1. Packages
  2. Zscaler Internet Access (ZIA)
  3. API Docs
  4. FirewallIPSRule
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

zia.FirewallIPSRule

zia logo
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

    The zia_firewall_ips_rule resource manages firewall IPS (Intrusion Prevention System) rules in the Zscaler Internet Access (ZIA) cloud service. IPS rules allow you to detect and prevent network intrusions by inspecting traffic for known threat signatures and anomalous patterns.

    For more information, see the ZIA IPS Control Policies documentation.

    Example Usage

    Basic Firewall IPS Rule

    Example coming soon!

    import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	zia "github.com/zscaler/pulumi-zia/sdk/go/pulumi-zia"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := zia.NewFirewallIPSRule(ctx, "example", &zia.FirewallIPSRuleArgs{
			Name:        pulumi.String("Example IPS Rule"),
			Description: pulumi.StringRef("Block intrusion attempts"),
			Order:       pulumi.Int(1),
			State:       pulumi.StringRef("ENABLED"),
			Action:      pulumi.StringRef("BLOCK_DROP"),
		})
		return err
	})
}

    Example coming soon!

    import * as zia from "@bdzscaler/pulumi-zia";

const example = new zia.FirewallIPSRule("example", {
    name: "Example IPS Rule",
    description: "Block intrusion attempts",
    order: 1,
    state: "ENABLED",
    action: "BLOCK_DROP",
});

    import zscaler_pulumi_zia as zia

example = zia.FirewallIPSRule("example",
    name="Example IPS Rule",
    description="Block intrusion attempts",
    order=1,
    state="ENABLED",
    action="BLOCK_DROP",
)

    resources:
  example:
    type: zia:FirewallIPSRule
    properties:
      name: Example IPS Rule
      description: Block intrusion attempts
      order: 1
      state: ENABLED
      action: BLOCK_DROP

    Create FirewallIPSRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FirewallIPSRule(name: string, args: FirewallIPSRuleArgs, opts?: CustomResourceOptions);
    @overload
def FirewallIPSRule(resource_name: str,
                    args: FirewallIPSRuleArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def FirewallIPSRule(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    name: Optional[str] = None,
                    order: Optional[int] = None,
                    labels: Optional[Sequence[int]] = None,
                    default_rule: Optional[bool] = None,
                    description: Optional[str] = None,
                    dest_addresses: Optional[Sequence[str]] = None,
                    dest_countries: Optional[Sequence[str]] = None,
                    dest_ip_categories: Optional[Sequence[str]] = None,
                    dest_ip_groups: Optional[Sequence[int]] = None,
                    dest_ipv6_groups: Optional[Sequence[int]] = None,
                    device_groups: Optional[Sequence[int]] = None,
                    devices: Optional[Sequence[int]] = None,
                    enable_full_logging: Optional[bool] = None,
                    eun_template_id: Optional[int] = None,
                    groups: Optional[Sequence[int]] = None,
                    is_eun_enabled: Optional[bool] = None,
                    action: Optional[str] = None,
                    location_groups: Optional[Sequence[int]] = None,
                    departments: Optional[Sequence[int]] = None,
                    nw_service_groups: Optional[Sequence[int]] = None,
                    locations: Optional[Sequence[int]] = None,
                    nw_services: Optional[Sequence[int]] = None,
                    capture_pcap: Optional[bool] = None,
                    predefined: Optional[bool] = None,
                    rank: Optional[int] = None,
                    res_categories: Optional[Sequence[str]] = None,
                    source_countries: Optional[Sequence[str]] = None,
                    src_ip_groups: Optional[Sequence[int]] = None,
                    src_ips: Optional[Sequence[str]] = None,
                    src_ipv6_groups: Optional[Sequence[int]] = None,
                    state: Optional[str] = None,
                    threat_categories: Optional[Sequence[int]] = None,
                    time_windows: Optional[Sequence[int]] = None,
                    users: Optional[Sequence[int]] = None,
                    zpa_app_segments: Optional[Sequence[ZPAAppSegmentInputArgs]] = None)
    func NewFirewallIPSRule(ctx *Context, name string, args FirewallIPSRuleArgs, opts ...ResourceOption) (*FirewallIPSRule, error)
    public FirewallIPSRule(string name, FirewallIPSRuleArgs args, CustomResourceOptions? opts = null)
    public FirewallIPSRule(String name, FirewallIPSRuleArgs args)
public FirewallIPSRule(String name, FirewallIPSRuleArgs args, CustomResourceOptions options)

