windows\\\\\\\\.exe logman start qcwlan -p {**********} 0xffff 18 -f bincirc -max 150 -o C:\\\\Users\\\\\\\\\\\\\\\\\\\\\\\\.etl -ets', 'C:\\\\Windows\\\\\\\\.exe netsh trace sta wireless_dbg provider={**********} 0xff globallevel=0xff persistent=yes trace=C:\\\\Users\\\\\\\\\\\\\\\\\\\\*']}
Persistence	{'Risk': 'MODERATE', 'Signature': 'Creates or modifies Windows services', 'Signature Sources': ['', 'HKEY_LOCAL_MACHINE\\\\*\\\\\\\\\\\\\\\\']} {'Risk': 'HIGH', 'Signature': 'Modifies security policies related information', 'Signature Sources': ['', 'HKEY_LOCAL_MACHINE\\\\\\\\\\\\\\\\\\\\\\\\']} {'Risk': 'HIGH', 'Signature': 'Uses sc.exe to modify the status of services', 'Signature Sources': ['', 'C:\\\\Windows\\\\\\\\**.exe ']}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Sandbox Report failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Cloud Sandbox subscription is required, but it is currently expired.

Error Sample Data

Get Sandbox Report failed.

Status Code: 403.

Message: Cloud Sandbox subscription is required, but it is currently expired.

Get URL Category

Retrieves the categories of the given URLs. If the total number of URLs exceeds 100, only the first 100 functional URLs will be processed.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Required	The list of URLs to retrieve their respective categories.	JSON `["google.com","youtube.com","facebook.com"]`

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "url": "google.com",
        "urlClassifications": [
            "WEB_SEARCH"
        ],
        "urlClassificationsWithSecurityAlert": []
    },
    {
        "url": "youtube.com",
        "urlClassifications": [
            "STREAMING_MEDIA"
        ],
        "urlClassificationsWithSecurityAlert": []
    },
    {
        "url": "facebook.com",
        "urlClassifications": [
            "SOCIAL_NETWORKING"
        ],
        "urlClassificationsWithSecurityAlert": []
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

[
    {
        "url": "google.com",
        "urlClassifications": [
            "WEB_SEARCH"
        ],
        "urlClassificationsWithSecurityAlert": []
    },
    {
        "url": "youtube.com",
        "urlClassifications": [
            "STREAMING_MEDIA"
        ],
        "urlClassificationsWithSecurityAlert": []
    },
    {
        "url": "facebook.com",
        "urlClassifications": [
            "SOCIAL_NETWORKING"
        ],
        "urlClassificationsWithSecurityAlert": []
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "Urls": [
        "google.com",
        "youtube.com",
        "facebook.com"
    ],
    "Category": [
        "WEB_SEARCH",
        "STREAMING_MEDIA",
        "SOCIAL_NETWORKING"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

url	urlClassifications	urlClassificationsWithSecurityAlert
http://google.com	JSON `[ "WEB_SEARCH" ]`	[]
http://youtube.com	CODE `[ "STREAMING_MEDIA" ]`	[]
http://facebook.com	CODE `[ "SOCIAL_NETWORKING" ]`	[]

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get URL Category failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid URL.

Error Sample Data

Get URL Category failed.

Status Code: 400.

Message: Invalid URL.

Get Whitelist

Retrieves whitelisted URLs.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "8.8.8.8",
        "paypal.com",
        "wellsfargo.com"
    ]
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "8.8.8.8",
        "paypal.com",
        "wellsfargo.com"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.
The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "WhitelistUrls": [
        "8.8.8.8",
        "paypal.com",
        "wellsfargo.com"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

whitelistUrls

8.8.8.8
paypal.com
wellsfargo.com

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Get Whitelist failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

