zscaler/zscaler-mcp-server/assess-network-security

zins_get_firewall_by_action(
    start_days_ago=9,
    end_days_ago=2,
    limit=10
)

zins_get_firewall_by_location(
    start_days_ago=9,
    end_days_ago=2,
    limit=20
)

zins_get_firewall_network_services(
    start_days_ago=9,
    end_days_ago=2,
    limit=30
)

zins_get_cyber_incidents(
    start_days_ago=16,
    end_days_ago=2,
    categorize_by=["THREAT_CATEGORY_ID"],
    limit=20
)

zins_get_cyber_incidents_by_location(
    start_days_ago=16,
    end_days_ago=2,
    categorize_by="LOCATION_ID",
    limit=20
)

Network Security Posture Assessment
=======================================
Date: <current_date>
Period: <start_date> to <end_date>
Assessment Type: <compliance / routine / incident-driven>
 
## Executive Summary
 
- **Total Firewall Transactions:** X,XXX,XXX
- **Allowed:** X,XXX,XXX (XX%)
- **Blocked:** XX,XXX (X.X%)
- **Block Ratio Assessment:** Within normal range / Needs review
- **Locations Analyzed:** XX
- **Network Services Detected:** XX
- **Security Incidents:** XXX
- **Overall Posture:** STRONG / ADEQUATE / NEEDS IMPROVEMENT
 
---
 
## Firewall Action Summary
 
| Action   | Count       | Percentage | Assessment           |
|----------|------------|-----------|---------------------|
| ALLOW    | 2,340,000  | 96.2%     | Normal               |
| BLOCK    | 92,500     | 3.8%      | Active enforcement   |
 
Block ratio of 3.8% is within the typical 1-5% range for
well-tuned policies, indicating effective enforcement without
excessive false positives.
 
---
 
## Firewall Activity by Location (Top 10)
 
| Rank | Location          | Total Traffic | Blocked | Block % | Status    |
|------|------------------|--------------|---------|---------|-----------|
| 1    | New York HQ       | 890,000      | 34,000  | 3.8%    | Normal    |
| 2    | San Francisco     | 456,000      | 22,000  | 4.8%    | Normal    |
| 3    | London            | 234,000      | 18,000  | 7.7%    | ELEVATED  |
| 4    | Singapore         | 189,000      | 4,500   | 2.4%    | Normal    |
| ...  | ...               | ...          | ...     | ...     | ...       |
 
**London office** shows elevated block ratio (7.7% vs 3.8% average).
Investigate whether this reflects targeted threats or overly
restrictive policies for that location.
 
---
 
## Network Services (Top 15)
 
| Service         | Port  | Traffic Count | % of Total | Risk     |
|----------------|-------|--------------|-----------|----------|
| HTTPS           | 443   | 1,890,000    | 77.6%     | Low      |
| HTTP            | 80    | 290,000      | 11.9%     | Medium   |
| DNS             | 53    | 145,000      | 6.0%      | Low      |
| SMTP            | 25    | 23,000       | 0.9%      | Low      |
| SSH             | 22    | 12,000       | 0.5%      | Medium   |
| RDP             | 3389  | 8,500        | 0.3%      | HIGH     |
| FTP             | 21    | 2,300        | 0.1%      | HIGH     |
| Unknown         | 8443  | 1,800        | 0.1%      | REVIEW   |
 
**Findings:**
- RDP traffic (3389): 8,500 transactions -- verify these are
  authorized remote desktop sessions only
- FTP traffic (21): 2,300 transactions -- FTP is unencrypted;
  migrate to SFTP (22) or FTPS
- Unknown (8443): 1,800 transactions on non-standard port --
  investigate source applications
 
---
 
## Security Incident Correlation
 
| Category           | Incidents | Firewall Blocks | Effectiveness |
|-------------------|-----------|----------------|--------------|
| Malware            | 234       | 45,000         | 99.5% caught  |
| Phishing           | 189       | 28,000         | 99.3% caught  |
| Command & Control  | 45        | 12,000         | 99.6% caught  |
| Data Exfiltration  | 12        | 3,200          | 99.6% caught  |
 
Firewall effectiveness is strong across all threat categories.
 
---
 
## Recommendations
 
### Immediate
1. Investigate RDP traffic -- ensure all sessions are authorized
2. Block FTP (port 21) and migrate to SFTP
3. Investigate unknown traffic on port 8443
 
### Short-Term
4. Review London office elevated block ratio
5. Create firewall rules for newly detected network services
6. Audit SSH access permissions
 
### Ongoing
7. Schedule monthly firewall effectiveness reviews
8. Track block ratio trends for anomaly detection
9. Review network service inventory quarterly

Firewall block ratio is unusually low at X.X%.
 
This could indicate:
- Policies are too permissive
- Traffic inspection is not enabled for all protocols
- Users are bypassing the firewall (split tunnel VPN)
- The environment is genuinely clean
 
Recommendation: Review firewall rule coverage and ensure all
traffic types are being inspected.

Firewall block ratio is elevated at XX.X%.
 
This could indicate:
- An active security incident or attack
- Recently deployed restrictive policies
- Misconfigured policies causing false positives
- Legitimate applications being incorrectly blocked
 
Recommendation: Review recently changed firewall rules and
check if users are reporting access issues.