    type: zia:FirewallIPSRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FirewallIPSRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FirewallIPSRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FirewallIPSRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FirewallIPSRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FirewallIPSRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var firewallIPSRuleResource = new Zia.FirewallIPSRule("firewallIPSRuleResource", new()
{
    Name = "string",
    Order = 0,
    Labels = new[]
    {
        0,
    },
    DefaultRule = false,
    Description = "string",
    DestAddresses = new[]
    {
        "string",
    },
    DestCountries = new[]
    {
        "string",
    },
    DestIpCategories = new[]
    {
        "string",
    },
    DestIpGroups = new[]
    {
        0,
    },
    DestIpv6Groups = new[]
    {
        0,
    },
    DeviceGroups = new[]
    {
        0,
    },
    Devices = new[]
    {
        0,
    },
    EnableFullLogging = false,
    EunTemplateId = 0,
    Groups = new[]
    {
        0,
    },
    IsEunEnabled = false,
    Action = "string",
    LocationGroups = new[]
    {
        0,
    },
    Departments = new[]
    {
        0,
    },
    NwServiceGroups = new[]
    {
        0,
    },
    Locations = new[]
    {
        0,
    },
    NwServices = new[]
    {
        0,
    },
    CapturePcap = false,
    Predefined = false,
    Rank = 0,
    ResCategories = new[]
    {
        "string",
    },
    SourceCountries = new[]
    {
        "string",
    },
    SrcIpGroups = new[]
    {
        0,
    },
    SrcIps = new[]
    {
        "string",
    },
    SrcIpv6Groups = new[]
    {
        0,
    },
    State = "string",
    ThreatCategories = new[]
    {
        0,
    },
    TimeWindows = new[]
    {
        0,
    },
    Users = new[]
    {
        0,
    },
    ZpaAppSegments = new[]
    {
        new Zia.Inputs.ZPAAppSegmentInputArgs
        {
            ExternalId = "string",
            Name = "string",
        },
    },
});

    example, err := zia.NewFirewallIPSRule(ctx, "firewallIPSRuleResource", &zia.FirewallIPSRuleArgs{
	Name:  pulumi.String("string"),
	Order: pulumi.Int(0),
	Labels: pulumi.IntArray{
		pulumi.Int(0),
	},
	DefaultRule: pulumi.Bool(false),
	Description: pulumi.String("string"),
	DestAddresses: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DestIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DeviceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Devices: pulumi.IntArray{
		pulumi.Int(0),
	},
	EnableFullLogging: pulumi.Bool(false),
	EunTemplateId:     pulumi.Int(0),
	Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	IsEunEnabled: pulumi.Bool(false),
	Action:       pulumi.String("string"),
	LocationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Departments: pulumi.IntArray{
		pulumi.Int(0),
	},
	NwServiceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Locations: pulumi.IntArray{
		pulumi.Int(0),
	},
	NwServices: pulumi.IntArray{
		pulumi.Int(0),
	},
	CapturePcap: pulumi.Bool(false),
	Predefined:  pulumi.Bool(false),
	Rank:        pulumi.Int(0),
	ResCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	SourceCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	SrcIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	State: pulumi.String("string"),
	ThreatCategories: pulumi.IntArray{
		pulumi.Int(0),
	},
	TimeWindows: pulumi.IntArray{
		pulumi.Int(0),
	},
	Users: pulumi.IntArray{
		pulumi.Int(0),
	},
	ZpaAppSegments: pulumizia.ZPAAppSegmentInputArray{
		&pulumizia.ZPAAppSegmentInputArgs{
			ExternalId: pulumi.String("string"),
			Name:       pulumi.String("string"),
		},
	},
})

    var firewallIPSRuleResource = new FirewallIPSRule("firewallIPSRuleResource", FirewallIPSRuleArgs.builder()
    .name("string")
    .order(0)
    .labels(0)
    .defaultRule(false)
    .description("string")
    .destAddresses("string")
    .destCountries("string")
    .destIpCategories("string")
    .destIpGroups(0)
    .destIpv6Groups(0)
    .deviceGroups(0)
    .devices(0)
    .enableFullLogging(false)
    .eunTemplateId(0)
    .groups(0)
    .isEunEnabled(false)
    .action("string")
    .locationGroups(0)
    .departments(0)
    .nwServiceGroups(0)
    .locations(0)
    .nwServices(0)
    .capturePcap(false)
    .predefined(false)
    .rank(0)
    .resCategories("string")
    .sourceCountries("string")
    .srcIpGroups(0)
    .srcIps("string")
    .srcIpv6Groups(0)
    .state("string")
    .threatCategories(0)
    .timeWindows(0)
    .users(0)
    .zpaAppSegments(ZPAAppSegmentInputArgs.builder()
        .externalId("string")
        .name("string")
        .build())
    .build());

