Lab 9 — SOC Investigation
Investigate the three incidents Kevin generated, perform triage, notify the user, test escalation, and configure automated workflows for future incidents.
1. Access ZWA and Review the Incident List
Administration → Data Loss Prevention → Workflow Automation
This opens the Zscaler Workflow Automation (ZWA) portal in a new tab. Click the Data Protection tab once it loads. Then click Incidents in the main menu.
You should see three incidents attributed to kevin@dataparity.com. Identify them:
| Incident # | Policy Triggered | Channel | File / Content | Status |
|---|---|---|---|---|
| Web Upload | Payroll_2025.xlsx | |||
| USB Device | Payroll_2025.xlsx | |||
| Browser / AI | PII text (SSN, Salary) |
2. Review Incident Details and Evidence
Click the Transaction ID for the web upload incident (Incident 1) to open the Incident Details view.
Review the Overview and Violation Details sections. Record what you observe:
| Attribute | Observed Value |
|---|---|
| Policy name triggered | |
| User identity | |
| Destination URL | |
| Detection engine | |
| Action taken |
Scroll down to the Violation Content card. Expand View Trigger Data to see the actual content from the file that triggered the violation.
Confirm this matches the Payroll_2025.xlsx file first identified in Lab 3 (DSPM) and reappearing in Lab 4.
3. Modify Incident Metadata — Triage All Three
On the Incident Details page, use the Actions menu to update Incident 1:
- Set Status to Investigating · Add note: "Reviewing for policy violation — appears accidental"
- Set Priority to High
- Refresh and verify fields reflect your changes
- Check the State Changes section for the audit trail
Repeat for the USB and browser incidents. Record your assessment:
| Incident | True or False Positive? | Severity | Initial Determination |
|---|---|---|---|
| Web Upload (Lab 6) | |||
| USB Device (Lab 7) | |||
| Browser / AI (Lab 8) |
4. Notify and Coach Kevin
From the Incident Details page for Incident 1, click Actions → Notify User.
- Select the notification language
- Enter a coaching message. Example:
- Click Submit
- Reload Incident Details → scroll to State Changes → confirm notification is logged
5. Escalate for Manager Approval
Step 1 — Add an Approver
Setup → Approvers → + Add More
Add your own name and email address as a test approver for this lab exercise.
Step 2 — Escalate the Incident
- From the Actions menu, select Escalate
- Select your ID from the Select Approver dropdown → Click Save
- Check your email for the DLP Incident Notification (check spam)
- Click the link in the email to open the approval page
Step 3 — Approve
- Select Approved in the Justification Type field
- Enter a reason → Click Submit
- Return to ZWA → reload the incident → verify escalation approval is in State Changes
6. Configure and Explore Automated Workflows
Step 1 — View Workflow Templates
Workflows → Workflow Templates
Review predefined templates and their available actions:
- Auto-notify user
- Auto-escalate to manager
- Auto-close low-risk incidents
- Auto-assign by department or policy type
Step 2 — Explore the Auto Escalate Template
Click View Workflow Template for the Auto Escalate template. Review the graphical workflow diagram. Observe: when an incident is created, the workflow automatically sends an email notification to the user's manager — the automated version of the manual escalation you just performed.
Step 3 — Review Workflow Mappings
Workflows → Workflow Mapping
Expand the first workflow mapping. Review triggering attributes, matching criteria, and which template is applied when conditions are met.
- Does the incident record contain enough information for Priya to determine intent — malicious or accidental?
- Which of the three incidents represents the highest risk to Dataparity? Why?
- The USB incident was generated off-network. How does that change Priya's assessment of intent?
- Priya sees three incidents from one user in one session. What does that pattern suggest?
- What attributes would distinguish a high-risk incident requiring human review from one that can be auto-closed?
- What governance controls should exist around workflow automation — who can create or modify templates?
ZWA transforms incident response from reactive to systematic. Every incident gets consistent handling, an auditable trail, and appropriate escalation — whether handled manually or automatically.
The three incidents Priya investigated today trace directly back to the data Alex discovered in Lab 1. Visibility (Module 1) → Protection (Module 2) → Investigation (Module 3) is a complete, connected loop — not three separate products.
Draw the explicit connection: the Payroll file appeared in DSPM (Lab 3), Copilot Readiness (Lab 4), as a blocked incident (Lab 6), and now as Priya's triage case. Ask: "What would have happened without any of these layers?"
The escalation email exercise is the most memorable part — attendees actually receive an email, which makes the workflow tangible and real.
Strong closing line: "Alex mapped the risk. Kevin tested the controls. Priya closed the loop. That's the complete data security lifecycle in one session."