Joint Solution BriefZscaler Internet AccessStreamline website access control with LogRhythm’s
centralized data collection and automation

Benefits
Simplify log ingestion and contextualize Zscaler log data
Accelerate detection of unwanted or deny listed URLs
Use a single console to investigate and block suspicious
website access
Speed response with enhanced investigative capabilities

About LogRhythm and Zscaler
LogRhythm and Zscaler work

Solution overview

together to help organizations

Understanding what’s occurring in your network and what websites

insight and confront a variety ofemployees are visiting is crucial to protect your organization. With aZero Trust approach on many organizations’ minds, it’s imperative tohave the right tools to protect networks from threats. The LogRhythm
SmartResponse™ for Zscaler Internet Access gives greater insight
into network activity and enables remediation actions from theLogRhythm console.
As logs are ingested from Zscaler’s Nanolog Streaming Service (NSS)
into the LogRhythm SIEM platform, the LogRhythm SmartResponse
for Zscaler can automatically blacklist the URL in Zscaler, when abanned keyword or URL is detected. The security administrator canadd or obtain information from Zscaler categories (i.e., business use,legal liability, productivity loss, and privacy risk) when investigating
suspicious activity via the Web Console or Mediator Server. The teamcan also use the SmartResponse to create custom categories. If an
alarm detects a custom set of rules, users can pull the Zscaler log policy
information to add to a LogRhythm alarm for further investigation.

around the globe increase network
cloud access security challenges
faced by the modern SOC.
LogRhythm SIEM and Zscaler Cloud
Protection and Internet Access cometogether to facilitate a modern Zero
Trust architecture. LogRhythm andZscaler empower security teams
to navigate a changing threat
landscape with confidence. Together,
LogRhythm and Zscaler are readyto defend.

Other security solutions

MDIAction
MDI

Zscaler provides visability

Data Collector

Analytics

SmartResponse™

LogRhythm collects, enriches, and analyzes data,and orchestrates response

Log collection
Securing an organization’s systems and networks begins
with high-fidelity and trustworthy log data. While othervendors outsource their log collection methodology to theSOC analyst, LogRhythm provides log sources reviewed
by dedicated security experts with dozens of years ofsecurity experience. LogRhythm Machine Data Intelligence(MDI) Fabric optimizes and stabilizes the ideal route ofcollection for over 950 log sources. Our security teams
review these sources and ensure that relevant security data
is normalized with other consumable security data. The
results are trusted logs and alerts that allow for precision
rule creation and comprehensive remediation efforts in theevent of an attack.
Zscaler Nanolog streaming service enables the transmissionof consolidated user activity logs seamlessly to LogRhythm
SIEM in real time. The logs are customizable by analysts forrelevancy before being sent to LogRhythm.

How it works
LogRhythm SIEM collects logs from every device,
application, and sensor in an environment while theMDI Fabric classifies and contextually structures every
log message.
Zscaler Nanolog Streaming Service (NSS) collects andconsolidates Zscaler DNS, firewall, and web logs from users
globally. Security analysts have the ability to customize
and configure log filteration for relevancy into the NSS
feeds, which specify which logs will be streamed. The logs
are then streamed to the LogRhythm platform as syslogs
in real time. From there they are parsed and normalized
to the LogRhythm schema, using features such as ourZscaler takes mitigating action

patented TrueTime™ process, which records the actual
time of occurrence, automatically correcting time zone,
device clock offsets, and collection offsets. Normalized
data is then sent to LogRhythm SIEM for analysis, storage,
and reporting, via a consolidated dashboard of all
security events.

How automated workflows work
To streamline security response workflows, organizations
can use LogRhythm SmartResponse™, which is part ofLogRhythm’s security orchestration, automation, andresponse (SOAR) solution. SmartResponse can be manually
executed in the Web Console and Mediator, as well as
attached to custom AI Engine rules in LogRhythm to
execute if that alarm rule ever triggers.
The LogRhythm SmartResponse for Zscaler performs
several actions including blacklisting a URL, getting policy
information, and adding a URL category. It simplifies
running actions between the SIEM and Zscaler by
centralizing day-to-day security tasks to a single console.
Actions and their use cases are provided in the table on thefollowing page.

SmartResponse for Zscaler
ActionDescription

Use Case

Create Zscaler SRP
configuration file

Execute this response and rerun it before
using other available actions whenever you
change the fixed-value parameter

Functionality that must be run
first, before other SmartResponse
functions can execute

Add new
URL category

Adds a URL category

Add a new custom URL category

Add URL to category

Adds a URL to existing category

Add a custom URL to an
existing category

Denylist URL

Adds a URL to the denylist

Add malicious URL to denylist

Add URL to allowlist

Adds a URL to the allowlist

Add a trusted URL to the allowlist

Get policy
information

Displays information about a URL
filtering policy

Fetch information about anexisting policy

URL lookup

Displays the category for the specified URL

Obtain URL category of amalicious URL

List user

Retrieves a list of all users and allows filtering
by name department or group

Displays list of all the users

Remove URL
from denylist

Removes the specified URL from the denylist

Remove URL from denylist

For more information, request a LogRhythm demo.
logrhythm.com/demo
info@logrhythm.com // 1.866.384.0713 // +44 (0)1628 918 330 // +65 6222 8110 // +61 2 8019 7185
© LogRhythm Inc. | JSB208622-11

www.logrhythm.com