diff --git a/playbooks/Zscaler_Outbound_Traffic_Filtering.json b/playbooks/Zscaler_Outbound_Traffic_Filtering.json
new file mode 100644
index 0000000000..04a5c3c26f
--- /dev/null
+++ b/playbooks/Zscaler_Outbound_Traffic_Filtering.json
@@ -0,0 +1,276 @@
+{
+    "blockly": false,
+    "blockly_xml": "<xml></xml>",
+    "category": "Isolation",
+    "coa": {
+        "data": {
+            "description": "Accepts a URL or list of URLs as input. Blocks the given URLs in ZScaler.\n\nhttps://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/",
+            "edges": [
+                {
+                    "id": "port_0_to_port_4",
+                    "sourceNode": "0",
+                    "sourcePort": "0_out",
+                    "targetNode": "4",
+                    "targetPort": "4_in"
+                },
+                {
+                    "conditions": [
+                        {
+                            "index": 0
+                        }
+                    ],
+                    "id": "port_4_to_port_6",
+                    "sourceNode": "4",
+                    "sourcePort": "4_out",
+                    "targetNode": "6",
+                    "targetPort": "6_in"
+                },
+                {
+                    "id": "port_7_to_port_1",
+                    "sourceNode": "7",
+                    "sourcePort": "7_out",
+                    "targetNode": "1",
+                    "targetPort": "1_in"
+                },
+                {
+                    "id": "port_6_to_port_8",
+                    "sourceNode": "6",
+                    "sourcePort": "6_out",
+                    "targetNode": "8",
+                    "targetPort": "8_in"
+                },
+                {
+                    "conditions": [
+                        {
+                            "index": 0
+                        }
+                    ],
+                    "id": "port_8_to_port_7",
+                    "sourceNode": "8",
+                    "sourcePort": "8_out",
+                    "targetNode": "7",
+                    "targetPort": "7_in"
+                }
+            ],
+            "hash": "ddce2d54e4936120ec7acc772b88f91fab41ec55",
+            "nodes": {
+                "0": {
+                    "data": {
+                        "advanced": {
+                            "join": []
+                        },
+                        "functionName": "on_start",
+                        "id": "0",
+                        "type": "start"
+                    },
+                    "errors": {},
+                    "id": "0",
+                    "type": "start",
+                    "warnings": {},
+                    "x": 19.999999999999986,
+                    "y": -6.394884621840902e-14
+                },
+                "1": {
+                    "data": {
+                        "advanced": {
+                            "join": []
+                        },
+                        "functionName": "on_finish",
+                        "id": "1",
+                        "type": "end"
+                    },
+                    "errors": {},
+                    "id": "1",
+                    "type": "end",
+                    "warnings": {},
+                    "x": 19.999999999999986,
+                    "y": 864
+                },
+                "4": {
+                    "data": {
+                        "advanced": {
+                            "customName": "url input filter",
+                            "customNameId": 0,
+                            "delimiter": ",",
+                            "delimiter_enabled": true,
+                            "description": "Determine branches based on provided inputs.",
+                            "join": [],
+                            "note": "Determine branches based on provided inputs."
+                        },
+                        "conditions": [
+                            {
+                                "comparisons": [
+                                    {
+                                        "conditionIndex": 0,
+                                        "op": "!=",
+                                        "param": "playbook_input:input_url",
+                                        "value": "None"
+                                    }
+                                ],
+                                "conditionIndex": 0,
+                                "customName": "input_url",
+                                "logic": "and"
+                            }
+                        ],
+                        "functionId": 1,
+                        "functionName": "url_input_filter",
+                        "id": "4",
+                        "type": "filter"
+                    },
+                    "errors": {},
+                    "id": "4",
+                    "type": "filter",
+                    "warnings": {},
+                    "x": 60,
+                    "y": 148
+                },
+                "6": {
+                    "data": {
+                        "action": "block url",
+                        "actionType": "contain",
+                        "advanced": {
+                            "customName": "block url",
+                            "customNameId": 0,
+                            "description": "Block urls in ZScaler based on given urls. ",
+                            "join": [],
+                            "note": "Block urls in ZScaler based on given urls. "
+                        },
+                        "connector": "Zscaler",
+                        "connectorConfigs": [
+                            "zscaler"
+                        ],
+                        "connectorId": "ee475421-d2e4-4d8e-addb-a2ce1465d6a3",
+                        "connectorVersion": "v1",
+                        "functionId": 1,
+                        "functionName": "block_url",
+                        "id": "6",
+                        "parameters": {
+                            "url": "filtered-data:url_input_filter:condition_1:playbook_input:input_url"
+                        },
+                        "requiredParameters": [
+                            {
+                                "data_type": "string",
+                                "field": "url"
+                            }
+                        ],
+                        "type": "action"
+                    },
+                    "errors": {},
+                    "id": "6",
+                    "type": "action",
+                    "warnings": {},
+                    "x": 0,
+                    "y": 328
+                },
+                "7": {
+                    "data": {
+                        "advanced": {
+                            "customName": "build observable",
+                            "customNameId": 0,
+                            "description": "This block uses custom code to generate an observable dictionary to output into the observables data path.",
+                            "join": [],
+                            "note": "This block uses custom code to generate an observable dictionary to output into the observables data path."
