[ZSCALER-ZIA] Malware download blocked by Advanced Threat Protection

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ZSCALER-ZIA] Malware download blocked by Advanced Threat Protection"; program: Zscaler; json_content:".sourcetype","zscalernss-web"; json_content:".event.action","Blocked"; json_content:!".event.threatname","None"; json_map: "src_ip", ".event.ClientIP"; json_map: "dest_ip", ".event.serverip"; json_map: "username", ".event.user"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype: malware; sid:5017938; rev:1; metadata: mitre_tactic_id TA0011, mitre_technique_id T1105, created_at 2026_08_11, updated_at 2026_08_11;)