From d97d9f2f8c72e100e7b76cc12472651a8436c13c Mon Sep 17 00:00:00 2001
From: Andrei Irimia <andrei.irimia@blackrock.com>
Date: Thu, 2 Apr 2026 17:57:23 +0100
Subject: [PATCH 1/4] chore: update copyright

---
 LICENSE                      | 2 +-
 NOTICE                       | 2 +-
 README.md                    | 2 +-
 __init__.py                  | 2 +-
 zscaler.json                 | 3 +--
 zscaler_connector.py         | 2 +-
 zscaler_consts.py            | 2 +-
 zscaler_get_admin_users.html | 2 +-
 zscaler_submit_file.html     | 2 +-
 zscaler_view.py              | 2 +-
 10 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/LICENSE b/LICENSE
index 01f84e5..86185fe 100644
--- a/LICENSE
+++ b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright (c) 2017-2025 Splunk Inc.
+   Copyright (c) 2017-2026 Splunk Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/NOTICE b/NOTICE
index e39a977..fdd8cf8 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,2 +1,2 @@
 Splunk SOAR App: Zscaler
-Copyright (c) 2017-2025 Splunk Inc.
+Copyright (c) 2017-2026 Splunk Inc.
diff --git a/README.md b/README.md
index fb0cef4..0f67287 100644
--- a/README.md
+++ b/README.md
@@ -1307,7 +1307,7 @@ ______________________________________________________________________
 
 Auto-generated Splunk SOAR Connector documentation.
 
-Copyright 2025 Splunk Inc.
+Copyright 2026 Splunk Inc.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/__init__.py b/__init__.py
index c8a2c5b..c6ac30e 100644
--- a/__init__.py
+++ b/__init__.py
@@ -1,6 +1,6 @@
 # File: __init__.py
 #
-# Copyright (c) 2017-2025 Splunk Inc.
+# Copyright (c) 2017-2026 Splunk Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/zscaler.json b/zscaler.json
index a19fb45..bc7fb72 100644
--- a/zscaler.json
+++ b/zscaler.json
@@ -9,8 +9,7 @@
     "product_name": "Zscaler",
     "product_version_regex": ".*",
     "publisher": "Splunk",
-    "license": "Copyright (c) 2017-2025 Splunk Inc.",
-    "app_version": "3.0.1",
+    "license": "Copyright (c) 2017-2026 Splunk Inc.",
     "utctime_updated": "2025-09-05T16:54:04.402050Z",
     "package_name": "phantom_zscaler",
     "main_module": "zscaler_connector.py",
diff --git a/zscaler_connector.py b/zscaler_connector.py
index 4f00ebf..12137f1 100644
--- a/zscaler_connector.py
+++ b/zscaler_connector.py
@@ -1,6 +1,6 @@
 # File: zscaler_connector.py
 #
-# Copyright (c) 2017-2025 Splunk Inc.
+# Copyright (c) 2017-2026 Splunk Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/zscaler_consts.py b/zscaler_consts.py
index e154084..f261979 100644
--- a/zscaler_consts.py
+++ b/zscaler_consts.py
@@ -1,6 +1,6 @@
 # File: zscaler_consts.py
 #
-# Copyright (c) 2017-2025 Splunk Inc.
+# Copyright (c) 2017-2026 Splunk Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/zscaler_get_admin_users.html b/zscaler_get_admin_users.html
index 4d5bfa2..4073b14 100644
--- a/zscaler_get_admin_users.html
+++ b/zscaler_get_admin_users.html
@@ -11,7 +11,7 @@
 {% block widget_content %}
   <!-- Main Start Block -->
   <!-- File: zscaler_get_admin_users.html
-    Copyright (c) 2017-2025 Splunk Inc.
+    Copyright (c) 2017-2026 Splunk Inc.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
diff --git a/zscaler_submit_file.html b/zscaler_submit_file.html
index 6b91cb0..c08b8f3 100644
--- a/zscaler_submit_file.html
+++ b/zscaler_submit_file.html
@@ -11,7 +11,7 @@
 {% block widget_content %}
   <!-- Main Start Block -->
   <!-- File: zscaler_submit_file.html
-    Copyright (c) 2017-2025 Splunk Inc.
+    Copyright (c) 2017-2026 Splunk Inc.
 
