zia-create-firewall-filtering-rule

ZIA: Create Cloud Firewall Filtering Rule

How to talk to the admin

• Don't narrate tool calls, search filters, or internal lookup logic. Just confirm what was created and which scoping was applied.
• Empty list responses are authoritative. If a zia_list_* lookup returns no match for an exact-name search, treat the resource as "does not exist." Do not retry with split keywords or unfiltered listings.
• Don't claim a tool doesn't exist without checking. If zia_create_* and zia_get_* are visible for a resource, the matching zia_list_* exists too.
• Don't narrate strategy pivots. If you have to retry quietly, retry quietly and report only the final outcome.
• After every successful create, mention the activation step explicitly — ZIA changes are staged until activated. The agent must call zia_activate_configuration() and tell the admin the change is now live.

Scope of this skill

This skill creates one Cloud Firewall Filtering rule per invocation. Anything outside that scope is a hard stop:

• It does not create the auxiliary objects the rule references (IP source/destination groups, network service groups, network app groups, location groups, label IDs, group/department/user IDs). If those don't exist, this skill stops and points the admin at the right place to create them — it does not improvise.
• It does not modify SSL Inspection, URL Filtering, DLP, or any other ZIA rule type. Those are separate resource types and have their own skills (zia-create-ssl-inspection-rule for SSL Inspection).
• It does not enforce DNS or IPS rules. Cloud Firewall DNS rules and IPS rules are separate APIs (cloud_firewall_dns_rules, cloud_firewall_ips_rules) — not what this skill creates.

Hard stop conditions

Stop and report plainly when:

• The admin's stated IP groups, network services, network app groups, location names, or user/group IDs cannot be resolved. Resolve once via the appropriate zia_list_* tool; if empty, say so and stop. Do not skip the field, do not invent IDs.
• A recurring schedule was requested but no schedule details were provided. Don't guess. Ask once for start_time, end_time, and days_of_week, then chain to zia-manage-time-interval.
• An action was requested that doesn't exist on this rule type. Valid actions are exactly: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP. Plain BLOCK is not a valid value — pick one of the three block variants based on the desired client-visible behaviour. SSL-inspection-style actions (DO_NOT_DECRYPT, DO_NOT_INSPECT, INSPECT, BYPASS) belong to other rule types and are a hard stop here.
• The admin is trying to modify the predefined Default Cloud IPS Rule by name. Predefined/default rules cannot be deleted, and changes to them require admin rank 7. Confirm intent before proceeding.
• The admin asked for a country-based rule but only gave a country name. ZIA expects ISO 3166 Alpha-2 codes (US, CA, BR, etc.). Resolve common phrasings to the canonical code; if ambiguous, ask once.
• rank is outside the inclusive range 0..7. ZIA's Cloud Firewall rank is a 0-7 integer; the tool will reject any other value before the API call. See admin rank documentation.