Operationalizing Threat Intelligence with Zscaler Integrations MCP Server

The Threat Intelligence Problem

Every security professional faces the same challenge: threat intelligence overload. Your inbox fills with advisories from CISA, industry ISACs, vendor bulletins, and security blogs. Each contains critical Indicators of Compromise (IOCs) - malicious IPs, domains, file hashes - that should be blocked immediately. But translating these text-heavy PDFs, RSS feeds, field advisories and blog posts into actionable security policies takes hours.

Zscaler has always been a threat intelligence-driven company. Our Zero Trust Exchange is powered by real-time analysis of 500+ billion transactions daily, feeding into continuously updated threat intelligence that protects customers automatically. But what about the intelligence that's specific to your organization? The regional threats from your local CERT, the industry-specific campaigns targeting your vertical, or the emerging threats your security team discovers through threat hunting?

The Zscaler Integrations MCP Server represents a new paradigm: AI-assisted threat intelligence operationalization that augments Zscaler's existing protections with your organization's unique intelligence requirements. Using Zscaler Integrations MCP Server, you can transform multi-hour policy creation workflows into conversational, minutes-long exchanges.

What is the Zscaler Integrations MCP Server?

The Zscaler Integrations MCP Server is an open-source integration that connects AI assistants (like Claude or ChatGPT) to Zscaler's extensive API ecosystem. It provides access to a growing list of tools across Zscaler's portfolio:

• ZIA: Firewall rules, URL categories, IP groups, etc.
• ZPA: Application segments, access policies, etc.
• ZDX: Device and network health monitoring, etc.
• ZCC: Client Connector management
• ZIdentity: User and Group management

Instead of clicking through consoles or writing scripts, you simply converse with your preferred chatbot:

Deploying the Zscaler Integrations MCP Server

Setting up the Zscaler Integrations MCP Server takes about 10 minutes. You can deploy it in your choice of container framework (i.e. Docker, AWS Bedrock AgentCore, etc.). For detailed setup instructions, check out the following guides:

• Setup Guide: https://zscaler-mcp-server.readthedocs.io/en/latest/getting-started.html
• GitHub README: https://github.com/zscaler/zscaler-mcp-server

Once configured, the server integrates directly with your preferred chatbot, giving you conversational access to your Zscaler environment. In this blog, we’ll demonstrate the integration using Claude Desktop.

How the LLM Works with Threat Intelligence

When you provide a research-focused prompt, the LLM follows a workflow that mirrors how a human analyst would approach threat research (but at machine speed).

Research & Contextualization

The LLM begins by searching authoritative threat intelligence sources based on your prompt criteria (i.e. government sources like CISA advisories and HHS HC3 alerts, vendor research from security blogs and sector-specific intelligence feeds when relevant). Once it locates relevant threat intelligence, it builds context around the campaign: identifying threat actor attribution (ransomware groups like RansomHub or LockBit, APT groups, financially-motivated actors), understanding attack patterns and TTPs, and analyzing the timeline of events. For instance, the LLM might discover that a threat actor conducted a major disruption operation in May 2025, only to resurface with new infrastructure in July. It may also examine victim demographics (i.e. which sectors are being targeted, geographic focus, and whether attacks target specific organization types).

IOC Extraction & Attribution

Once threat intelligence has been collected, the LLM extracts network indicators from the narrative that can be used inside Zscaler policy, such as:

• Infrastructure: C2 server IPs, domains, URLs, etc.
• Distribution: Malware hosting sites, phishing domains, exploit kit URLs, etc.
• Impersonation: Spoofed portals mimicking legitimate services (MyChart, Epic EMR, insurance sites)

With effective prompting, each IOC can be linked back to its originating source (a blog post, advisory, or campaign analysis). This attribution enables you to validate the LLM's research and understand the reality/legitimacy of each indicator.

Policy Proposal

Once complete, the LLM presents ZIA policy recommendations ready for review and activation. These typically include IP Destination Groups for C2 infrastructure, URL Categories for phishing domains and malicious infrastructure and Firewall Rules with appropriate actions and logging configurations. These policy proposals are then translated to API calls and implemented using the MCP Server.

Example: Emerging Threat Campaigns

The Scenario

Security vendors and government agencies regularly publish threat intelligence on active malware campaigns. For example, Lumma Stealer (LummaC2), a prolific infostealer-as-a-service, recently rebounded after a major May 2025 takedown, with new C2 infrastructure appearing within days. Let's analyze this emerging threat intelligence and create a policy to defend against it.

The Prompt

Copy this prompt to try it yourself:

Today's date is December 11, 2025, 2:30 PM EST.

Research the Lumma Stealer (LummaC2) malware campaign. Search for:

• Security slog posts

• CISA advisories

• Recent security vendor analyses

Extract all network IOCs mentioned (C2 IP addresses, domains, infrastructure) and create ZIA policy recommendations to augment Zscaler's existing protections:

• IP destination groups for C2 infrastructure

• Custom URL categories for malicious domains

• Firewall rules to block access

For each policy, include in the description:

• Source: [Blog post or advisory]

• Created: [Today's date]

• Review: [Today's date + 90 days]

• Threat: Lumma Stealer (LummaC2) infostealer

Create the necessary ZIA policy to block these threats, but DO NOT activate anything yet. Use concise bullets in your summary. Under 500 words.

Managing the IOC Lifecycle

Likewise, three months later, you may choose to revisit this policy and clean up old IOCs:

Copy this follow-up prompt to try it yourself:

Today's date is March 11, 2026.

