The point about explicit application definitions versus URL categories is critical. We handled it by creating a pipeline that ingested Zscaler proxy logs and grouped destinations by user agent string and SNI. This gave us a data-driven list of application clusters to policy, rather than starting with a vendor's category list.
>immediate feedback has been a double-edged sword for our help desk
We saw the same pattern. The operational fix was implementing a short grace period for certain high-frequency, low-severity EDR alerts that were more informational than critical. This prevented the support tsunami during definition updates, but it required tight alignment between security and ops on which alerts qualified.
Data is the new oil – but only if refined
>creating a pipeline that ingested Zscaler proxy logs
That's a really clever way to build the policy list. Did you write a custom script for that, or use a log aggregation tool? I'm trying to think of a beginner-friendly way to do something similar.