Feature · Investigation & Diagnostics

Investigation & Diagnostics Answer "what happened?" in under 5 minutes.

When a user says "I can't access this site", the native consoles show data, not answers. Two purpose-built investigation engines, one for ZIA and one for ZPA, turn hours of manual cross-referencing into minutes of guided analysis. Shipping today and being refined with every release.

Start Free Trial ▶ Watch Demo

ZIA Troubleshooting Engine in ZHERO: interactive Sankey diagram tracing traffic from devices through forwarding profiles and policies to ZIA and direct

75% reduction in Mean Time To Resolution with multi-layer visibility.

Why it matters

Two engines, one mission

Feature

ZIA Troubleshooting Engine

Benefit

Visual traffic flow (interactive Sankey) with 11 policy layers evaluated simultaneously

Outcome

Trace an access issue end-to-end in one view instead of 10+ screens

Feature

HAR and ZIA Insights correlation

Benefit

Upload HAR files or query real traffic logs, correlated with your policies

Outcome

Theory meets reality: see which requests were blocked, by which policy, and why

Feature

ZPA Diagnostics Engine

Benefit

Multi-dimensional drilldown (users, domains, domain:port) with one-click Excel export

Outcome

Raw ZPA diagnostic data becomes actionable intelligence without leaving the console

Feature

Session management

Benefit

Save and restore complete investigation sessions, with search history

Outcome

No investigation context lost between sessions

Investigation & Diagnostics removes the investigation tax: when something goes wrong on ZIA or ZPA, the admin normally enters a maze of policy types, diagnostic logs and configuration layers. ZHERO replaces that maze with a guided workflow that goes from symptom to root cause in minutes.

ZPA Diagnostics Engine

Raw ZPA logs become answers

Multi-dimensional drilldown across users, domains and domain:port combinations, with one-click Excel export running in the background. Raw diagnostic data becomes actionable intelligence without leaving the console.

ZPA diagnostics engine in ZHERO: drilldown from a search to the users, domains and domain and port combinations behind it

How it works

Four investigation steps in one workflow

Step 1

Set criteria

Define the scenario: user or group, device, location, destination URL or application. Any combination of criteria.

Step 2

Visualize flow

An interactive Sankey diagram shows the traffic path across device groups, app profiles, ZCC settings and forwarding profiles. Hover for details, click to drill in.

Step 3

Analyze policies

11 policy layers in one view (URL Filtering, SSL, Firewall, DNS, IPS, DLP and more) with clear ALLOW and BLOCK indicators on each rule.

Step 4

Correlate data

Upload HAR files or query real ZIA Insights traffic logs: ZHERO correlates actual requests with your policies to validate the theory.

Without ZHERO vs With ZHERO

Without ZHERO

With ZHERO

Tracing an access issue

30+ minutes across 10+ screens

Complete traffic flow in a single Sankey diagram

Policy evaluation

One policy type at a time, manually

All 11 policy types evaluated simultaneously

Real traffic data

Manual HAR analysis in separate tools

HAR files and ZIA Insights correlated with policies instantly

ZPA diagnostics

Copy-pasting log data into spreadsheets

One-click drilldown and Excel export, running in the background

Investigation context

Lost between sessions

Save and restore sessions, with built-in search history

FAQ

Questions, answered

Does my traffic data leave the browser?

No. The analysis is 100% browser-based: HAR files never leave your machine, ZHERO uses your existing Zscaler API session, and no configuration or traffic data is transmitted to ZHERO servers.

What is the difference between the ZIA and ZPA engines?

Different platforms, different data sources, same goal. The ZIA Troubleshooting Engine focuses on visual traffic flow, multi-layer policy analysis and traffic correlation. The ZPA Diagnostics Engine turns raw diagnostic logs into drilldowns and exports, alongside the native ZPA Diagnostics page.

Is Investigation & Diagnostics fully released?

The ZIA Troubleshooting Engine is shipped. The ZPA Diagnostics Engine is shipped in beta and being refined with every release.

Can I export the results?

Yes. Any ZPA drilldown result and raw log view exports to a professionally formatted Excel file in one click.

Investigation & Diagnostics in action

Watch a 4-minute demo.

Ready to see Investigation & Diagnostics in your tenant?

Start Your Transformation!

Install in two minutes. No servers, no migration, no training.

Start Free Trial Schedule a Demo