    firewall_ips_rule_resource = zia.FirewallIPSRule("firewallIPSRuleResource",
    name="string",
    order=0,
    labels=[0],
    default_rule=False,
    description="string",
    dest_addresses=["string"],
    dest_countries=["string"],
    dest_ip_categories=["string"],
    dest_ip_groups=[0],
    dest_ipv6_groups=[0],
    device_groups=[0],
    devices=[0],
    enable_full_logging=False,
    eun_template_id=0,
    groups=[0],
    is_eun_enabled=False,
    action="string",
    location_groups=[0],
    departments=[0],
    nw_service_groups=[0],
    locations=[0],
    nw_services=[0],
    capture_pcap=False,
    predefined=False,
    rank=0,
    res_categories=["string"],
    source_countries=["string"],
    src_ip_groups=[0],
    src_ips=["string"],
    src_ipv6_groups=[0],
    state="string",
    threat_categories=[0],
    time_windows=[0],
    users=[0],
    zpa_app_segments=[{
        "external_id": "string",
        "name": "string",
    }])

    const firewallIPSRuleResource = new zia.FirewallIPSRule("firewallIPSRuleResource", {
    name: "string",
    order: 0,
    labels: [0],
    defaultRule: false,
    description: "string",
    destAddresses: ["string"],
    destCountries: ["string"],
    destIpCategories: ["string"],
    destIpGroups: [0],
    destIpv6Groups: [0],
    deviceGroups: [0],
    devices: [0],
    enableFullLogging: false,
    eunTemplateId: 0,
    groups: [0],
    isEunEnabled: false,
    action: "string",
    locationGroups: [0],
    departments: [0],
    nwServiceGroups: [0],
    locations: [0],
    nwServices: [0],
    capturePcap: false,
    predefined: false,
    rank: 0,
    resCategories: ["string"],
    sourceCountries: ["string"],
    srcIpGroups: [0],
    srcIps: ["string"],
    srcIpv6Groups: [0],
    state: "string",
    threatCategories: [0],
    timeWindows: [0],
    users: [0],
    zpaAppSegments: [{
        externalId: "string",
        name: "string",
    }],
});

    type: zia:FirewallIPSRule
properties:
    action: string
    capturePcap: false
    defaultRule: false
    departments:
        - 0
    description: string
    destAddresses:
        - string
    destCountries:
        - string
    destIpCategories:
        - string
    destIpGroups:
        - 0
    destIpv6Groups:
        - 0
    deviceGroups:
        - 0
    devices:
        - 0
    enableFullLogging: false
    eunTemplateId: 0
    groups:
        - 0
    isEunEnabled: false
    labels:
        - 0
    locationGroups:
        - 0
    locations:
        - 0
    name: string
    nwServiceGroups:
        - 0
    nwServices:
        - 0
    order: 0
    predefined: false
    rank: 0
    resCategories:
        - string
    sourceCountries:
        - string
    srcIpGroups:
        - 0
    srcIps:
        - string
    srcIpv6Groups:
        - 0
    state: string
    threatCategories:
        - 0
    timeWindows:
        - 0
    users:
        - 0
    zpaAppSegments:
        - externalId: string
          name: string

    FirewallIPSRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FirewallIPSRule resource accepts the following input properties:

    Name string
    The name of the firewall IPS rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall IPS rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    CapturePcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    DefaultRule bool
    Indicates whether this is the default firewall IPS rule.
    Departments List<int>
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall IPS rule.
    DestAddresses List<string>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries List<string>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories List<string>
    Destination IP address URL categories for the rule.
    DestIpGroups List<int>
    IDs of destination IP address groups for the rule.
    DestIpv6Groups List<int>
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups List<int>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices List<int>
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    EunTemplateId int
    The ID of the end user notification template associated with the rule.
    Groups List<int>
    IDs of groups to which the rule must be applied.
    IsEunEnabled bool
    If set to true, enables end user notification for the rule.
    Labels List<int>
    IDs of labels associated with the rule.
    LocationGroups List<int>
    IDs of location groups to which the rule must be applied.
    Locations List<int>
    IDs of locations to which the rule must be applied.
    NwServiceGroups List<int>
    IDs of network service groups to which the rule applies.
    NwServices List<int>
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    ResCategories List<string>
    URL categories that apply to the response for the rule.
    SourceCountries List<string>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups List<int>
    IDs of source IP address groups for the rule.
    SrcIps List<string>
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups List<int>
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    ThreatCategories List<int>
    IDs of threat categories to which the rule applies.
    TimeWindows List<int>
    IDs of time intervals during which the rule must be enforced.
    Users List<int>
    IDs of users to which the rule must be applied.
    ZpaAppSegments List<zscaler.PulumiPackage.Zia.Inputs.ZPAAppSegmentInput>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    Name string
    The name of the firewall IPS rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall IPS rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    CapturePcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    DefaultRule bool
    Indicates whether this is the default firewall IPS rule.
    Departments []int
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall IPS rule.
    DestAddresses []string
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries []string
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories []string
    Destination IP address URL categories for the rule.
    DestIpGroups []int
    IDs of destination IP address groups for the rule.
    DestIpv6Groups []int
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups []int
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices []int
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    EunTemplateId int
    The ID of the end user notification template associated with the rule.
    Groups []int
    IDs of groups to which the rule must be applied.
    IsEunEnabled bool
    If set to true, enables end user notification for the rule.
    Labels []int
    IDs of labels associated with the rule.
    LocationGroups []int
    IDs of location groups to which the rule must be applied.
    Locations []int
    IDs of locations to which the rule must be applied.
    NwServiceGroups []int
    IDs of network service groups to which the rule applies.
    NwServices []int
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    ResCategories []string
    URL categories that apply to the response for the rule.
    SourceCountries []string
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups []int
    IDs of source IP address groups for the rule.
    SrcIps []string
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups []int
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    ThreatCategories []int
    IDs of threat categories to which the rule applies.
    TimeWindows []int
    IDs of time intervals during which the rule must be enforced.
    Users []int
    IDs of users to which the rule must be applied.
    ZpaAppSegments []ZPAAppSegmentInputArgs
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name String
    The name of the firewall IPS rule. Must be unique.
    order Integer
    The order of execution of the rule with respect to other firewall IPS rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    capturePcap Boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule Boolean
    Indicates whether this is the default firewall IPS rule.
    departments List<Integer>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall IPS rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Integer>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Integer>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Integer>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Integer>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    eunTemplateId Integer
    The ID of the end user notification template associated with the rule.
    groups List<Integer>
    IDs of groups to which the rule must be applied.
    isEunEnabled Boolean
    If set to true, enables end user notification for the rule.
    labels List<Integer>
    IDs of labels associated with the rule.
    locationGroups List<Integer>
    IDs of location groups to which the rule must be applied.
    locations List<Integer>
    IDs of locations to which the rule must be applied.
    nwServiceGroups List<Integer>
    IDs of network service groups to which the rule applies.
    nwServices List<Integer>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Integer
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Integer>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Integer>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    threatCategories List<Integer>
    IDs of threat categories to which the rule applies.
    timeWindows List<Integer>
    IDs of time intervals during which the rule must be enforced.
    users List<Integer>
    IDs of users to which the rule must be applied.
    zpaAppSegments List<ZPAAppSegmentInput>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name string
    The name of the firewall IPS rule. Must be unique.
    order number
    The order of execution of the rule with respect to other firewall IPS rules.
    action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    capturePcap boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule boolean
    Indicates whether this is the default firewall IPS rule.
    departments number[]
    IDs of departments to which the rule must be applied.
    description string
    Additional information about the firewall IPS rule.
    destAddresses string[]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries string[]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories string[]
    Destination IP address URL categories for the rule.
    destIpGroups number[]
    IDs of destination IP address groups for the rule.
    destIpv6Groups number[]
    IDs of destination IPv6 address groups for the rule.
    deviceGroups number[]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices number[]
    IDs of devices for which the rule must be applied.
    enableFullLogging boolean
    If set to true, enables full logging for the rule.
    eunTemplateId number