List All Categories

Retrieves a list of all categories.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "id": "OTHER_ADULT_MATERIAL",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ADULT_MATERIAL_DESC",
        "type": "URL_CATEGORY",
        "val": 1,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADULT_THEMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADULT_THEMES_DESC",
        "type": "URL_CATEGORY",
        "val": 2,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "LINGERIE_BIKINI",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "LINGERIE_BIKINI_DESC",
        "type": "URL_CATEGORY",
        "val": 3,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NUDITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NUDITY_DESC",
        "type": "URL_CATEGORY",
        "val": 4,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PORNOGRAPHY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PORNOGRAPHY_DESC",
        "type": "URL_CATEGORY",
        "val": 5,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SEXUALITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SEXUALITY_DESC",
        "type": "URL_CATEGORY",
        "val": 6,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADULT_SEX_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADULT_SEX_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 7,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "K_12_SEX_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "K_12_SEX_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 8,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_ADULT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_ADULT_DESC",
        "type": "URL_CATEGORY",
        "val": 100,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_DRUGS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_DRUGS_DESC",
        "type": "URL_CATEGORY",
        "val": 14,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MARIJUANA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MARIJUANA_DESC",
        "type": "URL_CATEGORY",
        "val": 118,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "GAMBLING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "GAMBLING_DESC",
        "type": "URL_CATEGORY",
        "val": 27,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "VIOLENCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "VIOLENCE_DESC",
        "type": "URL_CATEGORY",
        "val": 88,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEAPONS_AND_BOMBS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEAPONS_AND_BOMBS_DESC",
        "type": "URL_CATEGORY",
        "val": 89,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TASTELESS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TASTELESS_DESC",
        "type": "URL_CATEGORY",
        "val": 85,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MILITANCY_HATE_AND_EXTREMISM",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MILITANCY_HATE_AND_EXTREMISM_DESC",
        "type": "URL_CATEGORY",
        "val": 57,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_ILLEGAL_OR_QUESTIONABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ILLEGAL_OR_QUESTIONABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 33,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "COPYRIGHT_INFRINGEMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "COPYRIGHT_INFRINGEMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 34,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "COMPUTER_HACKING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "COMPUTER_HACKING_DESC",
        "type": "URL_CATEGORY",
        "val": 35,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "QUESTIONABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "QUESTIONABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 36,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PROFANITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PROFANITY_DESC",
        "type": "URL_CATEGORY",
        "val": 37,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MATURE_HUMOR",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MATURE_HUMOR_DESC",
        "type": "URL_CATEGORY",
        "val": 38,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ANONYMIZER",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ANONYMIZER_DESC",
        "type": "URL_CATEGORY",
        "val": 39,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SOCIETY_AND_LIFESTYLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SOCIETY_AND_LIFESTYLE_DESC",
        "type": "URL_CATEGORY",
        "val": 72,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ART_CULTURE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ART_CULTURE_DESC",
        "type": "URL_CATEGORY",
        "val": 73,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALTERNATE_LIFESTYLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALTERNATE_LIFESTYLE_DESC",
        "type": "URL_CATEGORY",
        "val": 74,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HOBBIES_AND_LEISURE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HOBBIES_AND_LEISURE_DESC",
        "type": "URL_CATEGORY",
        "val": 75,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DINING_AND_RESTAURANT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DINING_AND_RESTAURANT_DESC",
        "type": "URL_CATEGORY",
        "val": 76,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALCOHOL_TOBACCO",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALCOHOL_TOBACCO_DESC",
        "type": "URL_CATEGORY",
        "val": 77,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_NETWORKING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_NETWORKING_DESC",
        "type": "URL_CATEGORY",
        "val": 78,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HEALTH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HEALTH_DESC",
        "type": "URL_CATEGORY",
        "val": 32,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPORTS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPORTS_DESC",
        "type": "URL_CATEGORY",
        "val": 84,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPECIAL_INTERESTS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPECIAL_INTERESTS_DESC",
        "type": "URL_CATEGORY",
        "val": 83,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_GAMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_GAMES_DESC",
        "type": "URL_CATEGORY",
        "val": 28,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_NETWORKING_GAMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_NETWORKING_GAMES_DESC",
        "type": "URL_CATEGORY",
        "val": 101,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SHOPPING_AND_AUCTIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SHOPPING_AND_AUCTIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 79,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPECIALIZED_SHOPPING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPECIALIZED_SHOPPING_DESC",
        "type": "URL_CATEGORY",
        "val": 80,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REAL_ESTATE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REAL_ESTATE_DESC",
        "type": "URL_CATEGORY",
        "val": 81,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ONLINE_AUCTIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ONLINE_AUCTIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 82,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SOCIAL_AND_FAMILY_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SOCIAL_AND_FAMILY_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 69,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 70,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FAMILY_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FAMILY_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 71,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_RELIGION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_RELIGION_DESC",
        "type": "URL_CATEGORY",
        "val": 60,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRADITIONAL_RELIGION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRADITIONAL_RELIGION_DESC",
        "type": "URL_CATEGORY",
        "val": 61,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CULT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CULT_DESC",
        "type": "URL_CATEGORY",
        "val": 62,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALT_NEW_AGE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALT_NEW_AGE_DESC",
        "type": "URL_CATEGORY",
        "val": 63,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 15,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CONTINUING_EDUCATION_COLLEGES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CONTINUING_EDUCATION_COLLEGES_DESC",
        "type": "URL_CATEGORY",
        "val": 16,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HISTORY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HISTORY_DESC",
        "type": "URL_CATEGORY",
        "val": 17,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "K_12",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "K_12_DESC",
        "type": "URL_CATEGORY",
        "val": 18,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REFERENCE_SITES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REFERENCE_SITES_DESC",
        "type": "URL_CATEGORY",
        "val": 19,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SCIENCE_AND_TECHNOLOGY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SCIENCE_AND_TECHNOLOGY_DESC",
        "type": "URL_CATEGORY",
        "val": 20,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_BUSINESS_AND_ECONOMY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_BUSINESS_AND_ECONOMY_DESC",