+                        },
+                        "functionId": 1,
+                        "functionName": "build_observable",
+                        "id": "7",
+                        "inputParameters": [
+                            "block_url:action_result.summary",
+                            "block_url:action_result.status",
+                            "block_url:action_result.message",
+                            "filtered-data:url_input_filter:condition_1:playbook_input:input_url"
+                        ],
+                        "outputVariables": [
+                            "observable_array"
+                        ],
+                        "type": "code"
+                    },
+                    "errors": {},
+                    "id": "7",
+                    "type": "code",
+                    "userCode": "\n    build_observable__observable_array = list()\n    for summary, status, message, url in zip(block_url_result_item_0, block_url_result_item_1, block_url_result_message, filtered_input_0_input_url_values):\n        observable = {\n            \"type\": \"url\",\n            \"value\": url,\n            \"source\": \"ZScaler\"\n        }\n        if len(summary[\"ignored\"]) > 0:\n            observable[\"status\"] = \"ignored\"\n        else:\n            observable[\"status\"] = \"updated\"\n            \n        build_observable__observable_array.append(observable)\n        \n\n",
+                    "warnings": {},
+                    "x": 0,
+                    "y": 700
+                },
+                "8": {
+                    "data": {
+                        "advanced": {
+                            "customName": "block url success filter",
+                            "customNameId": 0,
+                            "delimiter": ",",
+                            "delimiter_enabled": true,
+                            "description": "Determine if the block url action was successful or not.",
+                            "join": [],
+                            "note": "Determine if the block url action was successful or not."
+                        },
+                        "conditions": [
+                            {
+                                "comparisons": [
+                                    {
+                                        "conditionIndex": 0,
+                                        "op": "==",
+                                        "param": "block_url:action_result.status",
+                                        "value": "success"
+                                    }
+                                ],
+                                "conditionIndex": 0,
+                                "customName": "success",
+                                "logic": "and"
+                            }
+                        ],
+                        "functionId": 2,
+                        "functionName": "block_url_success_filter",
+                        "id": "8",
+                        "type": "filter"
+                    },
+                    "errors": {},
+                    "id": "8",
+                    "type": "filter",
+                    "warnings": {},
+                    "x": 60,
+                    "y": 506
+                }
+            },
+            "notes": "Inputs: url\nInteractions: ZScaler\nActions: block url\nOutputs: observables"
+        },
+        "input_spec": [
+            {
+                "contains": [
+                    "url"
+                ],
+                "description": "Accepts url and block them",
+                "name": "input_url"
+            }
+        ],
+        "output_spec": [
+            {
+                "contains": [
+                    "url"
+                ],
+                "datapaths": [
+                    "build_observable:custom_function:observable_array"
+                ],
+                "deduplicate": false,
+                "description": "An array of observable dictionaries with value, type and information about the blocked urls.",
+                "metadata": {},
+                "name": "observable"
+            }
+        ],
+        "playbook_type": "data",
+        "python_version": "3",
+        "schema": "5.0.10",
+        "version": "6.0.1.123902"
+    },
+    "create_time": "2023-06-21T09:27:47.392005+00:00",
+    "draft_mode": false,
+    "labels": [
+        "*"
+    ],
+    "tags": [
+        "url",
+        "D3-OTF",
+        "ZScaler",
+        "denylist"
+    ]
+}
\ No newline at end of file
diff --git a/playbooks/Zscaler_Outbound_Traffic_Filtering.png b/playbooks/Zscaler_Outbound_Traffic_Filtering.png
new file mode 100755
index 0000000000..7f6babff65
Binary files /dev/null and b/playbooks/Zscaler_Outbound_Traffic_Filtering.png differ
diff --git a/playbooks/Zscaler_Outbound_Traffic_Filtering.py b/playbooks/Zscaler_Outbound_Traffic_Filtering.py
new file mode 100644
index 0000000000..f5e7bef5a4
--- /dev/null
+++ b/playbooks/Zscaler_Outbound_Traffic_Filtering.py
@@ -0,0 +1,173 @@
+"""
+Accepts a URL or list of URLs as input. Blocks the given URLs in ZScaler.\n\nhttps://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
+"""
+
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+
+
+@phantom.playbook_block()
+def on_start(container):
+    phantom.debug('on_start() called')
+
+    # call 'url_input_filter' block
+    url_input_filter(container=container)
+
+    return
+
+@phantom.playbook_block()
+def url_input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug("url_input_filter() called")
+
+    ################################################################################
+    # Determine branches based on provided inputs.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["playbook_input:input_url", "!=", None]
+        ],
+        name="url_input_filter:condition_1",
+        delimiter=",")
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        block_url(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def block_url(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug("block_url() called")
+
+    # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+
+    ################################################################################
+    # Block urls in ZScaler based on given urls. 
