zscaler.ziacloud.zia_atp_settings_info module – Retrieves the advanced threat configuration settings

Note

This module is part of the zscaler.ziacloud collection (version 2.0.3).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install zscaler.ziacloud. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: zscaler.ziacloud.zia_atp_settings_info.

New in zscaler.ziacloud 2.0.0

Synopsis

• Retrieves the advanced threat configuration settings

Requirements

The below requirements are needed on the host that executes this module.

• Zscaler SDK Python can be obtained from PyPI https://pypi.org/project/zscaler-sdk-python/

Parameters

Parameter	Comments
api_key string	A string that contains the obfuscated API key.
client_id string	The client ID for OAuth2 authentication.
client_secret string	The client secret for OAuth2 authentication.
cloud string	The Zscaler cloud name provisioned for your organization. Choices: "zscloud" "zscaler" "zscalerone" "zscalertwo" "zscalerthree" "zscalerbeta" "zscalergov" "zscalerten" "beta" "production"
password string	A string that contains the password for the API admin.
private_key string	The private key for JWT-based OAuth2 authentication.
provider dictionary	A dict containing authentication credentials.
api_key string	Obfuscated API key.
client_id string	OAuth2 client ID.
client_secret string	OAuth2 client secret.
cloud string	Zscaler cloud name. Choices: "zscloud" "zscaler" "zscalerone" "zscalertwo" "zscalerthree" "zscalerbeta" "zscalergov" "zscalerten" "beta" "production"
password string	Password for the API admin.
private_key string	Private key for OAuth2 JWT.
sandbox_cloud string	Sandbox Cloud environment.
sandbox_token string	Sandbox API Key.
use_legacy_client boolean	Whether to use the legacy Zscaler API client. Choices: false ← (default) true
username string	Email ID of the API admin.
vanity_domain string	Vanity domain for OAuth2.
sandbox_cloud string	The Sandbox cloud environment for API access.
sandbox_token string	A string that contains the Sandbox API Key.
use_legacy_client boolean	Whether to use the legacy Zscaler API client. Choices: false ← (default) true
username string	A string that contains the email ID of the API admin.
vanity_domain string	The vanity domain provisioned by Zscaler for OAuth2 flows.

Notes

Note

• Check mode is not supported.

Examples

- name: Retrieves the advanced threat configuration settings
  zscaler.ziacloud.zia_atp_settings_info:
    provider: '{{ provider }}'

