---
title: Zscaler Deception
slug: connectors/zscaler-deception
docTags: 
createdAt: 2026-06-09T16:29:45.565Z
---

The Zscaler Deception connector enables automated interactions with the Zscaler Deception platform, facilitating the retrieval and management of security incidents and events.

Zscaler Deception is a cloud-based security service that specializes in the detection of advanced threats and targeted attacks. This connector enables Swimlane Turbine users to automate the retrieval and analysis of security events and incidents, as well as the management of incident-related comments directly within the Swimlane platform. By integrating with Zscaler Deception, users can enhance their security posture with real-time threat intelligence and streamline their incident response workflows, ensuring a proactive defense against deceptive attacks.

### Limitations and Known Issues

None to date.

### Supported Versions

This Zscaler Deception connector uses the Version 2API.

### Additional Docs

- [Zscaler Deception API Documentation](https://nfr1278.illusionblack.com/ui/api-docs/)

## Configuration

### Prerequisites

To effectively utilize the Zscaler Deception connector with Swimlane Turbine, ensure you have the following:

- API Key Authentication with the required parameters:
  - URL: The endpoint URL for the Zscaler Deception API.
  - API Token (x-client-auth): A unique token used to authenticate API requests.

## Authentication Methods

### API Key Authentication:

- URL: The endpoint URL for the Zscaler Deception API (default: [https://admin.zscalerbeta.net](https://admin.zscalerbeta.net)).
- Username: Your Zscaler Deception username with sufficient permissions.
- Password: The password associated with your Zscaler Deception account.
- API Token: The API token/key associated with your Zscaler Deception account.
- Verify SSL Certificates: Option to verify SSL certificate (default: true).
- HTTP(s) Proxy: Optional proxy to route requests through.

## Capabilities

This Zscaler Deception connector provides the following capabilities:

- Get Events
- Get Incidents
- Get Incident Comments

### Get Events

Returns a list of events from the Zscaler Deception platform. This action requires Read\:Events permission and supports filtering, sorting, and pagination through query parameters.

Zscaler Deception's documentation for this action can be found [here](https://nfr1278.illusionblack.com/ui/api-docs/#/Events/get_events_).

### Get Incidents

Returns a list of incidents from the Zscaler Deception platform. This action requires Read\:Incidents permission and allows filtering by incident ID, date range, and other criteria. You can use query parameters to limit your search by incident ID, status, or date range.

Zscaler Deception's documentation for this action can be found [here](https://nfr1278.illusionblack.com/ui/api-docs/#/Incidents/get_incidents).

### Get Incident Comments

Returns all comments for a specific incident from the Zscaler Deception platform. This action requires Read\:Incidents permission and allows you to retrieve the complete comment history for any incident by providing the incident ID.

Zscaler Deception's documentation for this action can be found [here](https://nfr1278.illusionblack.com/ui/api-docs/#/Incidents/get_incidents_id__incidentId__comments).

# Configurations

## Zscaler Deception API Key Authentication

Authenticates using an API Key

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| api\_key      | API Token for x-client-auth header | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Get Events

Retrieves a list of events from Zscaler Deception, with options to specify limit and offset. Requires Read\:Events permission.

### Endpoint

- **URL:** `api/v2/events/`
- **Method:** `GET`

### Input

| **Argument Name**             | **Type** | **Required** | **Description**                                                   |
| ----------------------------- | -------- | ------------ | ----------------------------------------------------------------- |
| `parameters.limit`            | integer  | Required     | The numbers of items to return in a single response               |
| `parameters.offset`           | integer  | Required     | The number of items to skip before starting to collect the result |
| `parameters.sort`             | array    | Optional     | Sort order for events (e.g., "timestamp asc", "id desc")          |
| `parameters.fields`           | array    | Optional     | Fields to include in the response                                 |
| `parameters.from`             | string   | Optional     | Start date/time filter                                            |
| `parameters.to`               | string   | Optional     | End date/time filter                                              |
| `parameters.expfilter`        | array    | Optional     | Expression filter                                                 |
| `parameters.whitelisted`      | string   | Optional     | Whitelist filter                                                  |
| `parameters.test_events_only` | string   | Optional     | Filter for test events only                                       |