        "type": "URL_CATEGORY",
        "val": 9,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CORPORATE_MARKETING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CORPORATE_MARKETING_DESC",
        "type": "URL_CATEGORY",
        "val": 10,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FINANCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FINANCE_DESC",
        "type": "URL_CATEGORY",
        "val": 11,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PROFESSIONAL_SERVICES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PROFESSIONAL_SERVICES_DESC",
        "type": "URL_CATEGORY",
        "val": 12,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CLASSIFIEDS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CLASSIFIEDS_DESC",
        "type": "URL_CATEGORY",
        "val": 13,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRADING_BROKARAGE_INSURANCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRADING_BROKARAGE_INSURANCE_DESC",
        "type": "URL_CATEGORY",
        "val": 115,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "JOB_SEARCH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "JOB_SEARCH_DESC",
        "type": "URL_CATEGORY",
        "val": 56,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_INFORMATION_TECHNOLOGY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_INFORMATION_TECHNOLOGY_DESC",
        "type": "URL_CATEGORY",
        "val": 40,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRANSLATORS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRANSLATORS_DESC",
        "type": "URL_CATEGORY",
        "val": 41,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "IMAGE_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "IMAGE_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 42,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FILE_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FILE_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 43,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SHAREWARE_DOWNLOAD",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SHAREWARE_DOWNLOAD_DESC",
        "type": "URL_CATEGORY",
        "val": 44,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_BANNERS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_BANNERS_DESC",
        "type": "URL_CATEGORY",
        "val": 45,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 46,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_SEARCH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_SEARCH_DESC",
        "type": "URL_CATEGORY",
        "val": 47,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PORTALS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PORTALS_DESC",
        "type": "URL_CATEGORY",
        "val": 48,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SAFE_SEARCH_ENGINE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SAFE_SEARCH_ENGINE_DESC",
        "type": "URL_CATEGORY",
        "val": 49,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CDN",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CDN_DESC",
        "type": "URL_CATEGORY",
        "val": 107,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OSS_UPDATES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OSS_UPDATES_DESC",
        "type": "URL_CATEGORY",
        "val": 114,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DNS_OVER_HTTPS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DNS_OVER_HTTPS_DESC",
        "type": "URL_CATEGORY",
        "val": 117,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_INTERNET_COMMUNICATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_INTERNET_COMMUNICATION_DESC",
        "type": "URL_CATEGORY",
        "val": 50,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "INTERNET_SERVICES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "INTERNET_SERVICES_DESC",
        "type": "URL_CATEGORY",
        "val": 51,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DISCUSSION_FORUMS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DISCUSSION_FORUMS_DESC",
        "type": "URL_CATEGORY",
        "val": 52,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ONLINE_CHAT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ONLINE_CHAT_DESC",
        "type": "URL_CATEGORY",
        "val": 53,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "EMAIL_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "EMAIL_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 54,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "BLOG",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "BLOG_DESC",
        "type": "URL_CATEGORY",
        "val": 55,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "P2P_COMMUNICATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "P2P_COMMUNICATION_DESC",
        "type": "URL_CATEGORY",
        "val": 97,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REMOTE_ACCESS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REMOTE_ACCESS_DESC",
        "type": "URL_CATEGORY",
        "val": 104,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_CONFERENCING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_CONFERENCING_DESC",
        "type": "URL_CATEGORY",
        "val": 111,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ZSPROXY_IPS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ZSPROXY_IPS_DESC",
        "type": "URL_CATEGORY",
        "val": 112,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SECURITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SECURITY_DESC",
        "type": "URL_CATEGORY",
        "val": 91,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADWARE_OR_SPYWARE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADWARE_OR_SPYWARE_DESC",
        "type": "URL_CATEGORY",
        "val": 92,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ENCR_WEB_CONTENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ENCR_WEB_CONTENT_DESC",
        "type": "URL_CATEGORY",
        "val": 113,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MALICIOUS_TLD",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MALICIOUS_TLD_DESC",
        "type": "URL_CATEGORY",
        "val": 116,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_MISCELLANEOUS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_MISCELLANEOUS_DESC",
        "type": "URL_CATEGORY",
        "val": 58,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MISCELLANEOUS_OR_UNKNOWN",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MISCELLANEOUS_OR_UNKNOWN_DESC",
        "type": "URL_CATEGORY",
        "val": 98,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NEWLY_REG_DOMAINS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NEWLY_REG_DOMAINS_DESC",
        "type": "URL_CATEGORY",
        "val": 106,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NON_CATEGORIZABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NON_CATEGORIZABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 110,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRAVEL",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRAVEL_DESC",
        "type": "URL_CATEGORY",
        "val": 86,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "VEHICLES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "VEHICLES_DESC",
        "type": "URL_CATEGORY",
        "val": 87,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_GOVERNMENT_AND_POLITICS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_GOVERNMENT_AND_POLITICS_DESC",
        "type": "URL_CATEGORY",
        "val": 29,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "GOVERNMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "GOVERNMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 30,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "POLITICS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "POLITICS_DESC",
        "type": "URL_CATEGORY",
        "val": 31,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_ENTERTAINMENT_AND_RECREATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ENTERTAINMENT_AND_RECREATION_DESC",
        "type": "URL_CATEGORY",
        "val": 21,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ENTERTAINMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ENTERTAINMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 22,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TELEVISION_AND_MOVIES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TELEVISION_AND_MOVIES_DESC",
        "type": "URL_CATEGORY",
        "val": 23,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "STREAMING_MEDIA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "STREAMING_MEDIA_DESC",
        "type": "URL_CATEGORY",
        "val": 25,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "RADIO_STATIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "RADIO_STATIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 26,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MUSIC",
        "urls": [
            "mozart.com",
            "aaa.com",
            "bbb.com"
        ],
        "dbCategorizedUrls": [
            "brahms.com"
        ],
        "customCategory": false,
        "editable": true,
        "description": "MUSIC_DESC",
        "type": "URL_CATEGORY",
        "val": 24,
        "customUrlsCount": 3,
        "urlsRetainingParentCategoryCount": 1
    },
    {
        "id": "NEWS_AND_MEDIA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NEWS_AND_MEDIA_DESC",
        "type": "URL_CATEGORY",
        "val": 59,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "USER_DEFINED",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "USER_DEFINED_DESC",
        "type": "URL_CATEGORY",
        "val": 90,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