+    ################################################################################
+
+    filtered_input_0_input_url = phantom.collect2(container=container, datapath=["filtered-data:url_input_filter:condition_1:playbook_input:input_url"])
+
+    parameters = []
+
+    # build parameters list for 'block_url' call
+    for filtered_input_0_input_url_item in filtered_input_0_input_url:
+        if filtered_input_0_input_url_item[0] is not None:
+            parameters.append({
+                "url": filtered_input_0_input_url_item[0],
+            })
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.act("block url", parameters=parameters, name="block_url", assets=["zscaler"], callback=block_url_success_filter)
+
+    return
+
+
+@phantom.playbook_block()
+def build_observable(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug("build_observable() called")
+
+    ################################################################################
+    # This block uses custom code to generate an observable dictionary to output into 
+    # the observables data path.
+    ################################################################################
+
+    block_url_result_data = phantom.collect2(container=container, datapath=["block_url:action_result.summary","block_url:action_result.status","block_url:action_result.message"], action_results=results)
+    filtered_input_0_input_url = phantom.collect2(container=container, datapath=["filtered-data:url_input_filter:condition_1:playbook_input:input_url"])
+
+    block_url_result_item_0 = [item[0] for item in block_url_result_data]
+    block_url_result_item_1 = [item[1] for item in block_url_result_data]
+    block_url_result_message = [item[2] for item in block_url_result_data]
+    filtered_input_0_input_url_values = [item[0] for item in filtered_input_0_input_url]
+
+    build_observable__observable_array = None
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    build_observable__observable_array = list()
+    for summary, status, message, url in zip(block_url_result_item_0, block_url_result_item_1, block_url_result_message, filtered_input_0_input_url_values):
+        observable = {
+            "type": "url",
+            "value": url,
+            "source": "ZScaler"
+        }
+        if len(summary["ignored"]) > 0:
+            observable["status"] = "ignored"
+        else:
+            observable["status"] = "updated"
+            
+        build_observable__observable_array.append(observable)
+        
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_run_data(key="build_observable:observable_array", value=json.dumps(build_observable__observable_array))
+
+    return
+
+
+@phantom.playbook_block()
+def block_url_success_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug("block_url_success_filter() called")
+
+    ################################################################################
+    # Determine if the block url action was successful or not.
+    ################################################################################
+
+    # collect filtered artifact ids and results for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        conditions=[
+            ["block_url:action_result.status", "==", "success"]
+        ],
+        name="block_url_success_filter:condition_1",
+        delimiter=",")
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        build_observable(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+
+@phantom.playbook_block()
+def on_finish(container, summary):
+    phantom.debug("on_finish() called")
+
+    build_observable__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_observable:observable_array")) != "" else "null")  # pylint: disable=used-before-assignment
+
+    output = {
+        "observable": build_observable__observable_array,
+    }
+
+    ################################################################################
+    ## Custom Code Start
+    ################################################################################
+
+    # Write your custom code here...
+
+    ################################################################################
+    ## Custom Code End
+    ################################################################################
+
+    phantom.save_playbook_output_data(output=output)
+
+    return
\ No newline at end of file
diff --git a/playbooks/Zscaler_Outbound_Traffic_Filtering.yml b/playbooks/Zscaler_Outbound_Traffic_Filtering.yml
new file mode 100644
index 0000000000..f99cf8c988
--- /dev/null
+++ b/playbooks/Zscaler_Outbound_Traffic_Filtering.yml
@@ -0,0 +1,24 @@
+name: ZScaler Outbound Traffic Filtering
+id: 3e0df448-0546-4b2b-9143-365161cf40f9
+version: 1
+date: '2023-03-31'
+author: Patrick Bareiss, Splunk
+type: Response
+description: Accepts a URL or list of URLs and block them in ZScaler. Generates a list of observables with the blocked URLs.
+playbook: ZScaler_Outbound_Traffic_Filtering
+how_to_implement: This input playbook requires the ZScaler connector to be configured. It is designed to work in conjunction with the Dynamic URL Outbound Traffic Filtering Analysis playbook or other playbooks in the same style. 
+references:
+  - https://d3fend.mitre.org/technique/d3f:OutboundTrafficFiltering/
+app_list: 
+  - ZScaler
+tags:
+  platform_tags:
+    - denylist
+    - url
+    - D3-OTF
+    - ZScaler
+  playbook_type: Input
+  vpe_type: Modern
+  playbook_fields: []
+  product:
+  - Splunk SOAR
\ No newline at end of file