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
diff --git a/zscaler_view.py b/zscaler_view.py
index 480142b..14fa182 100644
--- a/zscaler_view.py
+++ b/zscaler_view.py
@@ -1,6 +1,6 @@
 # File: zscaler_view.py
 #
-# Copyright (c) 2017-2025 Splunk Inc.
+# Copyright (c) 2017-2026 Splunk Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

From 09a187d69a19ee3eec5d26a49d974391991c8a70 Mon Sep 17 00:00:00 2001
From: Andrei Irimia <andrei.irimia@blackrock.com>
Date: Thu, 2 Apr 2026 17:57:45 +0100
Subject: [PATCH 2/4] chore: pin pre-commit dependency

---
 .pre-commit-config.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fe86072..f388580 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -51,6 +51,7 @@ repos:
     rev: v1.89.0
     hooks:
       - id: semgrep
+        additional_dependencies: ["setuptools==81.0.0"]
   - repo: https://github.com/Yelp/detect-secrets
     rev: v1.5.0
     hooks:

From ba9020aabfc9718b3c3b74ff0be59aecec9f19a5 Mon Sep 17 00:00:00 2001
From: Andrei Irimia <andrei.irimia@blackrock.com>
Date: Thu, 2 Apr 2026 18:17:18 +0100
Subject: [PATCH 3/4] feat: add oauth support

---
 README.md                   |  18 +++-
 manual_readme_content.md    |   7 ++
 release_notes/unreleased.md |   1 +
 zscaler.json                |  31 ++++++-
 zscaler_connector.py        | 178 ++++++++++++++++++++++++++++++++----
 zscaler_consts.py           |  10 ++
 6 files changed, 217 insertions(+), 28 deletions(-)

diff --git a/README.md b/README.md
index 0f67287..26bc43f 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,20 @@
 # Zscaler
 
 Publisher: Splunk <br>
-Connector Version: 3.0.1 <br>
+Connector Version: 3.1.0 <br>
 Product Vendor: Zscaler <br>
 Product Name: Zscaler <br>
 Minimum Product Version: 6.2.2
 
 This app implements containment and investigative actions on Zscaler
 
+This app supports either authentication method below (one complete method is required):
+
+- **API session authentication:** `username`, `password`, and `api_key`
+- **OAuth client credentials:** `oauth_token_url`, `oauth_client_id`, and `oauth_client_secret`
+
+If neither method is fully configured, the app returns an authentication error.
+
 Below points are considered for providing the **URL Category** parameter value.
 
 - Entire URL category string has to be mentioned in block letters
@@ -76,9 +83,12 @@ This table lists the configuration variables required to operate Zscaler. These
 VARIABLE | REQUIRED | TYPE | DESCRIPTION
 -------- | -------- | ---- | -----------
 **base_url** | required | string | Base URL (e.g. https://admin.zscaler_instance.net) |
-**api_key** | required | password | API Key |
-**username** | required | string | Username |
-**password** | required | password | Password |
+**api_key** | optional | password | API Key |
+**username** | optional | string | Username |
+**password** | optional | password | Password |
+**oauth_token_url** | optional | string | OAuth Token URL |
+**oauth_client_id** | optional | string | OAuth Client ID |
+**oauth_client_secret** | optional | password | OAuth Client Secret |
 **sandbox_base_url** | optional | string | Sandbox Base URL |
 **sandbox_api_token** | optional | password | Sandbox API Token |
 
diff --git a/manual_readme_content.md b/manual_readme_content.md
index 92b1619..d16461f 100644
--- a/manual_readme_content.md
+++ b/manual_readme_content.md
@@ -1,3 +1,10 @@
+This app supports either authentication method below (one complete method is required):
+
+- **API session authentication:** `username`, `password`, and `api_key`
+- **OAuth client credentials:** `oauth_token_url`, `oauth_client_id`, and `oauth_client_secret`
+
+If neither method is fully configured, the app returns an authentication error.
+
 Below points are considered for providing the **URL Category** parameter value.
 