Please review all ZIA IP destination groups, URL categories and policies that have a Review Date of March 11, 2026 (or earlier) in their descriptions.

For each one:

1. Research the state of the malware campaign listed in the description.

2. If NO, campaign has been contained: Recommend removing the rule (stale IOC).

3. If YES, campaign is still a threat: Recommend extending review date by 90 days.

Show me what you'd remove vs. keep, and explain your reasoning.

The result? Automated IOC lifecycle management prevents "threat intel bloat" while ensuring active threats remain blocked. The 90-day review cycle aligns with research showing most C2 servers have

Example: Sector-Specific Threat Intelligence (Healthcare)

The Scenario

Healthcare organizations face unique threats. Ransomware groups specifically target medical facilities, knowing downtime can be life-threatening. In our next example, let’s augment our policy with healthcare-specific intelligence. Note the addition of priority to the prompt such that we can implement or withdraw policy suggestions easily when the time comes.

The Prompt

Copy this prompt to try it yourself:

Today's date is December 11, 2025, 3:15 PM EST.

You work in healthcare cybersecurity. Research recent cyber threats specifically targeting healthcare organizations:

1. Search HHS HC3 website for recent healthcare alerts

2. Search for "ransomware healthcare 2025" campaigns

3. Look for security vendor research about healthcare-targeted attacks

4. Find any campaigns impacting healthcare (credential theft is often initial access for ransomware)

Extract network IOCs (C2 IPs, phishing domains, malware distribution sites) from these articles and create ZIA policies to augment Zscaler's protections with healthcare-specific threat intelligence:

• IP destination groups for healthcare-targeted C2 infrastructure

• Custom URL categories for spoofed medical portals

• Firewall rules to block these threats

For each policy, include:

• Source: [Blog post or advisory]

• Created: [Today's date]

• Review: [Today's date + 90 days]

• Sector: Healthcare

• Threat: [Campaign name]

• Priority: [Critical/High/Medium]

Consider that:

• We already have Zscaler's threat intel active

• Users need access to legitimate medical sites (.nih.gov, .mayoclinic.org, EHR vendors)

• The policy should not break critical healthcare SaaS apps

• The policy should implement full logging for HIPAA compliance

Create the necessary ZIA policy to block these threats, but DO NOT activate anything yet. Use concise bullets in your summary. Under 500 words.

Managing the IOC Lifecycle

And, here again (three months later), you can easily review and clean up old IOCs:

Copy this follow-up prompt to try it yourself:

Today's date is March 11, 2026.

Please review all ZIA IP destination groups, URL categories and policies that have a Review Date of March 11, 2026 (or earlier) in their descriptions AND a Sector of Healthcare.

For each healthcare-specific policy:

1. Research the state of the malware campaign listed in the description.

2. If NO, campaign has been contained: Recommend removing the rule (stale IOC).

3. If YES, campaign is still a threat: Recommend extending review date by 90 days.

Show me what you'd remove vs. keep, and explain your reasoning.

Considerations

Risk Prioritization

Not all threats are equally urgent. You can prompt the LLM to categorize threats based on relevance and immediacy. Critical-priority threats are active campaigns with confirmed victims in your sector and may demand immediate action. High-priority threats come from threat groups with documented targeting history for your industry, even if no active campaign is underway. Medium-priority threats are opportunistic malware that may have some mention of your sector but lack evidence of targeted campaigns.

Copy this prompt to try it yourself:

For each policy recommendation, assign a priority level:

• Critical: Active campaigns targeting [your sector]

• High: Threat groups with [your sector] targeting history

• Medium: Opportunistic malware with sector mentions

Show priority in the policy description.

Customizable Execution

Keep in mind that suggested policies don’t have to be executed en masse. In fact, you may decide to execute only on the high-priority or critical suggestions while leaving the medium and low priority policies for further deliberation:

Operational Validation

Before implementing any policy changes, prompt the LLM to validate that proposed blocks won't disrupt legitimate operations. This includes ensuring that legitimate sites (such as vendor portals, SaaS applications, EHR systems) aren't caught in the block lists. For regulated industries, the LLM can also confirm that logging configurations meet compliance requirements like HIPAA, PCI-DSS, or SOX.

Copy this prompt to try it yourself:

Before creating these policies, validate:

1. No legitimate [vendor/SaaS/EHR] sites are blocked

2. Logging meets [HIPAA/PCI-DSS/SOX] requirements

3. No conflicts with existing ZIA policies

Show validation results before proceeding.

Monitor Before Blocking

Always test new policies in log-only mode (24-48 hours) before full blocking.

Copy this prompt to try it yourself:

Create this policy but set action to ALLOW with full logging enabled. We'll monitor for false positives before converting to BLOCK.

Lifecycle Management

Make use of date-stamped descriptions to automate IOC aging. This makes clean-up a breeze - even for non AI-assisted policy that was created!

Copy this prompt to try it yourself:

Show me all policies with review dates older than [current date]. For each, research recent activity and recommend keep vs. remove.

Conclusion

Zscaler's Security Cloud provides unmatched threat intelligence that automatically protects customers worldwide. The Zscaler Integrations MCP Server augments that foundation with intelligence unique to your organization:

• Sector-specific threats from your industry
• Regional threats from your local CERT
• Emerging threats not yet in mainstream feeds
• Organization-specific IOCs from threat hunting
• Intelligent lifecycle management with automated aging

The analyst remains in control - making critical decisions about what to block and when. The AI handles the mechanical translation from intelligence to policy, the correlation across sources, and the lifecycle management.

The result? More comprehensive coverage, faster response times, and more time for the proactive security work that truly matters.