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
atp dictionary	A dictionary of Advanced Threat Protection settings. Returned: always
active_x_blocked boolean	Indicates whether sites are allowed or blocked from accessing vulnerable ActiveX controls that are known to have been exploited. Returned: always
active_x_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for ActiveX controls Returned: always
ad_spyware_sites_blocked boolean	Indicates whether to allow or block websites known to contain adware or spyware that displays malicious advertisements that can collect users’ information without their knowledge Returned: always
ad_spyware_sites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for adware and spyware sites Returned: always
alert_for_unknown_or_suspicious_c2_traffic boolean	Indicates whether to send alerts upon detecting unknown or suspicious C2 traffic Returned: always
anonymizer_blocked boolean	Indicates whether to allow or block applications and methods used to obscure the destination and the content accessed by the user, therefore blocking traffic to anonymizing web proxies. Returned: always
anonymizer_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for anonymizers Returned: always
bit_torrent_blocked boolean	Indicates whether to allow or block the usage of BitTorrent, a popular P2P file sharing application that supports content download with encryption. Returned: always
bit_torrent_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for BitTorrent Returned: always
block_countries_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for blocked countries Returned: always
blocked_countries list / elements=string	Whether to allow or block requests to websites located in specific countries. Provide a ISO3166 Alpha2 code. Returned: always
browser_exploits_blocked boolean	Indicates whether known web browser vulnerabilities prone to exploitation are allowed or blocked. Returned: always
browser_exploits_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for browser exploits Returned: always
cmd_ctl_server_blocked boolean	Indicates whether connections to known Command & Control (C2) Servers are allowed or blocked Returned: always
cmd_ctl_server_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for connections to known C2 servers Returned: always
cmd_ctl_traffic_blocked boolean	Indicates whether botnets are allowed or blocked from sending or receiving commands to unknown servers Returned: always
cmd_ctl_traffic_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for botnets Returned: always
cookie_stealing_blocked boolean	Indicates whether to allow or block third-party websites that gather cookie information, which can be used to personally identify users, track internet activity, or steal a user’s session or sensitive information. Returned: always
cookie_stealing_pcap_enabled boolean	Indicates whether packet capture (PCAP) is enabled or not for cookie stealing Returned: always
crypto_mining_blocked boolean	Indicates whether to allow or block cryptocurrency mining network traffic and scripts which can negatively impact endpoint device performance and potentially lead to a misuse of company resources. Returned: always
crypto_mining_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for cryptomining Returned: always
dga_domains_blocked boolean	Indicates whether to allow or block domains that are suspected to be generated using domain generation algorithms (DGA) Returned: always
dga_domains_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for DGA domains Returned: always
file_format_vunerabilites_blocked boolean	Indicates whether known file format vulnerabilities and suspicious or malicious content in Microsoft Office or PDF documents are allowed or blocked Returned: always
file_format_vunerabilites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for file format vulnerabilities Returned: always
google_talk_blocked boolean	Indicates whether to allow or block access to Google Hangouts, a popular P2P VoIP application. Returned: always
google_talk_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for Google Returned: always
irc_tunnelling_blocked boolean	Indicates whether to allow or block IRC traffic being tunneled over HTTP and HTTPS Returned: always
irc_tunnelling_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for IRC tunnels Returned: always
known_phishing_sites_blocked boolean	Indicates whether known phishing sites are allowed or blocked Returned: always
known_phishing_sites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for known phishing sites Returned: always
malicious_urls_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for malicious URLs Returned: always
malware_sites_blocked boolean	Indicates whether known malicious sites and content are allowed or blocked Returned: always
malware_sites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for malicious sites Returned: always
potential_malicious_requests_blocked boolean	Indicates whether to allow or block this type of cross-site scripting (XSS) Returned: always
potential_malicious_requests_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for (XSS) attacks Returned: always
risk_tolerance integer	The Page Risk tolerance index set between 0 and 100 (100 being the highest risk). Users are blocked from accessing web pages with higher Page Risk than the specified value. Returned: always
risk_tolerance_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for suspicious web pages Returned: always
ssh_tunnelling_blocked boolean	Indicates whether to allow or block SSH traffic being tunneled over HTTP and HTTPS Returned: always
ssh_tunnelling_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for SSH tunnels Returned: always
suspect_adware_spyware_sites_blocked boolean	Indicates whether to allow or block any detections of communication and callback traffic associated with spyware agents and data transmission Returned: always
suspect_adware_spyware_sites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for suspected adware and spyware sites Returned: always
suspected_phishing_sites_blocked boolean	Indicates whether to allow or block suspected phishing sites identified through heuristic detection. The Zscaler service can inspect the content of a website for indications that it might be a phishing site. Returned: always
suspected_phishing_sites_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for suspected phishing sites Returned: always
tor_blocked boolean	Indicates whether to allow or block the usage of Tor, a popular P2P anonymizer protocol with support for encryption. Returned: always
tor_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for Tor Returned: always
webspam_blocked boolean	Indicates whether to allow or block web pages that pretend to contain useful information, to get higher ranking in search engine results or drive traffic to phishing, adware, or spyware distribution sites. Returned: always
webspam_capture boolean	Indicates whether packet capture (PCAP) is enabled or not for web spam Returned: always

Authors

• William Guilherme (@willguibr)

Collection links

• Issue Tracker
• Repository (Sources)