### Input Example

`{"parameters":{"limit":100,"offset":123,"sort":["string"],"fields":["string"],"from":"string","to":"string","expfilter":["string"],"whitelisted":"string","test_events_only":"string"}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `data`               | array    | Response data                    |
| `data.file_name`     | string   | Response data                    |
| `data.file`          | string   | Response data                    |
| `meta`               | object   | Output field: meta               |
| `meta.paging`        | object   | Output field: meta.paging        |
| `meta.paging.total`  | number   | Output field: meta.paging.total  |
| `meta.paging.offset` | number   | Output field: meta.paging.offset |
| `meta.paging.limit`  | number   | Output field: meta.paging.limit  |
| `meta.paging.amount` | number   | Output field: meta.paging.amount |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":[],"meta":{"paging":{}}}}`

## Get List of all Comments

Retrieve all comments linked to a given incident in Zscaler Deception by providing the incidentId.

### Endpoint

- **URL:** `api/v2/incidents/id/{{incidentId}}/comments`
- **Method:** `GET`

### Input

| **Argument Name**            | **Type** | **Required** | **Description** |
| ---------------------------- | -------- | ------------ | --------------- |
| `path_parameters.incidentId` | integer  | Required     | Incident Id     |

### Input Example

`{"path_parameters":{"incidentId":123}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `data`               | array    | Response data                    |
| `data.file_name`     | string   | Response data                    |
| `data.file`          | string   | Response data                    |
| `meta`               | object   | Output field: meta               |
| `meta.paging`        | object   | Output field: meta.paging        |
| `meta.paging.total`  | number   | Output field: meta.paging.total  |
| `meta.paging.offset` | number   | Output field: meta.paging.offset |
| `meta.paging.limit`  | number   | Output field: meta.paging.limit  |
| `meta.paging.amount` | number   | Output field: meta.paging.amount |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"data":[],"meta":{"paging":{}}}}`

## Get Incidents

Retrieves a list of incidents from Zscaler Deception, with the ability to specify limit and offset. Read\:Incidents permission is required.

### Endpoint

- **URL:** `api/v2/incidents`
- **Method:** `GET`

### Input

| **Argument Name**        | **Type** | **Required** | **Description**                                                   |
| ------------------------ | -------- | ------------ | ----------------------------------------------------------------- |
| `parameters.incident_id` | string   | Optional     | Incident Id                                                       |
| `parameters.from`        | string   | Optional     | from date                                                         |
| `parameters.to`          | string   | Optional     | to date                                                           |
| `parameters.spoll`       | boolean  | Optional     | Spoll                                                             |
| `parameters.limit`       | integer  | Required     | The numbers of items to return in a single response               |
| `parameters.offset`      | integer  | Required     | The number of items to skip before starting to collect the result |

### Input Example

`{"parameters":{"incident_id":"string","from":"string","to":"string","spoll":true,"limit":100,"offset":123}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `id`          | string   | Unique identifier                |
| `title`       | string   | Output field: title              |
| `type`        | string   | Type of the resource             |
| `filter`      | string   | Output field: filter             |
| `window`      | string   | Output field: window             |
| `description` | string   | Output field: description        |
| `mitigation`  | string   | Output field: mitigation         |
| `icon`        | string   | Output field: icon               |
| `columns`     | array    | Output field: columns            |

### Output Example

`{"status_code":200,"reason":"OK","json_body":{"id":0,"incident_id":0,"user_id":0,"comment":"string","created_timestamp":"string","edited_timestamp":"string","user_name":"string","user_login_id":"string"}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |