Zscaler log ingestion

Hi Roberto, if you have the zscaler cloud appliance. You would probably need to configure a feed in chronicle. If you have a the on prem nss log server, you will have to forward  all your log to your collector and configure well. 

HI @phaubertin zscaler is a cloud appliance. The easiest way perhaps is to use a webook feed, but right now they are suspended. To use what you suggest, I would have to copy or publish the logs somewhere(like a S3 bucket), I think

Hi Roberto, I understand that zscaler is cloud appliance. However, Zscaler offer 2 way to sending log to SIEM: VM-based NSS and Cloud NSS (source). 

There is several way to configure the feeds in chronicle. Right now, third party api is not a way for zscaler log ingestion.

I'm not aware how to ingest log with web hook. Chronicle Feeds offer a way to ingest from S3 bucket. 

Wish you luck,

Chronicle currently recommends you leverage native APIs (third party integrations that are supported), and if that isn't available then to leverage the GCS bucket method (or s3). 

https://github.com/chronicle/ingestion-scripts Google has a lot of ingest scripts, but they offer no support on them. I would look into maybe ripping apart some scripts to get zscalar to ingest to a bucket so then you can use Feed Management to ingest from that bucket. 

Depends on the Zscaler products:

1. If ZPA -> https://help.zscaler.com/zscaler-deployments-operations/siem-zpa-integration-deployment-and-operations-guide
Use ISS to send logs over chronicle forwarder or the new collector agent in json format

2. If ZIA -> https://help.zscaler.com/zia/about-insights-logs
Use NSS to send logs over chronicle forwarder or the new collector agent or Use NSS to push the logs via Webhook

Hi @Roberto_Lio 

Seeing as this thread has been resurrected it would be worth mentioning that Webhooks are GA again and instead of needing NSS / Cloud-NSS over Syslog to CFPS we are now able to use Webhooks with the ZIA & ZDX products.

https://help.zscaler.com/zia/about-webhooks
https://help.zscaler.com/zdx/configuring-webhooks

I haven't seen any documentation yet to enable ZPA to be sent using the same method.

Thanks @adam9 for your reply, we'll wait new docs

Correct me if I'm wrong, but I believe this is what you are looking for:

<URL removed by staff>

Thanks @Carlos_Garcia 

PS

for those who don't see the shared link, look on a search engine for "Zscaler and Google SecOps Deployment Guide"

Any update to this documentation for ZPA?

Thank you! The guide mostly worked, but it turnes out Cloud NSS is a separate entitlement/license that not every customer has. @adam9 perhaps the docs could be updated to indicate that! A screenshot might also help, since if the license is not applied that tab is just not visible and when you start setting up a regular NSS feed the settings are not the same.