zia-audit-ssl-inspection-bypass

ZIA: Audit SSL Inspection Bypass

Keywords

ssl inspection, ssl bypass, do not inspect, do not decrypt, ssl exceptions, ssl audit, ssl security gap, bypass ssl, inspection exclusion, ssl policy review, certificate pinning, decryption mode

Overview

Audit ZIA SSL inspection rules to understand what traffic is being inspected, bypassed, or blocked at the SSL layer. This skill works exclusively with SSL inspection tools. It does NOT call URL filtering, DLP, or other unrelated tools unless the user explicitly asks for cross-referencing.

Use this skill when: A security administrator wants to review SSL inspection rules, understand what traffic is or is not being decrypted, or audit SSL inspection policy configuration.

Scope Boundaries

ONLY use these tools in this skill:

• zia_list_ssl_inspection_rules() -- primary tool
• zia_get_ssl_inspection_rule(rule_id) -- detail for a specific rule
• get_zia_user_groups(search) -- resolve group IDs referenced in SSL rules
• get_zia_user_departments(search) -- resolve department IDs referenced in SSL rules
• zia_list_locations() -- resolve location IDs referenced in SSL rules

DO NOT call these tools unless the user explicitly asks:

• zia_list_url_filtering_rules() -- not part of SSL inspection audit
• zia_list_web_dlp_rules() / zia_list_web_dlp_rules_lite() -- not part of SSL inspection audit
• zia_list_firewall_rules() -- not part of SSL inspection audit
• Any other non-SSL tool

---

Workflow

Follow this 4-step process.

Step 1: Retrieve All SSL Inspection Rules

zia_list_ssl_inspection_rules()
```text

Categorize each rule by its action:

- **INSPECT** (also called DECRYPT) -- traffic is fully decrypted and inspected
- **DO_NOT_INSPECT** -- traffic is not decrypted or inspected (full bypass)
- **DO_NOT_DECRYPT** -- traffic is not decrypted but metadata is still visible
- **BLOCK** -- traffic is blocked at the SSL layer

If the user asks about a specific action (e.g., "which rules are in decryption mode"), filter the results to show only rules matching that action.