 - Entire URL category string has to be mentioned in block letters
diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md
index fbcb2fd..1115c9a 100644
--- a/release_notes/unreleased.md
+++ b/release_notes/unreleased.md
@@ -1 +1,2 @@
 **Unreleased**
+* Added OAuth support
\ No newline at end of file
diff --git a/zscaler.json b/zscaler.json
index bc7fb72..74d0258 100644
--- a/zscaler.json
+++ b/zscaler.json
@@ -9,7 +9,13 @@
     "product_name": "Zscaler",
     "product_version_regex": ".*",
     "publisher": "Splunk",
+    "contributors": [
+        {
+            "name": "Andrei Irimia"
+        }
+    ],
     "license": "Copyright (c) 2017-2026 Splunk Inc.",
+    "app_version": "3.1.0",
     "utctime_updated": "2025-09-05T16:54:04.402050Z",
     "package_name": "phantom_zscaler",
     "main_module": "zscaler_connector.py",
@@ -30,30 +36,45 @@
         "api_key": {
             "description": "API Key",
             "data_type": "password",
-            "required": true,
             "order": 1
         },
         "username": {
             "description": "Username",
             "data_type": "string",
-            "required": true,
             "order": 2
         },
         "password": {
             "description": "Password",
             "data_type": "password",
-            "required": true,
             "order": 3
         },
+        "oauth_token_url": {
+            "description": "OAuth Token URL",
+            "data_type": "string",
+            "required": false,
+            "order": 4
+        },
+        "oauth_client_id": {
+            "description": "OAuth Client ID",
+            "data_type": "string",
+            "required": false,
+            "order": 5
+        },
+        "oauth_client_secret": {
+            "description": "OAuth Client Secret",
+            "data_type": "password",
+            "required": false,
+            "order": 6
+        },
         "sandbox_base_url": {
             "data_type": "string",
             "description": "Sandbox Base URL",
-            "order": 4
+            "order": 7
         },
         "sandbox_api_token": {
             "data_type": "password",
             "description": "Sandbox API Token",
-            "order": 5
+            "order": 8
         }
     },
     "actions": [
diff --git a/zscaler_connector.py b/zscaler_connector.py
index 12137f1..155b451 100644
--- a/zscaler_connector.py
+++ b/zscaler_connector.py
@@ -19,13 +19,16 @@
 import json
 import re
 import time
+from datetime import datetime, timedelta
 
+import encryption_helper
 import phantom.app as phantom
 import phantom.rules as phantom_rules
 import requests
 from bs4 import BeautifulSoup
 from phantom.action_result import ActionResult
 from phantom.base_connector import BaseConnector
+from requests.auth import HTTPBasicAuth
 
 from zscaler_consts import *
 
@@ -45,6 +48,12 @@ def __init__(self):
         self._headers = None
         self._category = None
         self._retry_rest_call = None  # Retry rest call when get status_code 409 or 429
+        self._oauth_token_url = None
+        self._oauth_client_id = None
+        self._oauth_client_secret = None
+        self._oauth_access_token = None
+        self._oauth_token_expiry_time = None
+        self._use_oauth = False
 
     def _get_err_msg_from_exception(self, e):
         """
@@ -298,27 +307,121 @@ def _obfuscate_api_key(self, api_key):
         return now, key
 
     def _init_session(self):
-        username = self._username
-        password = self._password
-        api_key = self._api_key
-        try:
-            timestamp, obf_api_key = self._obfuscate_api_key(api_key)
-        except Exception:
-            return self.set_status(phantom.APP_ERROR, "Error obfuscating API key")
+        """Attempts to authenticate with Zscaler using either OAuth or API key authentication based on the asset configuration parameters"""
+        action_result = ActionResult()
 
-        body = {"apiKey": obf_api_key, "username": username, "password": password, "timestamp": timestamp}
+        # Use OAuth if OAuth credentials are provided
+        if self._use_oauth:
+            self.save_progress("Using OAuth for authentication")
+            access_token = self._generate_oauth_access_token(action_result)
+            if not access_token:
+                return self.set_status(phantom.APP_ERROR, "Error generating OAuth access token")
 
