🔐 SecureDynamics Zscaler Policy Deployment via Make.com — User Guide

🧭 Overview

This guide explains how to deploy Zscaler Internet Access (ZIA) security policies using Make.com, a Flask-powered API backend, and HubSpot as the source of configuration. It supports multiple policy types and logs results in Google Sheets for visibility and auditing.

⚙️ Architecture Summary

Component	Function
HubSpot CRM (Company Object)	Stores configuration JSON and API credentials
Make.com	Orchestrates the flow: fetches file, parses policies, and routes calls
Flask API (`/deploy-baseline`)	Deploys policies to Zscaler via SDK and API
Flask API (`/flatten-for-sheet`)	Normalizes failed/skipped rules for reporting
Google Sheets + Drive	Saves structured results for each run

🛎️ Trigger Conditions

The automation runs only when:

A JSON configuration file is uploaded to the HubSpot Company object’s
➤ API/SDK Configuration Upload field.
The Company has the following required fields:
- zia_api_username
- zia_api_password
- zia_api_key
- zia_cloud_name

✅ These credentials are used to authenticate with the Zscaler tenant.

📦 Workflow: Step-by-Step

1. 📩 Webhook Trigger (Make.com)

Triggered by HubSpot Company object update.
Validates presence of:
- Configuration file link
- Required ZIA credentials

2. 📥 Download & Parse Config

Fetches the uploaded config file via HubSpot File API.
Parses the JSON into separate categories:
- url_filtering, ssl_inspection, firewall_rules, etc.

3. 🚀 Deploy Each Policy Set

Each policy set is:

POSTed to /deploy-baseline
Authenticated using Zscaler API credentials
Deployed via SDK (with fallback to HTTP if needed)

The backend:

Matches rule by name
Updates existing rules or creates new ones
Returns result per rule: CREATED, UPDATED, FAILED, or SKIPPED

4. 📊 Flatten & Format Result

Results are POSTed to /flatten-for-sheet
Extracts only failed or skipped rules
Returns structured rows like:

Type	Name	Status	Error
Firewall Rules	Block SSH	FAILED	Invalid port range
SSL Inspection	Default Rule	SKIPPED	Predefined rule – not editable

5. 🧾 Save to Sheet

Rows are written to a Google Sheet titled:

php-template

CopyEdit

<CompanyName>-<timestamp>
Sheet is stored in:
- Zscaler New Tenant Setup Status folder (Google Drive)
- Shared drive: GPT Automation

📑 API Output — `/deploy-baseline`

JSON

{
  "message": "Policy deployment completed using uploaded JSON",
  "status": "SUCCESS",
  "results": {
    "url_filtering": [
      {
        "type": "URL Filtering",
        "name": "Block Facebook",
        "status": "UPDATED",
        "error": null
      }
    ]
  }
}

📄 API Output — `/flatten-for-sheet`

Input: JSON

{ "array": [ { "url_filtering": [...], "firewall_rules": [...] } ] }

Output (filtered rows only): JSON

{
  "rows": [
    {
      "values": ["Type", "Name", "Status", "Error"]
    },
    {
      "values": ["URL Filtering", "Block Facebook", "FAILED", "Invalid domain"]
    }
  ]
}

🧯 Troubleshooting

Problem	Likely Cause / Fix
Webhook not triggering	File not uploaded in correct field
"Missing fields" error in response	One of the ZIA credentials is missing in HubSpot
Empty spreadsheet	All rules succeeded – this is expected
"SKIPPED: Predefined rule"	System-managed rule cannot be updated
Auth failed	Invalid ZIA username/password/API key
500 error with traceback	Payload malformed or ZIA API temporarily down

📋 Tips

✅ Always validate the config file format before uploading.
✅ Use unique rule name fields to ensure proper match/update.
✅ Avoid editing predefined Zscaler rules via this automation.
✅ Review the generated sheet after every deployment for QA.

✅ Summary

Step	Action
1	Upload JSON to HubSpot Company object
2	Ensure all ZIA credentials are present
3	Make.com fetches, parses, and dispatches each rule set
4	Flask API deploys rules to ZIA
5	Errors are flattened and logged in Google Sheets
6	Result is copied to Google Drive folder for historical tracking