[
    {
        "id": "OTHER_ADULT_MATERIAL",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ADULT_MATERIAL_DESC",
        "type": "URL_CATEGORY",
        "val": 1,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADULT_THEMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADULT_THEMES_DESC",
        "type": "URL_CATEGORY",
        "val": 2,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "LINGERIE_BIKINI",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "LINGERIE_BIKINI_DESC",
        "type": "URL_CATEGORY",
        "val": 3,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NUDITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NUDITY_DESC",
        "type": "URL_CATEGORY",
        "val": 4,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PORNOGRAPHY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PORNOGRAPHY_DESC",
        "type": "URL_CATEGORY",
        "val": 5,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SEXUALITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SEXUALITY_DESC",
        "type": "URL_CATEGORY",
        "val": 6,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADULT_SEX_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADULT_SEX_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 7,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "K_12_SEX_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "K_12_SEX_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 8,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_ADULT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_ADULT_DESC",
        "type": "URL_CATEGORY",
        "val": 100,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_DRUGS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_DRUGS_DESC",
        "type": "URL_CATEGORY",
        "val": 14,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MARIJUANA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MARIJUANA_DESC",
        "type": "URL_CATEGORY",
        "val": 118,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "GAMBLING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "GAMBLING_DESC",
        "type": "URL_CATEGORY",
        "val": 27,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "VIOLENCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "VIOLENCE_DESC",
        "type": "URL_CATEGORY",
        "val": 88,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEAPONS_AND_BOMBS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEAPONS_AND_BOMBS_DESC",
        "type": "URL_CATEGORY",
        "val": 89,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TASTELESS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TASTELESS_DESC",
        "type": "URL_CATEGORY",
        "val": 85,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MILITANCY_HATE_AND_EXTREMISM",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MILITANCY_HATE_AND_EXTREMISM_DESC",
        "type": "URL_CATEGORY",
        "val": 57,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_ILLEGAL_OR_QUESTIONABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ILLEGAL_OR_QUESTIONABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 33,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "COPYRIGHT_INFRINGEMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "COPYRIGHT_INFRINGEMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 34,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "COMPUTER_HACKING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "COMPUTER_HACKING_DESC",
        "type": "URL_CATEGORY",
        "val": 35,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "QUESTIONABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "QUESTIONABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 36,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PROFANITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PROFANITY_DESC",
        "type": "URL_CATEGORY",
        "val": 37,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MATURE_HUMOR",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MATURE_HUMOR_DESC",
        "type": "URL_CATEGORY",
        "val": 38,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ANONYMIZER",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ANONYMIZER_DESC",
        "type": "URL_CATEGORY",
        "val": 39,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SOCIETY_AND_LIFESTYLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SOCIETY_AND_LIFESTYLE_DESC",
        "type": "URL_CATEGORY",
        "val": 72,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ART_CULTURE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ART_CULTURE_DESC",
        "type": "URL_CATEGORY",
        "val": 73,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALTERNATE_LIFESTYLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALTERNATE_LIFESTYLE_DESC",
        "type": "URL_CATEGORY",
        "val": 74,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HOBBIES_AND_LEISURE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HOBBIES_AND_LEISURE_DESC",
        "type": "URL_CATEGORY",
        "val": 75,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DINING_AND_RESTAURANT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DINING_AND_RESTAURANT_DESC",
        "type": "URL_CATEGORY",
        "val": 76,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALCOHOL_TOBACCO",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALCOHOL_TOBACCO_DESC",
        "type": "URL_CATEGORY",
        "val": 77,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_NETWORKING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_NETWORKING_DESC",
        "type": "URL_CATEGORY",
        "val": 78,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HEALTH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HEALTH_DESC",
        "type": "URL_CATEGORY",
        "val": 32,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPORTS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPORTS_DESC",
        "type": "URL_CATEGORY",
        "val": 84,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPECIAL_INTERESTS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPECIAL_INTERESTS_DESC",
        "type": "URL_CATEGORY",
        "val": 83,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_GAMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_GAMES_DESC",
        "type": "URL_CATEGORY",
        "val": 28,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_NETWORKING_GAMES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_NETWORKING_GAMES_DESC",
        "type": "URL_CATEGORY",
        "val": 101,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SHOPPING_AND_AUCTIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SHOPPING_AND_AUCTIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 79,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SPECIALIZED_SHOPPING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SPECIALIZED_SHOPPING_DESC",
        "type": "URL_CATEGORY",
        "val": 80,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REAL_ESTATE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REAL_ESTATE_DESC",
        "type": "URL_CATEGORY",
        "val": 81,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ONLINE_AUCTIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ONLINE_AUCTIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 82,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SOCIAL_AND_FAMILY_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SOCIAL_AND_FAMILY_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 69,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SOCIAL_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SOCIAL_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 70,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FAMILY_ISSUES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FAMILY_ISSUES_DESC",
        "type": "URL_CATEGORY",
        "val": 71,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_RELIGION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_RELIGION_DESC",
        "type": "URL_CATEGORY",
        "val": 60,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRADITIONAL_RELIGION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRADITIONAL_RELIGION_DESC",
        "type": "URL_CATEGORY",
        "val": 61,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CULT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CULT_DESC",
        "type": "URL_CATEGORY",
        "val": 62,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ALT_NEW_AGE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ALT_NEW_AGE_DESC",
        "type": "URL_CATEGORY",
        "val": 63,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_EDUCATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_EDUCATION_DESC",
        "type": "URL_CATEGORY",
        "val": 15,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CONTINUING_EDUCATION_COLLEGES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CONTINUING_EDUCATION_COLLEGES_DESC",
        "type": "URL_CATEGORY",
        "val": 16,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "HISTORY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "HISTORY_DESC",
        "type": "URL_CATEGORY",
        "val": 17,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "K_12",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "K_12_DESC",
        "type": "URL_CATEGORY",
        "val": 18,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REFERENCE_SITES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REFERENCE_SITES_DESC",
        "type": "URL_CATEGORY",
        "val": 19,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SCIENCE_AND_TECHNOLOGY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SCIENCE_AND_TECHNOLOGY_DESC",
        "type": "URL_CATEGORY",
        "val": 20,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_BUSINESS_AND_ECONOMY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_BUSINESS_AND_ECONOMY_DESC",
        "type": "URL_CATEGORY",
        "val": 9,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CORPORATE_MARKETING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CORPORATE_MARKETING_DESC",
        "type": "URL_CATEGORY",
        "val": 10,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FINANCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FINANCE_DESC",
        "type": "URL_CATEGORY",
        "val": 11,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PROFESSIONAL_SERVICES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PROFESSIONAL_SERVICES_DESC",
        "type": "URL_CATEGORY",
        "val": 12,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CLASSIFIEDS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CLASSIFIEDS_DESC",
        "type": "URL_CATEGORY",
        "val": 13,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRADING_BROKARAGE_INSURANCE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRADING_BROKARAGE_INSURANCE_DESC",
        "type": "URL_CATEGORY",
        "val": 115,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "JOB_SEARCH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "JOB_SEARCH_DESC",
        "type": "URL_CATEGORY",
        "val": 56,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_INFORMATION_TECHNOLOGY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_INFORMATION_TECHNOLOGY_DESC",
        "type": "URL_CATEGORY",
