| name | investigate-url |
| disable-model-invocation | true |
| argument-hint | <url_or_category_name> |
| description | Investigate where a URL or URL category is referenced across ZIA policy rules. |
Investigate URL Category
Investigate: $ARGUMENTS
Step 1: Classify the URL
If a URL was provided (not a category name):
zia_url_lookup(urls=["<url>"])
```text
Note the category name and ID.
## Step 2: Search Across All Policy Types
Check every policy type for references to this category:
**URL Filtering:**
```text
zia_list_url_filtering_rules()
```text
**SSL Inspection:**
```text
zia_list_ssl_inspection_rules()
```text
**DLP Web Rules:**
```text
zia_list_dlp_web_rules()
```text
**Cloud Firewall:**
```text
zia_list_cloud_firewall_rules()
```text
## Step 3: Map Policy Impact
For each rule that references the category, document:
- Rule name and order
- Action (ALLOW, BLOCK, CAUTION, INSPECT, DO_NOT_INSPECT, etc.)
- Scope (which users/groups/departments)
- Whether the rule is enabled
## Step 4: Present Report
```text
URL Category Policy Impact Report
===================================
URL: <url>
Category: <category_name>
Referenced in X rules across Y policy types:
URL FILTERING (Z rules):
1. "<rule>" (order N): BLOCK for All Users
2. "<rule>" (order N): ALLOW for <group> (override)
SSL INSPECTION (Z rules):
1. "<rule>" (order N): DO_NOT_INSPECT for All Users
DLP (Z rules):
(none)
CLOUD FIREWALL (Z rules):
1. "<rule>" (order N): ALLOW ports 80,443
Net effect for a typical user:
URL Filtering: BLOCKED
SSL Inspection: NOT INSPECTED
DLP: Not applicable (bypassed by SSL)
```text
