[ZSCALER-ZIA] Scam destination blocked

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ZSCALER-ZIA] Scam destination blocked"; program: Zscaler; json_content:".sourcetype","zscalernss-web"; json_content:".event.action","Blocked"; json_pcre:".event.threatname","/scam/i"; json_map: "src_ip", ".event.ClientIP"; json_map: "dest_ip", ".event.serverip"; json_map: "username", ".event.user"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype: social-engineering; sid:5017946; rev:1; metadata: mitre_tactic_id TA0001, mitre_technique_id T1566, created_at 2026_08_11, updated_at 2026_08_11;)