        "val": 40,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRANSLATORS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRANSLATORS_DESC",
        "type": "URL_CATEGORY",
        "val": 41,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "IMAGE_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "IMAGE_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 42,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "FILE_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "FILE_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 43,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SHAREWARE_DOWNLOAD",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SHAREWARE_DOWNLOAD_DESC",
        "type": "URL_CATEGORY",
        "val": 44,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_BANNERS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_BANNERS_DESC",
        "type": "URL_CATEGORY",
        "val": 45,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 46,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_SEARCH",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_SEARCH_DESC",
        "type": "URL_CATEGORY",
        "val": 47,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "PORTALS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "PORTALS_DESC",
        "type": "URL_CATEGORY",
        "val": 48,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "SAFE_SEARCH_ENGINE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "SAFE_SEARCH_ENGINE_DESC",
        "type": "URL_CATEGORY",
        "val": 49,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "CDN",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "CDN_DESC",
        "type": "URL_CATEGORY",
        "val": 107,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OSS_UPDATES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OSS_UPDATES_DESC",
        "type": "URL_CATEGORY",
        "val": 114,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DNS_OVER_HTTPS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DNS_OVER_HTTPS_DESC",
        "type": "URL_CATEGORY",
        "val": 117,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_INTERNET_COMMUNICATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_INTERNET_COMMUNICATION_DESC",
        "type": "URL_CATEGORY",
        "val": 50,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "INTERNET_SERVICES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "INTERNET_SERVICES_DESC",
        "type": "URL_CATEGORY",
        "val": 51,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "DISCUSSION_FORUMS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "DISCUSSION_FORUMS_DESC",
        "type": "URL_CATEGORY",
        "val": 52,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ONLINE_CHAT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ONLINE_CHAT_DESC",
        "type": "URL_CATEGORY",
        "val": 53,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "EMAIL_HOST",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "EMAIL_HOST_DESC",
        "type": "URL_CATEGORY",
        "val": 54,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "BLOG",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "BLOG_DESC",
        "type": "URL_CATEGORY",
        "val": 55,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "P2P_COMMUNICATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "P2P_COMMUNICATION_DESC",
        "type": "URL_CATEGORY",
        "val": 97,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "REMOTE_ACCESS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "REMOTE_ACCESS_DESC",
        "type": "URL_CATEGORY",
        "val": 104,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "WEB_CONFERENCING",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "WEB_CONFERENCING_DESC",
        "type": "URL_CATEGORY",
        "val": 111,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ZSPROXY_IPS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ZSPROXY_IPS_DESC",
        "type": "URL_CATEGORY",
        "val": 112,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_SECURITY",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_SECURITY_DESC",
        "type": "URL_CATEGORY",
        "val": 91,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ADWARE_OR_SPYWARE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ADWARE_OR_SPYWARE_DESC",
        "type": "URL_CATEGORY",
        "val": 92,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ENCR_WEB_CONTENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ENCR_WEB_CONTENT_DESC",
        "type": "URL_CATEGORY",
        "val": 113,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MALICIOUS_TLD",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MALICIOUS_TLD_DESC",
        "type": "URL_CATEGORY",
        "val": 116,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_MISCELLANEOUS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_MISCELLANEOUS_DESC",
        "type": "URL_CATEGORY",
        "val": 58,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MISCELLANEOUS_OR_UNKNOWN",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "MISCELLANEOUS_OR_UNKNOWN_DESC",
        "type": "URL_CATEGORY",
        "val": 98,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NEWLY_REG_DOMAINS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NEWLY_REG_DOMAINS_DESC",
        "type": "URL_CATEGORY",
        "val": 106,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "NON_CATEGORIZABLE",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NON_CATEGORIZABLE_DESC",
        "type": "URL_CATEGORY",
        "val": 110,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TRAVEL",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TRAVEL_DESC",
        "type": "URL_CATEGORY",
        "val": 86,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "VEHICLES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "VEHICLES_DESC",
        "type": "URL_CATEGORY",
        "val": 87,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_GOVERNMENT_AND_POLITICS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_GOVERNMENT_AND_POLITICS_DESC",
        "type": "URL_CATEGORY",
        "val": 29,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "GOVERNMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "GOVERNMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 30,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "POLITICS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "POLITICS_DESC",
        "type": "URL_CATEGORY",
        "val": 31,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "OTHER_ENTERTAINMENT_AND_RECREATION",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "OTHER_ENTERTAINMENT_AND_RECREATION_DESC",
        "type": "URL_CATEGORY",
        "val": 21,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "ENTERTAINMENT",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "ENTERTAINMENT_DESC",
        "type": "URL_CATEGORY",
        "val": 22,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "TELEVISION_AND_MOVIES",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "TELEVISION_AND_MOVIES_DESC",
        "type": "URL_CATEGORY",
        "val": 23,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "STREAMING_MEDIA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "STREAMING_MEDIA_DESC",
        "type": "URL_CATEGORY",
        "val": 25,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "RADIO_STATIONS",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "RADIO_STATIONS_DESC",
        "type": "URL_CATEGORY",
        "val": 26,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "MUSIC",
        "urls": [
            "mozart.com",
            "aaa.com",
            "bbb.com"
        ],
        "dbCategorizedUrls": [
            "brahms.com"
        ],
        "customCategory": false,
        "editable": true,
        "description": "MUSIC_DESC",
        "type": "URL_CATEGORY",
        "val": 24,
        "customUrlsCount": 3,
        "urlsRetainingParentCategoryCount": 1
    },
    {
        "id": "NEWS_AND_MEDIA",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "NEWS_AND_MEDIA_DESC",
        "type": "URL_CATEGORY",
        "val": 59,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    },
    {
        "id": "USER_DEFINED",
        "urls": [],
        "dbCategorizedUrls": [],
        "customCategory": false,
        "editable": true,
        "description": "USER_DEFINED_DESC",
        "type": "URL_CATEGORY",
        "val": 90,
        "customUrlsCount": 0,
        "urlsRetainingParentCategoryCount": 0
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "categoryCount": 103,
    "categoryIDList": [
        "OTHER_ADULT_MATERIAL",
        "ADULT_THEMES",
        "LINGERIE_BIKINI",
        "NUDITY",
        "PORNOGRAPHY",
        "SEXUALITY",
        "ADULT_SEX_EDUCATION",
        "K_12_SEX_EDUCATION",
        "SOCIAL_ADULT",
        "OTHER_DRUGS",
        "MARIJUANA",
        "GAMBLING",
        "VIOLENCE",
        "WEAPONS_AND_BOMBS",
        "TASTELESS",
        "MILITANCY_HATE_AND_EXTREMISM",
        "OTHER_ILLEGAL_OR_QUESTIONABLE",
        "COPYRIGHT_INFRINGEMENT",
        "COMPUTER_HACKING",
        "QUESTIONABLE",
        "PROFANITY",
        "MATURE_HUMOR",
        "ANONYMIZER",
        "OTHER_SOCIETY_AND_LIFESTYLE",
        "ART_CULTURE",
        "ALTERNATE_LIFESTYLE",
        "HOBBIES_AND_LEISURE",
        "DINING_AND_RESTAURANT",
        "ALCOHOL_TOBACCO",
        "SOCIAL_NETWORKING",
        "HEALTH",
        "SPORTS",
        "SPECIAL_INTERESTS",
        "OTHER_GAMES",
        "SOCIAL_NETWORKING_GAMES",
        "OTHER_SHOPPING_AND_AUCTIONS",
        "SPECIALIZED_SHOPPING",
        "REAL_ESTATE",
        "ONLINE_AUCTIONS",
        "OTHER_SOCIAL_AND_FAMILY_ISSUES",
        "SOCIAL_ISSUES",
        "FAMILY_ISSUES",
        "OTHER_RELIGION",
        "TRADITIONAL_RELIGION",
        "CULT",
        "ALT_NEW_AGE",
        "OTHER_EDUCATION",
        "CONTINUING_EDUCATION_COLLEGES",
        "HISTORY",
        "K_12",
        "REFERENCE_SITES",
        "SCIENCE_AND_TECHNOLOGY",
        "OTHER_BUSINESS_AND_ECONOMY",
        "CORPORATE_MARKETING",
        "FINANCE",
        "PROFESSIONAL_SERVICES",
        "CLASSIFIEDS",
        "TRADING_BROKARAGE_INSURANCE",
        "JOB_SEARCH",
        "OTHER_INFORMATION_TECHNOLOGY",
        "TRANSLATORS",
        "IMAGE_HOST",
        "FILE_HOST",
        "SHAREWARE_DOWNLOAD",
        "WEB_BANNERS",
        "WEB_HOST",
        "WEB_SEARCH",
        "PORTALS",
        "SAFE_SEARCH_ENGINE",
        "CDN",
        "OSS_UPDATES",
        "DNS_OVER_HTTPS",
        "OTHER_INTERNET_COMMUNICATION",
        "INTERNET_SERVICES",
        "DISCUSSION_FORUMS",
        "ONLINE_CHAT",
        "EMAIL_HOST",
        "BLOG",
        "P2P_COMMUNICATION",
        "REMOTE_ACCESS",
        "WEB_CONFERENCING",
        "ZSPROXY_IPS",
        "OTHER_SECURITY",
        "ADWARE_OR_SPYWARE",
        "ENCR_WEB_CONTENT",
        "MALICIOUS_TLD",
        "OTHER_MISCELLANEOUS",
        "MISCELLANEOUS_OR_UNKNOWN",
        "NEWLY_REG_DOMAINS",
        "NON_CATEGORIZABLE",
        "TRAVEL",
        "VEHICLES",
        "OTHER_GOVERNMENT_AND_POLITICS",
        "GOVERNMENT",
        "POLITICS",
        "OTHER_ENTERTAINMENT_AND_RECREATION",
        "ENTERTAINMENT",
        "TELEVISION_AND_MOVIES",
        "STREAMING_MEDIA",
        "RADIO_STATIONS",
        "MUSIC",
        "NEWS_AND_MEDIA",
        "USER_DEFINED"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