    The ID of the end user notification template associated with the rule.
    groups number[]
    IDs of groups to which the rule must be applied.
    isEunEnabled boolean
    If set to true, enables end user notification for the rule.
    labels number[]
    IDs of labels associated with the rule.
    locationGroups number[]
    IDs of location groups to which the rule must be applied.
    locations number[]
    IDs of locations to which the rule must be applied.
    nwServiceGroups number[]
    IDs of network service groups to which the rule applies.
    nwServices number[]
    IDs of network services to which the rule applies.
    predefined boolean
    Indicates whether this is a predefined rule.
    rank number
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    resCategories string[]
    URL categories that apply to the response for the rule.
    sourceCountries string[]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups number[]
    IDs of source IP address groups for the rule.
    srcIps string[]
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups number[]
    IDs of source IPv6 address groups for the rule.
    state string
    Rule state. Valid values: ENABLED, DISABLED.
    threatCategories number[]
    IDs of threat categories to which the rule applies.
    timeWindows number[]
    IDs of time intervals during which the rule must be enforced.
    users number[]
    IDs of users to which the rule must be applied.
    zpaAppSegments ZPAAppSegmentInput[]
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name str
    The name of the firewall IPS rule. Must be unique.
    order int
    The order of execution of the rule with respect to other firewall IPS rules.
    action str
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    capture_pcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    default_rule bool
    Indicates whether this is the default firewall IPS rule.
    departments Sequence[int]
    IDs of departments to which the rule must be applied.
    description str
    Additional information about the firewall IPS rule.
    dest_addresses Sequence[str]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    dest_countries Sequence[str]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    dest_ip_categories Sequence[str]
    Destination IP address URL categories for the rule.
    dest_ip_groups Sequence[int]
    IDs of destination IP address groups for the rule.
    dest_ipv6_groups Sequence[int]
    IDs of destination IPv6 address groups for the rule.
    device_groups Sequence[int]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices Sequence[int]
    IDs of devices for which the rule must be applied.
    enable_full_logging bool
    If set to true, enables full logging for the rule.
    eun_template_id int
    The ID of the end user notification template associated with the rule.
    groups Sequence[int]
    IDs of groups to which the rule must be applied.
    is_eun_enabled bool
    If set to true, enables end user notification for the rule.
    labels Sequence[int]
    IDs of labels associated with the rule.
    location_groups Sequence[int]
    IDs of location groups to which the rule must be applied.
    locations Sequence[int]
    IDs of locations to which the rule must be applied.
    nw_service_groups Sequence[int]
    IDs of network service groups to which the rule applies.
    nw_services Sequence[int]
    IDs of network services to which the rule applies.
    predefined bool
    Indicates whether this is a predefined rule.
    rank int
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    res_categories Sequence[str]
    URL categories that apply to the response for the rule.
    source_countries Sequence[str]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    src_ip_groups Sequence[int]
    IDs of source IP address groups for the rule.
    src_ips Sequence[str]
    Source IP addresses or CIDR ranges for the rule.
    src_ipv6_groups Sequence[int]
    IDs of source IPv6 address groups for the rule.
    state str
    Rule state. Valid values: ENABLED, DISABLED.
    threat_categories Sequence[int]
    IDs of threat categories to which the rule applies.
    time_windows Sequence[int]
    IDs of time intervals during which the rule must be enforced.
    users Sequence[int]
    IDs of users to which the rule must be applied.
    zpa_app_segments Sequence[ZPAAppSegmentInputArgs]
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name String
    The name of the firewall IPS rule. Must be unique.
    order Number
    The order of execution of the rule with respect to other firewall IPS rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP.
    capturePcap Boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule Boolean
    Indicates whether this is the default firewall IPS rule.
    departments List<Number>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall IPS rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Number>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Number>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Number>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Number>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    eunTemplateId Number
    The ID of the end user notification template associated with the rule.
    groups List<Number>
    IDs of groups to which the rule must be applied.
    isEunEnabled Boolean
    If set to true, enables end user notification for the rule.
    labels List<Number>
    IDs of labels associated with the rule.
    locationGroups List<Number>
    IDs of location groups to which the rule must be applied.
    locations List<Number>
    IDs of locations to which the rule must be applied.
    nwServiceGroups List<Number>
    IDs of network service groups to which the rule applies.
    nwServices List<Number>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Number
    Admin rank of the firewall IPS policy rule. Valid values: 0-7. Default: 7.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Number>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Number>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    threatCategories List<Number>
    IDs of threat categories to which the rule applies.
    timeWindows List<Number>
    IDs of time intervals during which the rule must be enforced.
    users List<Number>
    IDs of users to which the rule must be applied.
    zpaAppSegments List<Property Map>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FirewallIPSRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall IPS rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall IPS rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Integer
    The system-generated ID of the firewall IPS rule.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleId number
    The system-generated ID of the firewall IPS rule.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_id int
    The system-generated ID of the firewall IPS rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Number
    The system-generated ID of the firewall IPS rule.

    Supporting Types

    ZPAAppSegmentInput, ZPAAppSegmentInputArgs

    ExternalId string
    Name string
    ExternalId string
    Name string
    externalId String
    name String
    externalId string
    name string
    externalId String
    name String

    Import

    An existing Firewall IPS Rule can be imported using its resource ID, e.g.

    $ pulumi import zia:index:FirewallIPSRule example 12345

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    zia zscaler/pulumi-zia
    License
    zia logo
    Viewing docs for pulumi-resource-zia v1.3.8
    published on Friday, Mar 13, 2026 by Zscaler
    Schema (JSON)
    zscaler/pulumi-zia
      Try Pulumi Cloud free. Your team will thank you.