[ZSCALER-ZIA] Phishing threat blocked

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ZSCALER-ZIA] Phishing threat blocked"; program: Zscaler; json_content:".sourcetype","zscalernss-web"; json_content:".event.action","Blocked"; json_pcre:".event.threatname","/^HTML\.Phish/i"; json_map: "src_ip", ".event.ClientIP"; json_map: "dest_ip", ".event.serverip"; json_map: "username", ".event.user"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype: phish; sid:5017945; rev:1; metadata: mitre_tactic_id TA0001, mitre_technique_id T1566.002, created_at 2026_08_11, updated_at 2026_08_11;)