id	urls	dbCategorizedUrls	customCategory	editable	description	type	val	customUrlsCount	urlsRetainingParentCategoryCount
OTHER_ADULT_MATERIAL	[]	[]	False	True	OTHER_ADULT_MATERIAL_DESC	URL_CATEGORY	1	0	0
ADULT_THEMES	[]	[]	False	True	ADULT_THEMES_DESC	URL_CATEGORY	2	0	0
LINGERIE_BIKINI	[]	[]	False	True	LINGERIE_BIKINI_DESC	URL_CATEGORY	3	0	0
NUDITY	[]	[]	False	True	NUDITY_DESC	URL_CATEGORY	4	0	0
PORNOGRAPHY	[]	[]	False	True	PORNOGRAPHY_DESC	URL_CATEGORY	5	0	0
SEXUALITY	[]	[]	False	True	SEXUALITY_DESC	URL_CATEGORY	6	0	0
ADULT_SEX_EDUCATION	[]	[]	False	True	ADULT_SEX_EDUCATION_DESC	URL_CATEGORY	7	0	0
K_12_SEX_EDUCATION	[]	[]	False	True	K_12_SEX_EDUCATION_DESC	URL_CATEGORY	8	0	0
SOCIAL_ADULT	[]	[]	False	True	SOCIAL_ADULT_DESC	URL_CATEGORY	100	0	0
OTHER_DRUGS	[]	[]	False	True	OTHER_DRUGS_DESC	URL_CATEGORY	14	0	0
MARIJUANA	[]	[]	False	True	MARIJUANA_DESC	URL_CATEGORY	118	0	0
GAMBLING	[]	[]	False	True	GAMBLING_DESC	URL_CATEGORY	27	0	0
VIOLENCE	[]	[]	False	True	VIOLENCE_DESC	URL_CATEGORY	88	0	0
WEAPONS_AND_BOMBS	[]	[]	False	True	WEAPONS_AND_BOMBS_DESC	URL_CATEGORY	89	0	0
TASTELESS	[]	[]	False	True	TASTELESS_DESC	URL_CATEGORY	85	0	0
MILITANCY_HATE_AND_EXTREMISM	[]	[]	False	True	MILITANCY_HATE_AND_EXTREMISM_DESC	URL_CATEGORY	57	0	0
OTHER_ILLEGAL_OR_QUESTIONABLE	[]	[]	False	True	OTHER_ILLEGAL_OR_QUESTIONABLE_DESC	URL_CATEGORY	33	0	0
COPYRIGHT_INFRINGEMENT	[]	[]	False	True	COPYRIGHT_INFRINGEMENT_DESC	URL_CATEGORY	34	0	0
COMPUTER_HACKING	[]	[]	False	True	COMPUTER_HACKING_DESC	URL_CATEGORY	35	0	0
QUESTIONABLE	[]	[]	False	True	QUESTIONABLE_DESC	URL_CATEGORY	36	0	0
PROFANITY	[]	[]	False	True	PROFANITY_DESC	URL_CATEGORY	37	0	0
MATURE_HUMOR	[]	[]	False	True	MATURE_HUMOR_DESC	URL_CATEGORY	38	0	0
ANONYMIZER	[]	[]	False	True	ANONYMIZER_DESC	URL_CATEGORY	39	0	0
OTHER_SOCIETY_AND_LIFESTYLE	[]	[]	False	True	OTHER_SOCIETY_AND_LIFESTYLE_DESC	URL_CATEGORY	72	0	0
ART_CULTURE	[]	[]	False	True	ART_CULTURE_DESC	URL_CATEGORY	73	0	0
ALTERNATE_LIFESTYLE	[]	[]	False	True	ALTERNATE_LIFESTYLE_DESC	URL_CATEGORY	74	0	0
HOBBIES_AND_LEISURE	[]	[]	False	True	HOBBIES_AND_LEISURE_DESC	URL_CATEGORY	75	0	0
DINING_AND_RESTAURANT	[]	[]	False	True	DINING_AND_RESTAURANT_DESC	URL_CATEGORY	76	0	0
ALCOHOL_TOBACCO	[]	[]	False	True	ALCOHOL_TOBACCO_DESC	URL_CATEGORY	77	0	0
SOCIAL_NETWORKING	[]	[]	False	True	SOCIAL_NETWORKING_DESC	URL_CATEGORY	78	0	0
HEALTH	[]	[]	False	True	HEALTH_DESC	URL_CATEGORY	32	0	0
SPORTS	[]	[]	False	True	SPORTS_DESC	URL_CATEGORY	84	0	0
SPECIAL_INTERESTS	[]	[]	False	True	SPECIAL_INTERESTS_DESC	URL_CATEGORY	83	0	0
OTHER_GAMES	[]	[]	False	True	OTHER_GAMES_DESC	URL_CATEGORY	28	0	0
SOCIAL_NETWORKING_GAMES	[]	[]	False	True	SOCIAL_NETWORKING_GAMES_DESC	URL_CATEGORY	101	0	0
OTHER_SHOPPING_AND_AUCTIONS	[]	[]	False	True	OTHER_SHOPPING_AND_AUCTIONS_DESC	URL_CATEGORY	79	0	0
SPECIALIZED_SHOPPING	[]	[]	False	True	SPECIALIZED_SHOPPING_DESC	URL_CATEGORY	80	0	0
REAL_ESTATE	[]	[]	False	True	REAL_ESTATE_DESC	URL_CATEGORY	81	0	0
ONLINE_AUCTIONS	[]	[]	False	True	ONLINE_AUCTIONS_DESC	URL_CATEGORY	82	0	0
OTHER_SOCIAL_AND_FAMILY_ISSUES	[]	[]	False	True	OTHER_SOCIAL_AND_FAMILY_ISSUES_DESC	URL_CATEGORY	69	0	0
SOCIAL_ISSUES	[]	[]	False	True	SOCIAL_ISSUES_DESC	URL_CATEGORY	70	0	0
FAMILY_ISSUES	[]	[]	False	True	FAMILY_ISSUES_DESC	URL_CATEGORY	71	0	0
OTHER_RELIGION	[]	[]	False	True	OTHER_RELIGION_DESC	URL_CATEGORY	60	0	0
TRADITIONAL_RELIGION	[]	[]	False	True	TRADITIONAL_RELIGION_DESC	URL_CATEGORY	61	0	0
CULT	[]	[]	False	True	CULT_DESC	URL_CATEGORY	62	0	0
ALT_NEW_AGE	[]	[]	False	True	ALT_NEW_AGE_DESC	URL_CATEGORY	63	0	0
OTHER_EDUCATION	[]	[]	False	True	OTHER_EDUCATION_DESC	URL_CATEGORY	15	0	0
CONTINUING_EDUCATION_COLLEGES	[]	[]	False	True	CONTINUING_EDUCATION_COLLEGES_DESC	URL_CATEGORY	16	0	0
HISTORY	[]	[]	False	True	HISTORY_DESC	URL_CATEGORY	17	0	0
K_12	[]	[]	False	True	K_12_DESC	URL_CATEGORY	18	0	0
REFERENCE_SITES	[]	[]	False	True	REFERENCE_SITES_DESC	URL_CATEGORY	19	0	0