-        action_result = ActionResult()
-        ret_val, _ = self._make_rest_call_helper("/api/v1/authenticatedSession", action_result, data=body, method="post")
-        if phantom.is_fail(ret_val):
-            self.debug_print(f"Error starting Zscaler session: {action_result.get_message()}")
-            return self.set_status(phantom.APP_ERROR, f"Error starting Zscaler session: {action_result.get_message()}")
-        else:
-            self.save_progress("Successfully started Zscaler session")
-            self._headers = {"cookie": self._response.headers["Set-Cookie"].split(";")[0].strip()}
+            self._headers = {"Authorization": f"Bearer {access_token}"}
             return phantom.APP_SUCCESS
+        else:  # Fallback to API key authentication
+            try:
+                timestamp, obf_api_key = self._obfuscate_api_key(self._api_key)
+            except Exception:
+                return self.set_status(phantom.APP_ERROR, "Error obfuscating API key")
+
+            body = {
+                "apiKey": obf_api_key,
+                "username": self._username,
+                "password": self._password,
+                "timestamp": timestamp,
+            }
+
+            ret_val, _ = self._make_rest_call_helper("/api/v1/authenticatedSession", action_result, data=body, method="post")
+            if phantom.is_fail(ret_val):
+                self.debug_print(f"Error starting Zscaler session: {action_result.get_message()}")
+                return self.set_status(
+                    phantom.APP_ERROR,
+                    f"Error starting Zscaler session: {action_result.get_message()}",
+                )
+            else:
+                self.save_progress("Successfully started Zscaler session")
+                self._headers = {"cookie": self._response.headers["Set-Cookie"].split(";")[0].strip()}
+                return phantom.APP_SUCCESS
+
+    def _generate_oauth_access_token(self, action_result: ActionResult) -> str | None:
+        """Generates OAuth access token using asset configuration parameters
+
+        :param action_result: ActionResult object to set status and debug data
+        :return: access token if successful, None otherwise
+        """
+        # Use existing token if valid
+        if self._oauth_access_token and self._oauth_token_expiry_time and datetime.now() < self._oauth_token_expiry_time:
+            self.save_progress("OAuth access token is still valid, using existing token")
+            return self._oauth_access_token
+
+        self.save_progress("Generating OAuth access token")
+
+        # Generate new token by making a request to the token URL
+        self.save_progress("Generating new OAuth access token")
+        payload = {"grant_type": "client_credentials"}
+        try:
+            response = requests.post(
+                self._oauth_token_url,
+                data=payload,
+                auth=HTTPBasicAuth(self._oauth_client_id, self._oauth_client_secret),
+                timeout=ZSCALER_DEFAULT_TIMEOUT,
+            )
+        except Exception as e:
+            action_result.set_status(
+                phantom.APP_ERROR,
+                f"Error generating OAuth access token: {self._get_err_msg_from_exception(e)}",
+            )
+            return None
+
+        # Cache the token using the expires_in value returned by the OAuth token endpoint
+        try:
+            response_json = response.json()
+            self._oauth_access_token = response_json.get(ZSCALER_OAUTH_ACCESS_TOKEN_KEY)
+            expires_in = response_json.get("expires_in")
+            if self._oauth_access_token and isinstance(expires_in, (int, float)) and expires_in > 0:
+                self._oauth_token_expiry_time = datetime.now() + timedelta(seconds=int(expires_in))
+            else:
+                self._oauth_token_expiry_time = None
+        except Exception as e:
+            action_result.set_status(
+                phantom.APP_ERROR,
+                f"Error parsing OAuth access token from response: {self._get_err_msg_from_exception(e)}",
+            )
+            return None
+
+        # If we don't have an access token at this point, something went wrong
+        if not self._oauth_access_token:
+            action_result.set_status(phantom.APP_ERROR, "OAuth access token not found in response")
+            return None
+
+        self.save_progress("Successfully generated OAuth access token")
+        return self._oauth_access_token
+
+    def encrypt(self, encrypt_var, token_name):
+        """Handle encryption of token
+
+        :param encrypt_var: Variable that needs to be encrypted
+        :param token_name: Name of the token to be encrypted, used for logging purposes
+        :return: encrypted variable
+        """
+        self.debug_print(f"Encrypting the {token_name} token")
+        return encryption_helper.encrypt(encrypt_var, self.get_asset_id())
+
+    def decrypt(self, decrypt_var, token_name):
+        """Handle decryption of token
+
+        :param decrypt_var: Variable needs to be decrypted
+        :param token_name: Name of the token to be decrypted, used for logging purposes
+        :return: decrypted variable
+        """
+        self.debug_print(f"Decrypting the {token_name} token")
+        return encryption_helper.decrypt(decrypt_var, self.get_asset_id())
 
     def _deinit_session(self):
+        if self._use_oauth:
+            return phantom.APP_SUCCESS
+
         action_result = ActionResult()
         config = self.get_config()
         self._base_url = config["base_url"].rstrip("/")
@@ -1541,11 +1644,36 @@ def initialize(self):
             self.debug_print("Resetting the state file with the default format")
             self._state = {"app_version": self.get_app_json().get("app_version")}
 
