[Zscaler API] URL Category creation error: 400 Client Error

[Thadiyan123]

Hi team,

I have updated the config file with required inputs and when i run the python intelbridge its throwing me error.

Authentication is successful but the URL creation is ending in failure. Attaching the logs , Please let me know if there is some way to fix this.

Note : I am new to all of these , your help will be much appreciated.

[CyberHygiene101]

Hey there,

I haven't used this script for couple of years now so this might not be much help.

Looking at the configs I used back then, I changed the zscaler url from https://zsapi.zscaler.net to https://admin.zscaler.net so it might be worth trying that and re-running the script.

Can I also suggest that for security purposes and assuming the log file has not been modified to remove identifiable information:

1. Create a new Falcon client ID and de-activate the ID you have included in the log.
2. Remove the current log file if you have the option to do so and re-upload one where your email and falcon ID are removed/replaced

I hope this helps.

[Thadiyan123]

Hello,

I have tried the recommendations.

1. Created new falcon client ID
2. Tried with https://zsapi.zscaler.net/ and https://admin.zscaler.net/ both ending with same error. Attaching you the latest log files without any identifiable information.

====================================================================================
05/30/2025 07:10:45 PM Log utility started. Writing to ./logs/2025-05-30-13_40_45_intel_bridge_log.log
05/30/2025 07:10:45 PM Intel Bridge main routine starting...
05/30/2025 07:10:45 PM Initializing Intel Bridge
05/30/2025 07:10:45 PM Authenticating client xxxxxxxxxxxxxxxx to Falcon API
05/30/2025 07:10:45 PM Authenticating user yz@gmail.com to Zscaler API
05/30/2025 07:10:50 PM Starting Pull/Prepare/Push Loop # 1 With new indicators
05/30/2025 07:10:50 PM Confirming URL category CrowdStrike exists
05/30/2025 07:10:54 PM Creating URL category CrowdStrike
05/30/2025 07:10:55 PM [Zscaler API] URL Category creation error: 400 Client Error: for url: https://admin.zscaler.net/api/v1/urlCategories
05/30/2025 07:10:55 PM HTTP related failure:
< POST /api/v1/urlCategories HTTP/1.1
< Host: admin.zscaler.net
< User-Agent: Zscaler-FalconX-Intel-Bridge-v2
< Accept-Encoding: gzip, deflate
< Accept: /
< Connection: keep-alive
< content-type: application/json
< cache-control: no-cache
< cookie: JSESSIONID=xxxxxxxxxxxxx
< Content-Length: 130
<
< {"id": 0, "configuredName": "CrowdStrike", "customCategory": "true", "superCategory": "USER_DEFINED", "urls": ["mine.ppxxmr.com"]}

HTTP/1.1 400
Content-Type: application/json
Content-Length: 38
Connection: keep-alive
Strict-Transport-Security: max-age=31622400;includeSubDomains;preload
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
x-zscaler-mode: read-write
Content-Disposition: attachment; filename="api.json"
Cache-Control: no-store, no-cache
Date: Fri, 30 May 2025 13:40:54 GMT
Server: Zscaler
X-Cache: Error from cloudfront
Via: 1.1 dsgfsgssdf.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAA51-P2
Alt-Svc: h3=":443"; ma=86400
as>
{"message":"Request body is invalid."}