SCIENCE_AND_TECHNOLOGY	[]	[]	False	True	SCIENCE_AND_TECHNOLOGY_DESC	URL_CATEGORY	20	0	0
OTHER_BUSINESS_AND_ECONOMY	[]	[]	False	True	OTHER_BUSINESS_AND_ECONOMY_DESC	URL_CATEGORY	9	0	0
CORPORATE_MARKETING	[]	[]	False	True	CORPORATE_MARKETING_DESC	URL_CATEGORY	10	0	0
FINANCE	[]	[]	False	True	FINANCE_DESC	URL_CATEGORY	11	0	0
PROFESSIONAL_SERVICES	[]	[]	False	True	PROFESSIONAL_SERVICES_DESC	URL_CATEGORY	12	0	0
CLASSIFIEDS	[]	[]	False	True	CLASSIFIEDS_DESC	URL_CATEGORY	13	0	0
TRADING_BROKARAGE_INSURANCE	[]	[]	False	True	TRADING_BROKARAGE_INSURANCE_DESC	URL_CATEGORY	115	0	0
JOB_SEARCH	[]	[]	False	True	JOB_SEARCH_DESC	URL_CATEGORY	56	0	0
OTHER_INFORMATION_TECHNOLOGY	[]	[]	False	True	OTHER_INFORMATION_TECHNOLOGY_DESC	URL_CATEGORY	40	0	0
TRANSLATORS	[]	[]	False	True	TRANSLATORS_DESC	URL_CATEGORY	41	0	0
IMAGE_HOST	[]	[]	False	True	IMAGE_HOST_DESC	URL_CATEGORY	42	0	0
FILE_HOST	[]	[]	False	True	FILE_HOST_DESC	URL_CATEGORY	43	0	0
SHAREWARE_DOWNLOAD	[]	[]	False	True	SHAREWARE_DOWNLOAD_DESC	URL_CATEGORY	44	0	0
WEB_BANNERS	[]	[]	False	True	WEB_BANNERS_DESC	URL_CATEGORY	45	0	0
WEB_HOST	[]	[]	False	True	WEB_HOST_DESC	URL_CATEGORY	46	0	0
WEB_SEARCH	[]	[]	False	True	WEB_SEARCH_DESC	URL_CATEGORY	47	0	0
PORTALS	[]	[]	False	True	PORTALS_DESC	URL_CATEGORY	48	0	0
SAFE_SEARCH_ENGINE	[]	[]	False	True	SAFE_SEARCH_ENGINE_DESC	URL_CATEGORY	49	0	0
CDN	[]	[]	False	True	CDN_DESC	URL_CATEGORY	107	0	0
OSS_UPDATES	[]	[]	False	True	OSS_UPDATES_DESC	URL_CATEGORY	114	0	0
DNS_OVER_HTTPS	[]	[]	False	True	DNS_OVER_HTTPS_DESC	URL_CATEGORY	117	0	0
OTHER_INTERNET_COMMUNICATION	[]	[]	False	True	OTHER_INTERNET_COMMUNICATION_DESC	URL_CATEGORY	50	0	0
INTERNET_SERVICES	[]	[]	False	True	INTERNET_SERVICES_DESC	URL_CATEGORY	51	0	0
DISCUSSION_FORUMS	[]	[]	False	True	DISCUSSION_FORUMS_DESC	URL_CATEGORY	52	0	0
ONLINE_CHAT	[]	[]	False	True	ONLINE_CHAT_DESC	URL_CATEGORY	53	0	0
EMAIL_HOST	[]	[]	False	True	EMAIL_HOST_DESC	URL_CATEGORY	54	0	0
BLOG	[]	[]	False	True	BLOG_DESC	URL_CATEGORY	55	0	0
P2P_COMMUNICATION	[]	[]	False	True	P2P_COMMUNICATION_DESC	URL_CATEGORY	97	0	0
REMOTE_ACCESS	[]	[]	False	True	REMOTE_ACCESS_DESC	URL_CATEGORY	104	0	0
WEB_CONFERENCING	[]	[]	False	True	WEB_CONFERENCING_DESC	URL_CATEGORY	111	0	0
ZSPROXY_IPS	[]	[]	False	True	ZSPROXY_IPS_DESC	URL_CATEGORY	112	0	0
OTHER_SECURITY	[]	[]	False	True	OTHER_SECURITY_DESC	URL_CATEGORY	91	0	0
ADWARE_OR_SPYWARE	[]	[]	False	True	ADWARE_OR_SPYWARE_DESC	URL_CATEGORY	92	0	0
ENCR_WEB_CONTENT	[]	[]	False	True	ENCR_WEB_CONTENT_DESC	URL_CATEGORY	113	0	0
MALICIOUS_TLD	[]	[]	False	True	MALICIOUS_TLD_DESC	URL_CATEGORY	116	0	0
OTHER_MISCELLANEOUS	[]	[]	False	True	OTHER_MISCELLANEOUS_DESC	URL_CATEGORY	58	0	0
MISCELLANEOUS_OR_UNKNOWN	[]	[]	False	True	MISCELLANEOUS_OR_UNKNOWN_DESC	URL_CATEGORY	98	0	0
NEWLY_REG_DOMAINS	[]	[]	False	True	NEWLY_REG_DOMAINS_DESC	URL_CATEGORY	106	0	0
NON_CATEGORIZABLE	[]	[]	False	True	NON_CATEGORIZABLE_DESC	URL_CATEGORY	110	0	0
TRAVEL	[]	[]	False	True	TRAVEL_DESC	URL_CATEGORY	86	0	0
VEHICLES	[]	[]	False	True	VEHICLES_DESC	URL_CATEGORY	87	0	0
OTHER_GOVERNMENT_AND_POLITICS	[]	[]	False	True	OTHER_GOVERNMENT_AND_POLITICS_DESC	URL_CATEGORY	29	0	0
GOVERNMENT	[]	[]	False	True	GOVERNMENT_DESC	URL_CATEGORY	30	0	0
POLITICS	[]	[]	False	True	POLITICS_DESC	URL_CATEGORY	31	0	0
OTHER_ENTERTAINMENT_AND_RECREATION	[]	[]	False	True	OTHER_ENTERTAINMENT_AND_RECREATION_DESC	URL_CATEGORY	21	0	0
ENTERTAINMENT	[]	[]	False	True	ENTERTAINMENT_DESC	URL_CATEGORY	22	0	0
TELEVISION_AND_MOVIES	[]	[]	False	True	TELEVISION_AND_MOVIES_DESC	URL_CATEGORY	23	0	0
STREAMING_MEDIA	[]	[]	False	True	STREAMING_MEDIA_DESC	URL_CATEGORY	25	0	0
RADIO_STATIONS	[]	[]	False	True	RADIO_STATIONS_DESC	URL_CATEGORY	26	0	0
MUSIC	[ "http://mozart.com ", "http://aaa.com ", "http://bbb.com " ]	[ "brahms.com" ]	False	True	MUSIC_DESC	URL_CATEGORY	24	3	1
NEWS_AND_MEDIA	[]	[]	False	True	NEWS_AND_MEDIA_DESC	URL_CATEGORY	59	0	0
USER_DEFINED	[]	[]	False	True	USER_DEFINED_DESC	URL_CATEGORY	90	0	0

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List All Categories failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

List All Categories failed.

Status Code: 400.

Message: AUTHENTICATION_FAILED.

Remove URL From Blacklist

Removes URLs from the blacklist. Note: After running the command, it will indicate that all URLs are removed successfully without errors; however, only the specified URLs will be removed.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to remove from the blacklist.	["Hello.com"]

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

D3 enriches the raw data from the original Zscaler API response by adding the "result" field to indicate whether the URLs have been successfully removed from blacklist.

SAMPLE DATA

JSON

{
    "result": "Remove URL from blacklist Successfully"
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 enriches the context data from the original Zscaler API response by adding the "result" field to indicate whether the URLs have been successfully removed from blacklist.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "result": "Remove URL from blacklist Successfully"
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URL From Blacklist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Remove URL From Blacklist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Remove URL From Whitelist

Removes URLs from the whitelist.

Input

Input Parameter	Required/Optional	Description	Example
URLs	Optional	The list of URLs to remove from the whitelist.	JSON `["remove.com"]`

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "paypal.com",
        "wellsfargo.com"
    ]
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "paypal.com",
        "wellsfargo.com"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "whitelistUrls": [
        "paypal.com",
        "wellsfargo.com"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

whitelistUrls

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Remove URL From Whitelist failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Remove URL From Whitelist failed.

Status Code: 403.

Message: AUTHENTICATION_FAILED.

Upload File to Sandbox

Uploads files to the Zscaler Sandbox.

File ID and File Source

It is not recommended to use the Test Command feature with the <command name> command as it is designed for dynamic input files in Playbooks, Incident Attachments, and Artifact Attachments. There is a simple workaround to test the command:

Navigate to Configuration on the top bar menu.

Click on Utility Commands on the left sidebar menu.

Use the search box to find and select the Create a File from input Text Array command.

Click on the Test tab.
Input the required information for the parameters.
Click on the Test Command button. A D3 File ID will appear in the output data after the file has been successfully created. The D3 File Source of the created file will be Playbook File.

Input

Input Parameter	Required/Optional	Description	Example
File IDs	Required	The file path of the file source. The options for file paths are: Incident Attachment: Incident.file.file ID Playbook File: Task output Artifact File: Incident.Events.file.file ID	JSON `[ "473" ]`
File Source	Required	The file source of the file to send. The options for file sources are: Incident Attachment File: Manually uploaded file from Incident Playbook File: Output from another Task Artifact File: Ingested Artifact in an Event	Playbook File
Force Submit	Required	Enabling this will submit the file(s) to Zscaler sandbox even if found malicious during AV scan and a verdict already exists.	True

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

JSON

[
    {
        "code": 200,
        "message": "/submit response OK",
        "fileType": "pdf",
        "md5": "**************",
        "sandboxSubmission": "Sandbox Benign"
    },
    {
        "code": 200,
        "message": "File not submitted to Sandbox",
        "md5": "**************",
        "sandboxSubmission": "File not Submitted to Sandbox"
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

JSON

[
    {
        "code": 200,
        "message": "/submit response OK",
        "fileType": "pdf",
        "md5": "**************",
        "sandboxSubmission": "Sandbox Benign"
    },
    {
        "code": 200,
        "message": "File not submitted to Sandbox",
        "md5": "**************",
        "sandboxSubmission": "File not Submitted to Sandbox"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

JSON

{
    "MD5s": [
        "*****",
        "*****"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

code	message	fileType	md5	sandboxSubmission
200	/submit response OK	pdf	*****	Sandbox Benign
200	File not submitted to Sandbox	pdf	*****	File not Submitted to Sandbox

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Upload File to sandbox failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: File Not Found.

Error Sample Data

Upload File to sandbox failed.

Status Code: 404.

Message: File Not Found.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Zscaler portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AUTHENTICATION_FAILED.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: AUTHENTICATION_FAILED.