[ZSCALER-ZIA] DLP policy violation detected on outbound transfer

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ZSCALER-ZIA] DLP policy violation detected on outbound transfer"; program: Zscaler; json_content:".sourcetype","zscalernss-web"; json_content:!".event.dlpengine","None"; json_map: "src_ip", ".event.ClientIP"; json_map: "dest_ip", ".event.serverip"; json_map: "username", ".event.user"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype: exfiltration; sid:5017939; rev:1; metadata: mitre_tactic_id TA0010, mitre_technique_id T1567, created_at 2026_08_11, updated_at 2026_08_11;)