+        # API authentication
         config = self.get_config()
         self._base_url = config["base_url"].rstrip("/")
-        self._username = config["username"]
-        self._password = config["password"]
-        self._api_key = config["api_key"]
+        self._username = config.get("username", None)
+        self._password = config.get("password", None)
+        self._api_key = config.get("api_key", None)
+
+        # OAuth
+        self._oauth_token_url = config.get(ZSCALER_OAUTH_TOKEN_URL_KEY, "").rstrip("/") or None
+        self._oauth_client_id = config.get(ZSCALER_OAUTH_CLIENT_ID_KEY, None)
+        self._oauth_client_secret = config.get(ZSCALER_OAUTH_CLIENT_SECRET_KEY, None)
+        self._oauth_access_token = self._state.get(ZSCALER_OAUTH_ACCESS_TOKEN_KEY, None)
+        oauth_token_expiry_time = self._state.get(ZSCALER_OAUTH_TOKEN_EXPIRY_TIME_KEY)
+        if oauth_token_expiry_time:
+            try:
+                self._oauth_token_expiry_time = datetime.fromisoformat(oauth_token_expiry_time)
+            except Exception as e:
+                self.debug_print(f"Failed to parse saved OAuth token expiry time: {e}")
+                self._oauth_token_expiry_time = None
+        self._use_oauth = self._oauth_token_url is not None and self._oauth_client_id is not None and self._oauth_client_secret is not None
+
+        # Decrypt the access token if it exists in the state and is encrypted
+        if self._use_oauth and self._oauth_access_token and self._state.get(ZSCALER_OAUTH_TOKEN_ENCRYPTED_KEY, False):
+            try:
+                self._oauth_access_token = self.decrypt(self._oauth_access_token, ZSCALER_OAUTH_ACCESS_TOKEN_KEY)
+                self._state[ZSCALER_OAUTH_TOKEN_ENCRYPTED_KEY] = False
+            except Exception as e:
+                self.debug_print(ZSCALER_DECRYPTION_ERROR_MSG.format(e))
+                return self.set_status(phantom.APP_ERROR, ZSCALER_DECRYPTION_ERROR_MSG.format(e))
+
         self._sandbox_base_url = config.get("sandbox_base_url", None)
         if self._sandbox_base_url:
             self._sandbox_base_url = self._sandbox_base_url.rstrip("/")
@@ -1557,6 +1685,18 @@ def initialize(self):
         return self._init_session()
 
     def finalize(self):
+        try:
+            # Encrypt the access token before saving it to the state
+            if self._use_oauth and self._oauth_access_token:
+                self._state[ZSCALER_OAUTH_ACCESS_TOKEN_KEY] = self.encrypt(self._oauth_access_token, ZSCALER_OAUTH_ACCESS_TOKEN_KEY)
+                self._state[ZSCALER_OAUTH_TOKEN_ENCRYPTED_KEY] = True
+                self._state[ZSCALER_OAUTH_TOKEN_EXPIRY_TIME_KEY] = (
+                    self._oauth_token_expiry_time.isoformat() if self._oauth_token_expiry_time else None
+                )
+        except Exception as e:
+            self.debug_print(ZSCALER_ENCRYPTION_ERROR_MSG.format(e))
+            return self.set_status(phantom.APP_ERROR, ZSCALER_ENCRYPTION_ERROR_MSG.format(e))
+
         self.save_state(self._state)
         return self._deinit_session()
 
diff --git a/zscaler_consts.py b/zscaler_consts.py
index f261979..3c5d64b 100644
--- a/zscaler_consts.py
+++ b/zscaler_consts.py
@@ -23,6 +23,16 @@
 )
 ZSCALER_MAX_PAGESIZE = 1000
 ZSCALER_DEFAULT_TIMEOUT = 30
+ZSCALER_ENCRYPTION_ERROR_MSG = "Error occurred while encrypting access token: {}"
+ZSCALER_DECRYPTION_ERROR_MSG = "Error occurred while decrypting access token: {}"
+
+# Constants relating to OAuth
+ZSCALER_OAUTH_TOKEN_URL_KEY = "oauth_token_url"
+ZSCALER_OAUTH_CLIENT_ID_KEY = "oauth_client_id"
+ZSCALER_OAUTH_CLIENT_SECRET_KEY = "oauth_client_secret"  # pragma: allowlist secret
+ZSCALER_OAUTH_ACCESS_TOKEN_KEY = "access_token"
+ZSCALER_OAUTH_TOKEN_ENCRYPTED_KEY = "is_encrypted"
+ZSCALER_OAUTH_TOKEN_EXPIRY_TIME_KEY = "expiry_time"
 
 # Constants relating to "_validate_integer"
 ZSCALER_VALID_INTEGER_MSG = "Please provide a valid integer value in the {param}"

From 2273aceacfbf5dac96ef78f31dd7ff21ba94c61a Mon Sep 17 00:00:00 2001
From: Andrei Irimia <andrei.irimia@blackrock.com>
Date: Fri, 14 Aug 2026 14:36:03 +0100
Subject: [PATCH 4/4] chore: reorder import

---
 zscaler_connector.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zscaler_connector.py b/zscaler_connector.py
index b484cb0..bf4e262 100644
--- a/zscaler_connector.py
+++ b/zscaler_connector.py
@@ -21,8 +21,8 @@
 import subprocess
 import sys
 import time
-from urllib.parse import quote
 from datetime import datetime, timedelta
+from urllib.parse import quote
 
 import encryption_helper
 import phantom.app as phantom