Devo and Zscaler

Global threat visibility and security analytics pairing
creates the ultimate solution for cloud-native SOC teams.

+SOLUTION SHEETCORRELATING EVENTS WITH CONTEXT IS ESSENTIAL FOR
SECURITY TEAMSSOC leaders face tremendous challenges. Between dealing

USE CASES

with the shift to remote work and an increasing number ofThreat Detection: Reduce MTTD soanalysts can detect threats early andthen quickly and proactively activate
incident response.

advanced persistent threats (APT), the need for solutions
that protect the cloud-first enterprise has never been
greater. Solutions must correlate events with intelligent
data sources to aid security analysts’ prioritization andThreat Hunting: Hunt with context forthreats across all data — streaming andhistorical — while enabling SOC analysts
to target threats contextually.

investigation efforts.
ENABLE YOUR TEAM TO PROACTIVELY DETECT,HUNT AND ISOLATE THREATS

Devo and Zscaler have created an integration to address
this need, available now for mutual customers. The integration

Threat Alerts: Isolate threats andblock additional compromises, rapidlyand effectively.

consists of Zscaler’s Nanolog Streaming Service consolidatinglogs from all users, globally, in the Devo Platform, whereadministrators can view and mine transaction data by user,device, application and location in real time.

ARCHITECTURE DIAGRAM

TCP Feed
NSS Web
NSS Firewall
Zscaler
Nanolog

NSS

Internet
Gateway

NSS Web

SSL ConnectionNSS

TCP Feed

Devo Relay

Relay Reciever

NSS Firewall

This integration enables SOC teams to proactively monitor and react rapidly to incidents as they occur.
Analysts can visualize, share and understand data in an intuitive way, enhancing and accelerating theirdecision-making process.

1.

Devo & Zscaler - August 2021

The Web Traffic Overview Activeboard in Devo, which
provides overview statistics of web traffic observed
by ZScaler Internet Access (ZIA).

The Threat Overview Activeboard in Devo, which
provides overview statistics of web threats observed
by ZScaler Internet Access (ZIA).

To access the integration, customers need valid Devo and Zscaler user accounts, a Zscaler Nanolog
Streaming Server, as well as a Devo Relay deployed in their infrastructure. To learn more, Devo customers
can review this documentation:
https://docs.devo.com/confluence/ndt/v7.3.0/parsers-and-collectors/collectors/zscaler-integration

Zscaler accelerates digital transformation so customers can be more agile, efficient, resilient, and secure.
The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss by securely
connecting users, devices, and applications in any location. Distributed across more than 150 data centers
globally, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform.

Devo

Devo is the only cloud-native logging and security analytics

255 Main Streetplatform that releases the full potential of your data to empower

Suite 702

bold, confident action. With unrivaled scale to collect all of your dataCambridge, MA 02142

without compromise, speed to give you immediate access and© 2021 Devo All Rights Reserved

answers, and clarity to focus on the signals that matter most, Devo isyour ally in protecting your organization today and tomorrow. Devo is
headquartered in Cambridge, Mass. Learn more at www.devo.com.